CVE-2024-32359

An RBAC authorization risk in Carina v0.13.0 and earlier allows local attackers to execute arbitrary code through designed commands to obtain the secrets of the entire cluster and further take over the cluster...

Typora 跨站脚本漏洞

Typora is an editor. A cross-site scripting vulnerability exists in Typora versions v1.0.0 through v1.7, which stems from a cross-site scripting vulnerability in the Markdown editor that can be exploited by an attacker to upload a Markdown file to execute arbitrary code...

CVE-2024-23774

An unquoted Windows search path vulnerability exists in the KSchedulerSvc.exe and AMPTools.exe components of Quest KACE Agent for Windows versions 12.0.38 and 13.1.23.0 . This flaw allows local attackers to execute arbitrary code with NT Authority\SYSTEM privileges. To remediate, users are advise...

Devellion CubeCart 安全漏洞

Devellion CubeCart is a free and open source e-commerce shopping cart software from the company of Devellion UK. The software supports selling products, adding/editing products or images, etc. in an online store. A security vulnerability exists in Devellion CubeCart versions prior to 6.5.5, which...

CVE-2024-32418

An issue in flusity CMS v2.33 allows a remote attacker to execute arbitrary code via the addaddon.php component...

The vulnerability of the Pandora FMS system for monitoring and managing IT environments lies in the improper restriction on the path name to the restricted access catalog. This allows attackers to write arbitrary files into the system and execute arbitrary code.

The vulnerability of the Pandora FMS system for monitoring and managing IT environments stems from incorrect restrictions on the path name used to access the restricted catalog. Exploiting this vulnerability allows a malicious actor to write arbitrary files into the system and execute arbitrary...

CVE-2023-49502

Buffer Overflow vulnerability in Ffmpeg v.n6.1-3-g466799d4f5 allows a local attacker to execute arbitrary code via the ffbwdiffilterintrac function in the libavfilter/bwdifdsp.c:125:5 component...

CVE-2024-31784

An issue in Typora v.1.8.10 and before, allows a local attacker to obtain sensitive information and execute arbitrary code via a crafted payload to the src component...

Typora 安全漏洞

Typora is an editor. A security vulnerability exists in Typora v.1.8.10 and earlier versions that originated from a vulnerability that allows a local attacker to obtain sensitive information and execute arbitrary code via a crafted src component payload...

CVE-2024-30885

Reflected Cross-Site Scripting XSS vulnerability in HadSky v7.6.3, allows remote attackers to execute arbitrary code and obtain sensitive information via the chklogin.php component...

CVE-2024-31492

An external control of file name or path vulnerability CWE-73 in FortiClientMac version 7.2.3 and below, version 7.0.10 and below installer may allow a local attacker to execute arbitrary code or commands via writing a malicious configuration file in /tmp before starting the installation process...

Vulnerabilities fixed in Microsoft Defender for IoT

Microsoft has fixed vulnerabilities in Defender for IoT. A malicious party can exploit the vulnerabilities to afford elevated permissions and execute arbitrary code with permissions of the process. Microsoft has made updates available that fix the described vulnerabilities described. We recommend...

PT-2024-18163 · Unknown · Parisneo/Lollms-Webui

Name of the Vulnerable Software and Affected Versions: parisneo/lollms-webui affected versions not specified Description: The issue arises due to inadequate sanitization and validation of model output data, allowing an attacker to inject malicious JavaScript code. This code can be executed within...

Microsoft Windows Internet Shortcut SmartScreen Bypass Vulnerability

This vulnerability allows remote attackers to bypass the SmartScreen security feature to execute arbitrary code on affected installations of Microsoft Windows. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The...

PT-2024-3000 · Microsoft · Windows 7 +2

Name of the Vulnerable Software and Affected Versions: Lenovo preloaded Windows versions 7 through 8 Description: A buffer overflow vulnerability was reported in a system recovery bootloader that could allow a privileged attacker with local access to execute arbitrary code. The vulnerability is...

CVE-2024-29863

A race condition exists in the Qlik Qlikview installer executable in versions prior to May 2022 SR3 (12.70.20300) and May 2023 SR2 (12.80.20200) . The vulnerability stems from improper synchronization when using a shared resource, specifically during an MSI repair operation. An attacker can explo...

CVE-2024-25693

There is a path traversal in Esri Portal for ArcGIS versions = 11.2. Successful exploitation may allow a remote, authenticated attacker to traverse the file system to access files or execute code outside of the intended directory...

Button < 1.1.28 - Contributor+ PHP Object Injection in button_shortcode

Description The plugin is vulnerable to PHP Object Injection via deserialization of untrusted input in the buttonshortcode function. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable...

CVE-2024-28853 Ampache Stored XSS

Ampache is a web based audio/video streaming application and file manager. Stored Cross Site Scripting XSS vulnerability in ampache before v6.3.1 allows a remote attacker to execute code via a crafted payload to serval parameters in the post request of...

FreeImage 安全漏洞

FreeImage is a cross-platform open source library for supporting popular graphic image formats. FreeImage suffers from a buffer overflow vulnerability that originates when the program fails to properly validate the length and size of input data, which can be exploited by a local attacker to execu...