GHSA-53Q7-4874-24QG Information Disclosure Vulnerability in Privacy Center of SERVER_SIDE_FIDES_API_URL

SERVERSIDEFIDESAPIURL is a server-side configuration environment variable used by the Fides Privacy Center to communicate with the Fides webserver backend. The value of this variable is a URL which typically includes a private IP address, private domain name, and/or port. This vulnerability allow...

Information Disclosure Vulnerability in Privacy Center of SERVER_SIDE_FIDES_API_URL

SERVERSIDEFIDESAPIURL is a server-side configuration environment variable used by the Fides Privacy Center to communicate with the Fides webserver backend. The value of this variable is a URL which typically includes a private IP address, private domain name, and/or port. This vulnerability allow...

PT-2024-7053

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.50 Description The issue is related to a mistake in the rtw89 sta info get iter function, where status-he gi is compared to array size, but then rate-he gi is used as an array index instead of status-he gi...

CVE-2024-37767

CVE-2024-37767 affects 14Finger v1.1. The issue is insecure permissions in the component "/api/admin/user", enabling an attacker to access all user information via a crafted GET request. Reported across multiple sources (NVD, Red Hat, OSV, CNNVD, CVEs lists). The underlying problem is improper ac...

14Finger Security Vulnerability

14Finger is a full-featured Web fingerprint recognition and sharing platform by b1ackc4t individual developers. A security vulnerability exists in 14Finger version 1.1, which stems from the /api/admin/user component that allows an attacker to access all user information via a crafted GET request...

CVE-2024-37767

Insecure permissions in the component /api/admin/user of 14Finger v1.1 allows attackers to access all user information via a crafted GET request...

The vulnerability of microprogrammed software in serial interface industrial converters of the Ethernet Westermo EDW-100, related to the storage of passwords as plain text, allows a hacker to disclose information about the user’s name and password for any user account.

The vulnerability of the microprogrammed industrial converter’s serial interface Ethernet implementation, the Westermo EDW-100, lies in the storage of passwords as plain-text files in the configuration file. Exploiting this vulnerability allows a malicious actor to obtain information about the...

CVE-2024-31223

Fides is an open-source privacy engineering platform, and SERVERSIDEFIDESAPIURL is a server-side configuration environment variable used by the Fides Privacy Center to communicate with the Fides webserver backend. The value of this variable is a URL which typically includes a private IP address,...

CVE-2024-31223 Fides Information Disclosure Vulnerability in Privacy Center of SERVER_SIDE_FIDES_API_URL

Fides is an open-source privacy engineering platform, and SERVERSIDEFIDESAPIURL is a server-side configuration environment variable used by the Fides Privacy Center to communicate with the Fides webserver backend. The value of this variable is a URL which typically includes a private IP address,...

CVE-2024-31223 Fides Information Disclosure Vulnerability in Privacy Center of SERVER_SIDE_FIDES_API_URL

Fides is an open-source privacy engineering platform, and SERVERSIDEFIDESAPIURL is a server-side configuration environment variable used by the Fides Privacy Center to communicate with the Fides webserver backend. The value of this variable is a URL which typically includes a private IP address,...

CVE-2024-31223 Fides Information Disclosure Vulnerability in Privacy Center of SERVER_SIDE_FIDES_API_URL

Fides is an open-source privacy engineering platform, and SERVERSIDEFIDESAPIURL is a server-side configuration environment variable used by the Fides Privacy Center to communicate with the Fides webserver backend. The value of this variable is a URL which typically includes a private IP address,...

CVE-2024-5672 Red Lion Europe: mbNET.mini vulnerable to OS command injection

A high privileged remote attacker can execute arbitrary system commands via GET requests due to improper neutralization of special elements used in an OS command...

CVE-2024-5672 Red Lion Europe: mbNET.mini vulnerable to OS command injection

A high privileged remote attacker can execute arbitrary system commands via GET requests due to improper neutralization of special elements used in an OS command...

MB Connect Line mbNET.mini OS Command Injection Vulnerability

MB Connect Line mbNET.mini is an industrial router from MB Connect Line, Germany. An operating system command injection vulnerability exists in MB Connect Line mbNET.mini version 2.2.11 and earlier, which stems from an improper neutralization of special elements used in operating system commands,...

PT-2024-37032 · Helmholz +2 · Rex100 +2

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: A high privileged remote attacker can execute arbitrary system commands via GET requests due to improper neutralization of special elements used in an O...

kernel: udf: Fix NULL pointer dereference in udf_symlink function

A vulnerability was found in the Linux kernel's UDF file system driver, where the udfsymlink function can dereference a NULL pointer. This occurs because the function uses a value returned from udftgetblk without checking if it is NULL, potentially causing system crashes if sbgetblk fails...

The vulnerability of the get_ip_addr_details function (/view/dhcp/dhcpConfig/commit.php) in Ruijie RG-UAC router software allows a attacker to execute arbitrary commands.

The vulnerability of the getipaddrdetails function /view/dhcp/dhcpConfig/commit.php in Ruijie RG-UAC router software exists due to the failure to address special elements used in operating system commands. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands via th...

The vulnerability of the get_ip.addr_details function in Ruijie RG-UAC router microprogramming software allows a hacker to execute arbitrary commands.

The vulnerability of the getip.addrdetails function /view/vpn/autovpn/sxhvpnlic.php in Ruijie RG-UAC router software exists due to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to execute arbitrary commands remotely...

clk: Fix clk_core_get NULL dereference

...

Go before 1.14.14 and 1.15.x before 1.15.7 on Windows is vulnerable to Command Injection and remote code execution when using the "go get" command to fetch modules that make use of cgo (for example cgo can execute a gcc program from an untrusted download).

...