8953 matches found
DerbyNet 安全漏洞
DerbyNet is a simple code for a match broadcasting program. A SQL injection vulnerability exists in the DerbyNet print/render/award.inc script, which can be exploited by an attacker to be able to view, add, modify, or delete information in the back-end database...
DEBIAN-CVE-2024-26871
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix NULL pointer dereference in f2fssubmitpagewrite BUG: kernel NULL pointer dereference, address: 0000000000000014 RIP: 0010:f2fssubmitpagewrite+0x6cf/0x780 f2fs Call Trace: ? showregs+0x6e/0x80 ? die+0x29/0x70 ?...
UBUNTU-CVE-2024-26871
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix NULL pointer dereference in f2fssubmitpagewrite BUG: kernel NULL pointer dereference, address: 0000000000000014 RIP: 0010:f2fssubmitpagewrite+0x6cf/0x780 f2fs Call Trace: ? showregs+0x6e/0x80 ? die+0x29/0x70 ?...
UBUNTU-CVE-2024-26820
In the Linux kernel, the following vulnerability has been resolved: hvnetvsc: Register VF in netvscprobe if NETDEVICEREGISTER missed If hvnetvsc driver is unloaded and reloaded, the NETDEVICEREGISTER handler cannot perform VF register successfully as the register call is received before netvscpro...
Elber ESE DVB-S/S2 Satellite Receiver 1.5.x Device Config
Summary ESE Elber Satellite Equipment product line, designed for the high-end radio contribution and distribution market, where quality and reliability are most important. The Elber IRD Integrated Receiver Decoder ESE-01 offers a professional audio quality and composite video at an excellent...
GHSA-8CPH-M685-6V6R OpenFGA Authorization Bypass
Overview Some end users of OpenFGA v1.5.0 or later are vulnerable to authorization bypass when calling Check or ListObjects APIs. Am I Affected? You are very likely affected if your model involves exclusion e.g. a but not b or intersection e.g. a and b and you have any cyclical relationships. If...
CVE-2024-31452 OpenFGA Authorization Bypass
OpenFGA is a high-performance and flexible authorization/permission engine. Some end users of OpenFGA v1.5.0 or later are vulnerable to authorization bypass when calling Check or ListObjects APIs. You are very likely affected if your model involves exclusion e.g. a but not b or intersection e.g. ...
Sensitive Information Disclosure
OpenTelemetry.Instrumentation.AspNetCore and OpenTelemetry.Instrumentation.Http are vulnerable to Sensitive Information Disclosure. The vulnerability is due to the url.full attribute/tag on spans Activity writing the raw query string to logs, which can potentially expose sensitive data such as En...
CVE-2024-3774
aEnrich Technology a+HRD's functionality for front-end retrieval of system configuration values lacks proper restrictions on a specific parameter, allowing attackers to modify this parameter to access certain sensitive system configuration values...
CVE-2024-3774
aEnrich Technology a+HRD's functionality for front-end retrieval of system configuration values lacks proper restrictions on a specific parameter, allowing attackers to modify this parameter to access certain sensitive system configuration values...
ROS-20240412-06
A vulnerability in the OpenSSL library's implementation of the SM2 cryptographic algorithm is related to buffer copying without checking the size of the input data. Exploitation of the vulnerability could allow an attacker acting remotely to execute arbitrary code by transmitting specially crafte...
Apple warns people of mercenary attacks via threat notification system
Apple has reportedly sent alerts to individuals in 92 nations on Wednesday, April 10, to say its detected that they may have been a victim of a mercenary attack. The company says it has sent out these types of threat notifications to over 150 countries since the start in 2021. Mercenary spyware i...
Critical RCE Flaw Found in EoL D-Link NAS Devices
...
File Upload Injection
contao/core-bundle is vulnerable to File Upload Injection. The vulnerability is due to inadequate sanitization of filenames during the upload process, which allows users to inject malicious code in filenames, leading to code execution in tooltips and popups in the back end...
Wordpress Plugin Essential Grid 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...
Contao: Remember-me tokens will not be cleared after a password change
Impact When a front end member changes their password, the corresponding remember-me tokens are not removed. Patches Update to Contao 4.13.40. Workarounds Disable "Allow auto login" in the login module. References...
CVE-2024-28190
Contao core/file management is vulnerable to Cross‑Site Scripting via filenames during file upload. In Contao 4.x and 5.x, versions prior to 4.13.40 and 5.3.4 allow attackers to inject malicious code in uploaded filenames, which is then executed in backend tooltips and popups. Affected versions i...
CVE-2024-28190 Contao core bundle vulnerable to cross site scripting in the file manager
Contao is an open source content management system. Starting in version 4.0.0 and prior to version 4.13.40 and 5.3.4, users can inject malicious code in filenames when uploading files back end and front end, which is then executed in tooltips and popups in the back end. Contao versions 4.13.40 an...
