PT-2024-17055 · Irfanview · Irfanview

Name of the Vulnerable Software and Affected Versions: IrfanView affected versions not specified Description: This issue allows remote attackers to execute arbitrary code on affected installations of IrfanView. User interaction is required to exploit this issue, where the target must visit a...

CVE-2024-48069

A vulnerability was found in Weaver E-cology allows attackers use race conditions to bypass security mechanisms to upload malicious files and control server privileges...

Vulnerability fixed in Adobe Photoshop

Adobe has fixed a vulnerability in Photoshop Specifically for versions 24.7.3, 25.11 and earlier. The vulnerability is in the way Adobe Photoshop handles certain files. A malicious party could exploit this vulnerability by tricking a user into opening a malicious file, which could lead to the...

PT-2024-10126

The rsync software is affected by a path traversal issue, which arises from the behavior enabled by the --inc-recursive option. This option is default-enabled for many client options and can be enabled by the server even if not explicitly enabled by the client. When using the --inc-recursive...

Russian Hackers Exploit New NTLM Flaw to Deploy RAT Malware via Phishing Emails

A newly patched security flaw impacting Windows NT LAN Manager NTLM was exploited as a zero-day by a suspected Russia-linked actor as part of cyber attacks targeting Ukraine. The vulnerability in question, CVE-2024-43451 CVSS score: 6.5, refers to an NTLM hash disclosure spoofing vulnerability th...

GHSA-4HJF-6PXR-549H Moodle Cross-site Scripting vulnerability

A flaw was found in moodle. Insufficient sanitizing of data when performing a restore could result in a cross-site scripting XSS risk from malicious backup files...

EulerOS 2.0 SP9 : openjpeg2 (EulerOS-SA-2024-2818)

According to the versions of the openjpeg2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A vulnerability was found in OpenJPEG similar to CVE-2019-6988. This flaw allows an attacker to bypass existing protections and cause an...

EulerOS 2.0 SP10 : openjpeg2 (EulerOS-SA-2024-2891)

According to the versions of the openjpeg2 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A vulnerability was found in OpenJPEG similar to CVE-2019-6988.This flaw allows an attacker to bypass existing protections and cause an...

CVE-2024-48646

An Unrestricted File Upload vulnerability exists in Sage 1000 v7.0.0, which allows authorized users to upload files without proper validation. An attacker could exploit this vulnerability by uploading malicious files, such as HTML, scripts, or other executable content, that may be executed on the...

CVE-2024-48734

Unrestricted file upload in /SASStudio/SASStudio/sasexec/sessionID/InternalPath in SAS Studio 9.4 allows remote attacker to upload malicious files. NOTE: this is disputed by the vendor because file upload is allowed for authorized users...

CVE-2024-48734

Unrestricted file upload exists in SAS Studio 9.4 at the endpoint /SASStudio/SASStudio/sasexec/{sessionID}/{InternalPath}, enabling a remote attacker to upload malicious files. The vulnerability is disputed by the vendor, who notes that file upload is allowed for authorized users. Affected produc...

CVE-2024-44237

An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in macOS Ventura 13.7.1, macOS Sonoma 14.7.1. Processing a maliciously crafted file may lead to unexpected app termination...

Apple macOS 安全漏洞

Apple macOS is a suite of specialized operating systems developed for Mac computers by Apple USA. A security vulnerability exists in Apple macOS version 15, which stems from the handling of maliciously crafted files that may result in heap corruption...

The vulnerability of Adobe InDesign’s automation tool for computer design lies in its ability to download files of a malicious nature without limitation, allowing attackers to execute arbitrary code.

The vulnerability of Adobe InDesign’s computer layout automation tool is related to the ability to download files of a malicious nature without limitation. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of Adobe InCopy, a text creation and editing software, relates to the ability to download files of a malicious nature indefinitely. This allows a hacker to execute arbitrary code.

The vulnerability of the Adobe InCopy text creation and editing software is related to the ability to download files of a malicious nature without limitation. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

Adobe After Effects < 18.4.2 Multiple Vulnerabilities (APSB21-79) (macOS)

The version of Adobe After Effects installed on the remote macOS host is prior to 18.4.2. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB21-79 advisory. - Adobe After Effects version 18.4.1 and earlier is affected by a memory corruption vulnerability due to insecu...

PT-2024-16028 · Unknown · Binary-Husky/Gpt Academic

Name of the Vulnerable Software and Affected Versions: binary-husky/gpt academic version 3.83 Description: A stored cross-site scripting XSS vulnerability exists in the software. The vulnerability occurs at the "/file" endpoint, which renders HTML files. Malicious HTML files containing XSS payloa...

CVE-2024-22034

Attackers could put the special files in .osc into the actual package sources e.g. apiurl. This allows the attacker to change the configuration of osc for the victim...

Tungsten Automation Power PDF PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Tungsten Automation Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

Tungsten Automation Power PDF PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Tungsten Automation Power PDF. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists...