Code injection

A timing side-channel issue was addressed with improvements to constant-time computation in cryptographic functions. This issue is fixed in macOS Sonoma 14.3, watchOS 10.3, tvOS 17.3, iOS 17.3 and iPadOS 17.3. An attacker may be able to decrypt legacy RSA PKCS1 v1.5 ciphertexts without having the...

CVE-2024-23218

A timing side-channel issue was addressed with improvements to constant-time computation in cryptographic functions. This issue is fixed in iOS 16.7.6 and iPadOS 16.7.6, iOS 17.3 and iPadOS 17.3, macOS Monterey 12.7.4, macOS Sonoma 14.3, macOS Ventura 13.6.5, tvOS 17.3, watchOS 10.3. An attacker...

CVE-2024-23218

A timing side-channel issue was addressed with improvements to constant-time computation in cryptographic functions. This issue is fixed in iOS 16.7.6 and iPadOS 16.7.6, iOS 17.3 and iPadOS 17.3, macOS Monterey 12.7.4, macOS Sonoma 14.3, macOS Ventura 13.6.5, tvOS 17.3, watchOS 10.3. An attacker...

PT-2024-1476 · Redis · Redis

Name of the Vulnerable Software and Affected Versions: Redis versions master-1b8bd86 through master-7b46079 Description: The issue is related to an ODR violation via the component hiredisAllocFns at /opt/fs/redisraft/deps/hiredis/alloc.c. This is associated with a buffer overflow in memory, which...

Uncaught Exception in surrealdb

Although custom parameters and functions are only supported at the database level, it was allowed to invoke those entities at the root or namespace level. This would cause a panic which would crash the SurrealDB server, leading to denial of service. Impact A client that is authorized to run queri...

PT-2024-40347 · Surrealdb · Surrealdb

Name of the Vulnerable Software and Affected Versions: SurrealDB versions prior to 1.1.1 Description: The issue allows authorized clients to invoke custom parameters and functions at the root or namespace level, causing a panic that crashes the SurrealDB server, leading to denial of service. This...

The vulnerability of the BMC (Baseboard Management Controller) on the NVIDIA DGX A100 server allows a hacker to enhance their privileges, gain access to read, modify, or delete data, execute arbitrary code, or cause a service failure.

The vulnerability of the BMC Baseboard Management Controller in NVIDIA’s DGX A100 server lies in the absence of authentication procedures for critical functions. Exploiting this vulnerability allows an attacker to enhance their privileges, gain read, write, or delete access to data, execute...

CVE-2023-52115

The iaware module has a Use-After-Free UAF vulnerability. Successful exploitation of this vulnerability may affect the system functions...

CVE-2023-52115

The iaware module has a Use-After-Free UAF vulnerability. Successful exploitation of this vulnerability may affect the system functions...

Design/Logic Flaw

The iaware module has a Use-After-Free UAF vulnerability. Successful exploitation of this vulnerability may affect the system functions...

CVE-2023-52115

The iaware module has a Use-After-Free UAF vulnerability. Successful exploitation of this vulnerability may affect the system functions...

CVE-2023-52115

The CVE-2023-52115 entry concerns the iaware module with a Use-After-Free (UAF) vulnerability that may affect system functions. CVSS data indicate HIGH availability impact, Network attack vector, Low attack complexity, No privileges required, No user interaction. Connected documents tie this to H...

CVE-2023-52115

The iaware module has a Use-After-Free UAF vulnerability. Successful exploitation of this vulnerability may affect the system functions...

PT-2024-14412 · Unknown · Haware Module

Name of the Vulnerable Software and Affected Versions: iaware module affected versions not specified Description: The iaware module has a Use-After-Free UAF vulnerability. Successful exploitation of this vulnerability may affect the system functions. Recommendations: At the moment, there is no...

MailerLite – WooCommerce integration < 2.0.9 - Cross-Site Request Forgery via Multiple AJAX Functions

Description The MailerLite – WooCommerce integration plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.8. This is due to missing or incorrect nonce validation on multiple AJAX functions. This makes it possible for unauthenticated attackers to...

Apollo Authorization Issues Vulnerabilities

Apollo is a set of PHP scripts by Alex Breen, an individual developer. It is intended to provide a web-based interface for students to upload course assignments. An authorization issue vulnerability exists in Apollo versions 2.0.0 and 2.0.1, which stems from the inclusion of unknown functions in...

NVIDIA DGX Security Vulnerability

NVIDIA DGX is a high-performance workstation for deep learning applications from NVIDIA. A security vulnerability exists in the NVIDIA DGX A100 Servers that originates from a user that could result in a loss of authentication for critical functions on neighboring networks...

CVE-2023-6883

The Easy Social Feed plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple AJAX functions in all versions up to, and including, 6.5.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to...

Design/Logic Flaw

The Easy Social Feed plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple AJAX functions in all versions up to, and including, 6.5.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to...

CVE-2023-6883 Easy Social Feed <= 6.5.2 - Missing Authorization to Settings Modification

The Easy Social Feed plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple AJAX functions in all versions up to, and including, 6.5.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to...