PT-2024-21809

Name of the Vulnerable Software and Affected Versions aiohttp versions prior to 3.9.4 Description A XSS vulnerability exists on index pages for static file handling. This issue arises when using web.static..., show index=True, as the resulting index pages do not escape file names, making the serv...

PT-2024-3331 · D Link · D-Link Dir-845L

Name of the Vulnerable Software and Affected Versions: D-LINK DIR-845L versions =v1.01KRb03 Description: The issue is related to insufficient protection of internal data when handling the file parameter, potentially allowing a remote attacker to gain unauthorized access to protected information...

SAP Asset Accounting 安全漏洞

SAP Asset Accounting is an asset accounting program from SAP, Germany. It is used to manage and monitor fixed assets. A security vulnerability exists in SAP Asset Accounting that stems from allowing an elevated-privilege attacker to exploit insufficient authentication of user-supplied path...

forgejo -- multiple issues

The forgejo team reports: CVE-2024-24789: The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment could be exploited to create an zip file with contents that vary depending on the implementation reading the...

Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of...

CVE-2024-1532

A vulnerability exists in the stb-language file handling that affects the RTU500 series product versions listed below. A malicious actor could enforce diagnostic texts being displayed as empty strings, if an authorized user uploads a specially crafted stb-language file...

CVE-2024-1532

Hitachi Energy RTU500 CMU Firmware is affected by CVE-2024-1532 (stb-language file handling). A specially crafted stb-language file uploaded by an authorized user could cause diagnostic texts to be displayed as empty strings. Affected firmware ranges include 12.0.1–12.0.14, 12.2.1–12.2.11, 12.4.1...

CVE-2024-1532

A vulnerability exists in the stb-language file handling that affects the RTU500 series product versions listed below. A malicious actor could enforce diagnostic texts being displayed as empty strings, if an authorized user uploads a specially crafted stb-language file...

CVE-2024-1531

CVE-2024-1531 affects Hitachi Energy RTU500 series CMU Firmware due to a flaw in the stb-language file handling. Affected firmware ranges include 12.0.1–12.0.14, 12.2.1–12.2.11, 12.4.1–12.4.11, 12.6.1–12.6.9, 12.7.1–12.7.6, 13.2.1–13.2.6, 13.4.1–13.4.4, and 13.5.1–13.5.3. The vulnerability could ...

PT-2024-18118 · Unknown · Rtu500 Series

Name of the Vulnerable Software and Affected Versions: RTU500 series product affected versions not specified Description: A vulnerability exists in the stb-language file handling. A malicious actor could enforce diagnostic texts being displayed as empty strings, if an authorized user uploads a...

EasyAdmin 安全漏洞

Easyadmin is a simple, lightweight backend management system scaffolding by laker individual developers. A security vulnerability exists in EasyAdmin version 20240315 and earlier versions, which stems from path traversal due to incorrect manipulation of the parameter file...

CVE-2024-1623

Insufficient session timeout vulnerability in the FAST3686 V2 Vodafone router from Sagemcom. This vulnerability could allow a local attacker to access the administration panel without requiring login credentials. This vulnerability is possible because the 'Login.asp and logout.asp' files do not...

SUSE-SU-2024:0882-1 Security update for hdf5

This update for hdf5 fixes the following issues: Updated to version 1.10.11 Changed the error handling for a not found path in the find plugin process. Fixed CVE-2018-11202, a malformed file could result in chunk index memory leaks. Fixed a file space allocation bug in the parallel library for...

CVE-2024-2403

Improper cleanup in temporary file handling component in Devolutions Remote Desktop Manager 2024.1.12 and earlier on Windows allows an attacker that compromised a user endpoint, under specific circumstances, to access sensitive information via residual files in the temporary directory...

CVE-2024-2403

Improper cleanup in temporary file handling component in Devolutions Remote Desktop Manager 2024.1.12 and earlier on Windows allows an attacker that compromised a user endpoint, under specific circumstances, to access sensitive information via residual files in the temporary directory...

CVE-2024-2403

CVE-2024-2403 affects Devolutions Remote Desktop Manager prior to 2024.1.12 on Windows. The root cause is improper cleanup in the temporary file handling component, which may allow an attacker who has already compromised a user endpoint to access sensitive information via residual files in the te...

Devolutions Remote Desktop Manager Security Vulnerability

Devolutions Remote Desktop Manager is an application from Devolutions Canada. It provides remote desktop management functionality. A security vulnerability exists in Devolutions Remote Desktop Manager version 2024.1.12 and earlier, which stems from a sensitive information disclosure vulnerability...

CVE-2024-23230

This issue was addressed with improved file handling. This issue is fixed in macOS Sonoma 14.4, macOS Monterey 12.7.4, macOS Ventura 13.6.5. An app may be able to access sensitive user data...

CVE-2024-23230

CVE-2024-23230 affects macOS (Sonoma 14.4, Monterey 12.7.4, Ventura 13.6.5). The vulnerability is due to improper file handling, allowing an app to access sensitive user data. Fixes are included in the listed macOS releases: Sonoma 14.4, Monterey 12.7.4, Ventura 13.6.5. No exploitation details ar...

PT-2024-19725 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 12.7.4 macOS versions prior to 13.6.5 macOS versions prior to 14.4 Description: The issue allows an app to potentially access sensitive user data due to inadequate file handling. This has been addressed with improved...