Information leakage vulnerability in the management server of itC center of Guangdong Paulan Electronics Co.(CNVD-2024-41835)

Ltd. is a high-tech enterprise integrating R&D, design, production, sales and service of audio-visual system overall solution products. There is an information leakage vulnerability in the management server of itC Center of Guangdong Paulan Electronics Co., Ltd. which can be exploited by attacker...

mozilla: WASM type confusion involving ArrayTypes

The Mozilla Foundation's Security Advisory: A difference in the handling of StructFields and ArrayTypes in WASM could be used to trigger an exploitable type confusion vulnerability...

The vulnerability of the Layer-2 Bridge network driver for Windows operating systems allows a hacker to cause a service failure.

The vulnerability of the Layer-2 Bridge network driver for Windows operating systems is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability could allow a malicious actor to cause service failures...

CVE-2024-34130 Acrobat Android : OverSecured Finding : Access to arbitrary* content providers via insecure Intent configuration

Acrobat Mobile Sign Android versions 24.4.2.33155 and earlier are affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could exploit this vulnerability to access confidential information. Exploitation of this issue does not require user...

CVE-2024-36197 Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)

Adobe Experience Manager versions 6.5.20 and earlier Answer: are affected by a DOM-based Cross-Site Scripting XSS vulnerability. This vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser session. Exploitation of this issue requires user...

CVE-2024-4181

The CVE-2024-4181 issue affects llama_index (RunGptLLM class) version 0.9.47 used by RunGpt framework to connect to LLMs. Root cause: unsafe use of eval enabling a malicious or compromised LLM hosting provider to run arbitrary commands on a client machine. Impact statements in sources indicate th...

CVE-2024-1355 Command injection vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Mangement Console

A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain admin SSH access to the appliance via the actions-console docker container while setting a service URL. Exploitation of this vulnerability...

UBUNTU-CVE-2024-20981

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: DDL. Supported versions that are affected are 8.0.35 and prior and 8.2.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server...

PT-2023-18914 · Undefined · Undefined

ParsedReport CompletenessMedium 07-12-2023 Fighting Ursa Aka APT28: Illuminating a Covert Campaign https://unit42.paloaltonetworks.com/russian-apt-fighting-ursa-exploits-cve-2023-233397 Report completeness: Medium Actors/Campaigns: Fancy bear Forest blizzard Threats: Wildfire Victims: Organizatio...

CVE-2023-46764

Unauthorized startup vulnerability of background apps. Successful exploitation of this vulnerability may cause background apps to start maliciously...

The vulnerability of the Docker Desktop platform for developing and delivering container applications lies in the fact that it allows a user to introduce or modify arguments, enabling an attacker to increase their privileges.

The vulnerability of the Docker Desktop platform for developing and delivering container applications is related to the implementation or modification of arguments. Exploiting this vulnerability can allow an attacker to enhance their privileges...

Denial of service

Input parameter verification vulnerability in the communication system. Successful exploitation of this vulnerability may affect availability...

CVE-2023-32324

OpenPrinting CUPS is an open source printing system. In versions 2.4.2 and prior, a heap buffer overflow vulnerability would allow a remote attacker to launch a denial of service DoS attack. A buffer overflow vulnerability in the function formatlogline could allow remote attackers to cause a DoS ...

CVE-2021-46886

The video framework has memory overwriting caused by addition overflow. Successful exploitation of this vulnerability may affect availability...

CVE-2021-46883

The video framework has memory overwriting caused by addition overflow. Successful exploitation of this vulnerability may affect availability...

CVE-2022-48351

The secure OS module has configuration defects. Successful exploitation of this vulnerability may affect availability...

CVE-2023-20854

VMware Workstation contains an arbitrary file deletion vulnerability. A malicious actor with local user privileges on the victim's machine may exploit this vulnerability to delete arbitrary files from the file system of the machine on which Workstation is installed...

Design/Logic Flaw

WEPA Print Away does not verify that a user has authorization to access documents before generating print orders and associated release codes. This could allow an attacker to generate print orders and release codes for documents they don´t own and print hem without authorization. In order to...

CVE-2022-46381

creationtimestamp| type| source ---|---|--- 2022-12-14 00:21:59+00:00| seen| https://t.me/cibsecurity/54467 2022-12-14 10:16:53+00:00| published-proof-of-concept| https://t.me/dilagrafie/2137 2022-12-14 10:16:53+00:00| published-proof-of-concept| https://t.me/dilagrafie/154 2023-01-28...

Code injection

A cleartext storage of sensitive information vulnerability exists in PcVue versions 8.10 through 15.2.3. This could allow an unauthorized user with access the email and short messaging service SMS accounts configuration files to discover the associated simple mail transfer protocol SMTP account...