Mattermost Server 安全漏洞

Mattermost Server is an open source messaging platform from Mattermost, Inc. in the United States. A security vulnerability exists in Mattermost Server versions prior to 9.5.2, prior to 9.4.4, prior to 9.3.3, and prior to 8.1.11, which stems from a lack of proper access control in /api/v4/, where...

CVE-2024-22189

A flaw was found in quic-go. This issue may allow an attacker to trigger a denial of service by sending a large number of NEWCONNECTIONID frames that retire old connection IDs. The receiver is supposed to respond to each retirement frame with a RETIRECONNECTIONID frame, but the attacker can preve...

HackerOne: Attachment disclosure via summary report

A critical vulnerability was discovered in the HackerOne platform that allowed an attacker to gain unauthorized access to attachments belonging to other users through the report summary editing functionality. By manipulating attachment IDs in the request, an attacker could view sensitive files th...

CVE-2024-29667

SQL Injection vulnerability in Tongtianxing Technology Co., Ltd CMSV6 v.7.31.0.2 through v.7.31.0.3 allows a remote attacker to escalate privileges and obtain sensitive information via the ids parameter...

CVE-2024-29024 JumpServer Direct Object Reference (IDOR) Vulnerability in File Manager Bulk Transfer Functionality

JumpServer is an open source bastion host and an operation and maintenance security audit system. An authenticated user can exploit the Insecure Direct Object Reference IDOR vulnerability in the file manager's bulk transfer by manipulating job IDs to upload malicious files, potentially compromisi...

CVE-2024-29024 JumpServer Direct Object Reference (IDOR) Vulnerability in File Manager Bulk Transfer Functionality

JumpServer is an open source bastion host and an operation and maintenance security audit system. An authenticated user can exploit the Insecure Direct Object Reference IDOR vulnerability in the file manager's bulk transfer by manipulating job IDs to upload malicious files, potentially compromisi...

Tongtianxing CMSV6 SQL注入漏洞

Tongtianxing CMSV6 is a vehicle information based data platform from Tongtianxing. A SQL injection vulnerability exists in Tongtianxing CMSV6 versions v.7.31.0.2 through v.7.31.0.3, which could allow a remote attacker to elevate privileges and gain access to sensitive information via the ids...

CVE-2024-29667

SQL Injection vulnerability in Tongtianxing Technology Co., Ltd CMSV6 v.7.31.0.2 through v.7.31.0.3 allows a remote attacker to escalate privileges and obtain sensitive information via the ids parameter...

PT-2024-22956 · Tongtianxing Technology Co. · Cmsv6

Name of the Vulnerable Software and Affected Versions: Tongtianxing Technology Co., Ltd CMSV6 versions 7.31.0.2 through 7.31.0.3 Description: The issue allows a remote attacker to escalate privileges and obtain sensitive information via the ids parameter. This is a SQL Injection vulnerability...

CVE-2024-29667: Improper Privilege Management

SQL Injection vulnerability in Tongtianxing Technology Co., Ltd CMSV6 v.7.31.0.2 through v.7.31.0.3 allows a remote attacker to escalate privileges and obtain sensitive information via the ids parameter...

Authorization Bypass

Grafana vulnerable to Authorization Bypass Through User-Controlled Key. The vulnerability is due to insufficient validation of organization IDs in the DeleteDashboardSnapshot within dashboardsnapshot.go. This allows an attacker to bypass authorization and delete a snapshot by sending a DELETE...

GHSA-V7PX-46V9-5QWP Storefront user can access history and most viewed data from matching back-office user with the same ID

Impact Navigation history, most viewed and favorite navigation items are returned to storefront user in JSON navigation response if ID of storefront user matches ID of back-office user...

CVE-2023-48296 OroPlatform's storefront user can access history and most viewed data from matching back-office user with the same ID

OroPlatform is a PHP Business Application Platform BAP. Navigation history, most viewed and favorite navigation items are returned to storefront user in JSON navigation response if ID of storefront user matches ID of back-office user. This vulnerability is fixed in 5.1.4...

CVE-2023-46839

PCI devices can make use of a functionality called phantom functions, that when enabled allows the device to generate requests using the IDs of functions that are otherwise unpopulated. This allows a device to extend the number of outstanding requests. Such phantom functions need an IOMMU context...

PT-2024-27211

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.37 Description The issue is related to the wifi component of the Linux kernel, specifically the iwlwifi driver. It involves guarding against invalid station IDs in the iwl mvm mld rm sta id function to preven...

CVE-2024-2604

creationtimestamp| type| source ---|---|--- 2024-03-18 22:26:43+00:00| seen| https://t.me/ctinow/211000 2024-03-18 22:26:46+00:00| seen| https://t.me/ctinow/211003 2024-03-19 05:01:58+00:00| seen| https://t.me/ctinow/211150...

CVE-2023-52159

creationtimestamp| type| source ---|---|--- 2024-03-18 03:26:43+00:00| seen| https://t.me/ctinow/210132 2024-03-18 03:26:51+00:00| seen| https://t.me/ctinow/210137...

Cisco Unified IP Phone Software Denial of Service (CVE-2018-0332)

A vulnerability in the Session Initiation Protocol SIP ingress packet processing of Cisco Unified IP Phone software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition. The vulnerability is due to a lack of flow-control mechanisms in the software. An attacke...

Cisco IP Phones 8800 Series Command Injection Vulnerability in Debug Shell (CVE-2017-12305)

A vulnerability in the debug interface of Cisco IP Phone 8800 series could allow an authenticated, local attacker to execute arbitrary commands, aka Debug Shell Command Injection. The vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by...

CVE-2024-2566

creationtimestamp| type| source ---|---|--- 2024-03-16 14:21:42+00:00| seen| https://t.me/ctinow/209556 2024-03-17 16:21:26+00:00| seen| https://t.me/ctinow/209981 2024-03-17 16:26:48+00:00| seen| https://t.me/ctinow/209983...