ROS-20241218-01

Vulnerability of the kmallocreserve function in the net/core/skbuff.c module of the network subsystem of the Linux kernel is related to integer overflow. Linux kernel subsystem is related to integer overflow. Exploitation of the vulnerability could allow an attacker to cause a denial of service...

Improper Input Validation

dev.sigstore, sigstore-java is vulnerable to Improper Input Validation. The vulnerability is due to insufficient verification in the KeylessVerifier.verify method, which fails to properly validate whether the inclusion proof provided by a bundle corresponds to the correct log, allows an attacker ...

PT-2024-36596 · Xwiki · Xwiki Platform

Name of the Vulnerable Software and Affected Versions: XWiki Platform versions 9.7-rc-1 through 15.10.10 XWiki Platform versions 16.4.0 through 16.4.0 XWiki Platform versions 16.5.0 is not affected, instead versions prior to 16.5.0 are affected, so the correct range is: XWiki Platform versions...

PT-2024-9986 · Acronis · Acronis Cyber Protect Cloud Agent

Name of the Vulnerable Software and Affected Versions: Acronis Cyber Protect Cloud Agent Linux before build 39185 Description: The issue is related to the use of a weak algorithm for signing RPM packages in the Acronis Cyber Protect Cloud Agent for Linux. This weakness can potentially allow an...

Incorrect Rekor Entry Selection

github.com/sigstore/gitsign is vulnerable to Incorrect Rekor entry selection. The vulnerability is due to gitsign not correctly handling situations where multiple Rekor entries are returned during online verification, leading it to potentially select the wrong one. It allows an attacker to...

The vulnerability of the web page rendering modules in WebKitGTK and WPE WebKit, related to the occurrence of operations outside the buffer in memory, allows attackers to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the Web page rendering modules in WebKitGTK and WPE WebKit relates to the escape of operations beyond the buffer in memory. Exploiting this vulnerability can allow a remote attacker to access confidential data, compromise its integrity, and cause service failures...

The vulnerability of the web page rendering modules in WebKitGTK and WPE WebKit, related to lack of access control, allows attackers to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability of the Web page rendering modules in WebKitGTK and WPE WebKit is related to deficiencies in access control. Exploiting this vulnerability can allow an attacker to gain access to confidential data, compromise its integrity, and cause service failures...

The vulnerability of the WPE WebKit and WebKitGTK web page rendering modules, related to bypassing authentication through spoofing, allows attackers to access sensitive data, compromise its integrity, and cause service failures.

The vulnerability of the WPE WebKit and WebKitGTK page rendering modules is related to the bypassing of authentication processes through spoofing techniques. Exploiting this vulnerability can allow a malicious actor to gain access to confidential data, compromise its integrity, and cause service...

The vulnerability of the WPE WebKit and WebKitGTK web page rendering modules, related to access to memory cells before the buffer is initialized, allows attackers to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability of the WPE WebKit and WebKitGTK page rendering modules relates to access to memory cells before the buffer is initialized. Exploiting this vulnerability can allow a remote attacker to gain access to confidential data, compromise its integrity, and cause service failures...

Siemens SCALANCE M-800 Family Improper Limitation of a Pathname to a Restricted Directory (CVE-2024-50559)

Affected devices do not properly validate the filenames of the certificate. This could allow an authenticated remote attacker to append arbitrary values which will lead to compromise of integrity of the system. This plugin only works with Tenable.ot. Please visit...

CVE-2024-50559

A vulnerability has been identified in RUGGEDCOM RM1224 LTE4G EU 6GK6108-4AM00-2BA2 All versions V8.2, RUGGEDCOM RM1224 LTE4G NAM 6GK6108-4AM00-2DA2 All versions V8.2, SCALANCE M804PB 6GK5804-0AP00-2AA2 All versions V8.2, SCALANCE M812-1 ADSL-Router 6GK5812-1AA00-2AA2 All versions V8.2, SCALANCE...

Siemens多款产品 路径遍历漏洞

SCALANCE M-800, MUM-800 and S615 and RUGGEDCOM RM1224 are industrial routers. A path traversal vulnerability exists in multiple Siemens products, which can be exploited by an attacker to append arbitrary values, resulting in a compromise of system integrity...

Exploit for Cross-site Scripting in Salesagility Suitecrm

CVE-2024-50335: Authenticated XSS in "Publish Key" Field Allow...

The vulnerability of the Nested iFrame Handler component in the Firefox web browser arises from an incorrect SameSite attribute in the cookie file. This allows attackers to access sensitive data, compromise its integrity, and cause service failures.

The vulnerability of the Nested iFrame Handler component in the Firefox web browser is related to an incorrect SameSite attribute in the cookie file. Exploiting this vulnerability can allow a remote attacker to access sensitive data, compromise its integrity, and cause service interruptions...

The vulnerability in the Firefox web browser, related to the improper handling of pointers, allows a malicious actor to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability in the Firefox web browser is related to the exploitation of an incorrect pointer. Exploiting this vulnerability can allow a remote attacker to gain access to confidential data, compromise its integrity, and cause service interruptions...

ROS-20241021-10

The vulnerability of the SI library for asynchronous DNS c-ares queries is related to failure to take measures to protect the structure of a web page. the structure of the web page. Exploitation of the vulnerability could allow an attacker acting remotely, gain access to sensitive data, compromis...

CVE-2024-45693 Apache CloudStack: Request origin validation bypass makes account takeover possible

Users logged into the Apache CloudStack's web interface can be tricked to submit malicious CSRF requests due to missing validation of the origin of the requests. This can allow an attacker to gain privileges and access to resources of the authenticated users and may lead to account...

CVE-2024-47563

A vulnerability has been identified in SINEC Security Monitor All versions V4.9.0. The affected application does not properly validate a file path that is supplied to an endpoint intended to create CSR files. This could allow an unauthenticated remote attacker to create files in writable...

Siemens SINEC Security Monitor

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories CERT Services | Services |...

The vulnerability of the WebRTC component in Google Chrome browsers, related to recording beyond the buffer limit, allows attackers to access confidential data, compromise its integrity, and cause service failures.

The vulnerability of the WebRTC component in the Google Chrome web browser is related to memory corruption beyond the buffer boundaries. Exploiting this vulnerability can allow an attacker to access sensitive data, compromise its integrity, and cause service interruptions...