AZL-54327 CVE-2024-45337 affecting package cf-cli for versions less than 8.7.3-4

Applications and libraries which misuse connection.serverAuthenticate via callback field ServerConfig.PublicKeyCallback may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is...

Important: dotnet8.0

Issue Overview: .NET and Visual Studio Remote Code Execution Vulnerability CVE-2024-38229 .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability CVE-2024-43483 .NET, .NET Framework, and Visual Studio Denial of Service Vulnerability CVE-2024-43484 .NET and Visual Studio Denial of...

Important: libsoup

Issue Overview: GNOME libsoup before 3.6.0 allows HTTP request smuggling in some configurations because '\0' characters at the end of header names are ignored, i.e., a "Transfer-Encoding\0: chunked" header is treated the same as a "Transfer-Encoding: chunked" header. CVE-2024-52530 GNOME libsoup...

Gallagher Controller 6000和Gallagher Controller 7000 安全漏洞

The Gallagher Controller 6000 and Gallagher Controller 7000 are both products of Gallagher New Zealand.The Gallagher Controller 6000 is an interface between a Gallagher Command Center server and distributed field hardware. The Gallagher Controller 7000 is a powerful network connected controller. ...

PT-2024-17630 · Classcms · Classcms

Name of the Vulnerable Software and Affected Versions: ClassCMS version 4.8 Description: A problematic vulnerability was found in ClassCMS, affecting an unknown functionality of the file /index.php/admin of the component Model Management Page. The manipulation of the URL argument leads to...

WordPress WPCargo Track & Trace plugin <= 8.0.2 - Settings Change vulnerability

Settings Change vulnerability discovered by Mika Patchstack Alliance in WordPress Plugin WPCargo Track & Trace versions = 8.0.2...

SUSE-SU-2024:4291-1 Security update for python312

This update for python312 fixes the following issues: - CVE-2024-12254: Fixed unbounded memory buffering in SelectorSocketTransport.writelines bsc1234290 Other fixes: - Updated to version 3.12.8 - Remove -IVendor/ from python-config bsc1231795...

Security update for libsoup2

This update for libsoup2 fixes the following issues: CVE-2024-52530: Fixed HTTP request smuggling via stripping null bytes from the ends of header names bsc1233285 CVE-2024-52531: Fixed buffer overflow via UTF-8 conversion in soupheaderparseparamliststrict bsc1233292 CVE-2024-52532: Fixed infinit...

CVE-2024-51165

SQL injection vulnerability in JEPAAS7.2.8, via /je/rbac/rbac/loadLoginCount in the dateVal parameter, which could allow a remote user to submit a specially crafted query, allowing an attacker to retrieve all the information stored in the DB...

UBUNTU-CVE-2024-55634

A vulnerability in Drupal Core allows Privilege Escalation.This issue affects Drupal Core: from 8.0.0 before 10.2.11, from 10.3.0 before 10.3.9, from 11.0.0 before 11.0.8...

JEPaaS 安全漏洞

JEPaaS is a rapid development platform from China's Kate Weiye JEPaaS. A security vulnerability exists in JEPaaS version 7.2.8. An attacker exploiting the vulnerability can retrieve all information stored in the database...

WordPress plugin System Dashboard 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPress...

CVE-2024-50930

CVE-2024-50930 affects Silicon Labs Z-Wave Series 500, specifically version 6.84.0. The issue allows attackers to execute arbitrary code. The available connected docs confirm the product/version and the impact but do not provide root-cause details or exploit specifics. Mitigation guidance in PT S...

CVE-2024-12369

A vulnerability was found in OIDC-Client. When using the RH SSO OIDC adapter with EAP 7.x or when using the elytron-oidc-client subsystem with EAP 8.x, authorization code injection attacks can occur, allowing an attacker to inject a stolen authorization code into the attacker's own session with t...

CVE-2023-50904

Missing Authorization vulnerability in Poll Maker Team Poll Maker allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Poll Maker: from n/a through 4.8.0...

CVE-2023-28168 WordPress WordPress Console plugin <= 0.3.9 - Broken Access Control vulnerability

Missing Authorization vulnerability in Jerod Santo WordPress Console allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordPress Console: from n/a through 0.3.9...

WordPress plugin IdeaPush 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2024-14002 · Unknown · Poll Maker

Name of the Vulnerable Software and Affected Versions: Poll Maker versions through 4.8.0 Description: The issue is related to a Missing Authorization vulnerability in Poll Maker, allowing exploitation of incorrectly configured access control security levels. Recommendations: For versions through...

The vulnerability of the command-line interface (CLI) of the Instant AOS-8 and AOS-10 operating systems, which allows a hacker to gain unauthorized access to protected information

The vulnerability of the command-line interface CLI of the Instant AOS-8 and AOS-10 operating systems is related to incorrect restrictions on the path name to the restricted-access directory. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized acces...

The vulnerability of the command-line interface (CLI) of the Instant AOS-8 and AOS-10 operating systems, which allows a hacker to escalate their privileges and execute arbitrary code.

The vulnerability of the command-line interface CLI of the Instant AOS-8 and AOS-10 operating systems is related to the lack of measures taken to clean data at the management level. Exploiting this vulnerability can allow a malicious actor to increase their privileges and execute arbitrary code b...