9794 matches found
CVE-2024-21518
This affects versions of the package opencart/opencart from 4.0.0.0. A Zip Slip issue was identified via the marketplace installer due to improper sanitization of the target path, allowing files within a malicious archive to traverse the filesystem and be extracted to arbitrary locations. An...
CVE-2024-21518
This affects versions of the package opencart/opencart from 4.0.0.0. A Zip Slip issue was identified via the marketplace installer due to improper sanitization of the target path, allowing files within a malicious archive to traverse the filesystem and be extracted to arbitrary locations. An...
CVE-2024-21518: Path Traversal: '\..\filename'
This affects versions of the package opencart/opencart from 4.0.0.0. A Zip Slip issue was identified via the marketplace installer due to improper sanitization of the target path, allowing files within a malicious archive to traverse the filesystem and be extracted to arbitrary locations. An...
OpenCart security vulnerabilities
OpenCart is an open source online store management system for creating and managing e-commerce websites. It is known for its user-friendliness and flexibility for online stores of different sizes. OpenCart suffers from a file disclosure vulnerability due to an improperly cleaned destination path...
AdsExhaust Adware Distributed in Fake Oculus Installer via Google Search
New adware "AdsExhaust" disguises itself as an Oculus installer to steal screenshots, generate fake clicks, and drain resources. Learn how to protect yourself from AdsExhaust and similar threats...
PT-2024-18931
Name of the Vulnerable Software and Affected Versions opencart/opencart versions 4.0.0.0 and later Description A Zip Slip issue was identified via the marketplace installer due to improper sanitization of the target path, allowing files within a malicious archive to traverse the filesystem and be...
Behind the Great Wall: Void Arachne Targets Chinese-Speaking Users With the Winos 4.0 C&C Framework
We recently discovered a new threat actor group that we dubbed Void Arachne. This group targets Chinese-speaking users with malicious Windows Installer MSI files in a recent campaign. These MSI files contain legitimate software installer files for AI software and other popular software but are...
Android PackageInstallerService createSessionInternal Database Access
The vulnerability of the createSessionInternal function in the PackageInstallerService.java module of the Android operating system is related to the lack of encapsulation around special characters in the name of the installer when it is written to /data/system/packages.list. Exploiting this...
Exploit for Special Element Injection in Google Android
CVE 2024 0044 CVE-2024-0044, identified in the createSessionI...
OPENSUSE-SU-2024:12803-1 cockpit-d-installer-0.8.1~1-5.1 on GA media
These are all security issues fixed in the cockpit-d-installer-0.8.11-5.1 package on the GA media of openSUSE Tumbleweed...
Cybercriminals Employ PhantomLoader to Distribute SSLoad Malware
The nascent malware known as SSLoad is being delivered by means of a previously undocumented loader called PhantomLoader, according to findings from cybersecurity firm Intezer. "The loader is added to a legitimate DLL, usually EDR or AV products, by binary patching the file and employing...
Red Hat Satellite Foreman-Installer Password Disclosure
The vulnerability of the foreman-installer component of the Red Hat Satellite system management software is related to insufficient protection for operational data. Exploiting this vulnerability could allow an attacker to obtain the password from the process list...
Fedora: Security Advisory for rust-coreos-installer (FEDORA-2024-40ee18b2e7)
The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2024-30369
A10 Thunder ADC Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of A10 Thunder ADC. An attacker must first obtain the ability to execute low-privileged code on the target system in...
CVE-2024-30369 A10 Thunder ADC Incorrect Permission Assignment Local Privilege Escalation Vulnerability
A10 Thunder ADC Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of A10 Thunder ADC. An attacker must first obtain the ability to execute low-privileged code on the target system in...
CVE-2024-30369 A10 Thunder ADC Incorrect Permission Assignment Local Privilege Escalation Vulnerability
A10 Thunder ADC Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of A10 Thunder ADC. An attacker must first obtain the ability to execute low-privileged code on the target system in...
PT-2024-9894
Name of the Vulnerable Software and Affected Versions: GFI Archiver affected versions not specified Description: This issue allows remote attackers to execute arbitrary code on affected installations of GFI Archiver. Authentication is not required to exploit this issue. The specific flaw exists...
CVE-2024-30369: Incorrect Permission Assignment for Critical Resource
A10 Thunder ADC Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of A10 Thunder ADC. An attacker must first obtain the ability to execute low-privileged code on the target system in...
CVE-2024-3716
A flaw was found in foreman-installer when puppet-candlepin is invoked cpdb with the --password parameter. This issue leaks the password in the process list and allows an attacker to take advantage and obtain the password...
CVE-2024-3716
A flaw was found in foreman-installer when puppet-candlepin is invoked cpdb with the --password parameter. This issue leaks the password in the process list and allows an attacker to take advantage and obtain the password...