CVE-2024-34687 Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application server for ABAP and ABAP Platform

SAP NetWeaver Application Server for ABAP and ABAP Platform do not sufficiently encode user controlled inputs, resulting in Cross-Site Scripting XSS vulnerability. An attacker can control code that is executed within a user’s browser, which could result in modification, deletion of data, includin...

PT-2024-40004 · Scrapy · Scrapy

Name of the Vulnerable Software and Affected Versions: Scrapy versions prior to 2.11.2 Description: The issue allows a malicious actor with write access to the start requests and read access to the spider output to exploit the vulnerability. This can be done by redirecting to any local file using...

Siemens SIMATIC CN 4100 安全漏洞

The Siemens SIMATIC CN 4100 is a communication node from Siemens, Germany. A security vulnerability exists in the Siemens SIMATIC CN 4100 because the affected device contains an unrestricted USB port. An attacker can exploit the vulnerability to potentially misuse the port to boot another operati...

General Electric Healthcare Ultrasound 路径遍历漏洞

GE General Electric Healthcare Ultrasound is a medical sonic detection device from General Electric GE. A path traversal vulnerability exists in General Electric Healthcare Ultrasound. An attacker could exploit this vulnerability to access files and directories stored outside of the web root fold...

General Electric Healthcare Ultrasound 路径遍历漏洞

GE General Electric Healthcare Ultrasound is a medical sonic detection device from General Electric GE. A path traversal vulnerability exists in General Electric Healthcare Ultrasound. An attacker could exploit this vulnerability to access files and directories stored outside of the web root fold...

CVE-2024-23236

A correctness issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.5. An app may be able to read arbitrary files...

CVE-2024-23236

A correctness issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.5. An app may be able to read arbitrary files...

Apple macOS Sonoma 安全漏洞

Apple macOS is a specialized operating system developed for Mac computers by Apple Inc. in the United States. A security vulnerability exists in Apple macOS Sonoma. An attacker exploiting the vulnerability is able to read arbitrary files...

RHEL 7 : kubernetes (Unpatched Vulnerability)

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched. - kubernetes: Privilege escalation in the PodSecurityPolicy admission plugin CVE-2017-1000056 - In Kubernet...

CVE-2024-4545

CVE-2024-4545 affects EnterpriseDB Postgres Advanced Server (EPAS). All EPAS versions 15.0 up to 15.7.0 and 16.0 up to 16.3.0 permit users using edbldr to bypass role permissions from pg_read_server_files, allowing low-privilege users to read files they would normally be unable to access. The und...

CVE-2024-34365 Apache Karaf Cave: Cave SSRF and arbitrary file access

UNSUPPORTED WHEN ASSIGNED Improper Input Validation vulnerability in Apache Karaf Cave.This issue affects all versions of Apache Karaf Cave. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to th...

CVE-2024-34365 Apache Karaf Cave: Cave SSRF and arbitrary file access

UNSUPPORTED WHEN ASSIGNED Improper Input Validation vulnerability in Apache Karaf Cave.This issue affects all versions of Apache Karaf Cave. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to th...

UBUNTU-CVE-2024-33870

An issue was discovered in Artifex Ghostscript before 10.03.1. There is path traversal via a crafted PostScript document to arbitrary files if the current directory is in the permitted paths. For example, there can be a transformation of ../../foo to ./../../foo and this will grant access if ./ i...

PT-2024-24323 · Unknown · Sonic Shopfloor.Guide

Name of the Vulnerable Software and Affected Versions: Sonic Shopfloor.guide versions prior to 3.1.3 Description: A SQL injection issue in unit.php allows remote attackers to execute arbitrary SQL commands via the level2 parameter. This enables attackers to manipulate database queries, potentiall...

CVE-2024-34346

Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. The Deno sandbox may be unexpectedly weakened by allowing file read/write access to privileged files in various locations on Unix and Windows platforms. For example, reading /proc/self/environ may provide access...

CVE-2024-34346 Deno contains a permission escalation via open of privileged files with missing `--deny` flag

Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. The Deno sandbox may be unexpectedly weakened by allowing file read/write access to privileged files in various locations on Unix and Windows platforms. For example, reading /proc/self/environ may provide access...

CVE-2024-34346

CVE-2024-34346 affects Deno and describes a permission-escalation via opening privileged files (e.g., reading /proc/self/environ, writing /proc/self/mem) when sandbox permissions are opened with --allow-read/--allow-write. The issue arises because the sandbox can be weakened if deny flags are not...

GHSA-GQMF-JQGV-V8FW Pterodactyl Wings vulnerable to Arbitrary File Write/Read

Impact If the Wings token is leaked either by viewing the node configuration or posting it accidentally somewhere, an attacker can use it to gain arbitrary file write and read access on the node the token is associated to. Workarounds Enabling the ignorepanelconfigupdates option or updating to th...

CVE-2024-34066

Pterodactyl wings is the server control plane for Pterodactyl Panel. If the Wings token is leaked either by viewing the node configuration or posting it accidentally somewhere, an attacker can use it to gain arbitrary file write and read access on the node the token is associated to. This issue h...

CVE-2024-34066

The CVE-2024-34066 issue affects Pterodactyl Wings (github.com/pterodactyl/wings). If the Wings token is leaked (for example via node configuration exposure or accidental posting), an attacker can gain arbitrary file write and read access on the associated node. Root cause: leaked token enabling ...