21637 matches found
CVE-2024-11159
CVE-2024-11159 : A vulnerability in Mozilla Thunderbird where using remote content in OpenPGP encrypted messages can disclose plaintext. Affected products include Thunderbird versions prior to 128.4.3 and prior to 132.0.1 (per multiple advisories). The root cause is exposure of OpenPGP ciphertext...
CVE-2024-48989
The CVE-2024-48989 affects Bosch Rexroth IndraDrive PROFINET stack (IndraDrive devices, all versions) with a vulnerability in the PROFINET stack that enables an attacker to cause a denial-of-service by sending arbitrary UDP messages, rendering the device unresponsive. Practical impact and exploit...
CVE-2024-47574
A authentication bypass using an alternate path or channel in Fortinet FortiClientWindows version 7.4.0, versions 7.2.4 through 7.2.0, versions 7.0.12 through 7.0.0, and 6.4.10 through 6.4.0 allows low privilege attacker to execute arbitrary code with high privilege via spoofed named pipe message...
CVE-2024-47574
A authentication bypass using an alternate path or channel in Fortinet FortiClientWindows version 7.4.0, versions 7.2.4 through 7.2.0, versions 7.0.12 through 7.0.0, and 6.4.10 through 6.4.0 allows low privilege attacker to execute arbitrary code with high privilege via spoofed named pipe message...
Mozilla Thunderbird < 128.4.3
The version of Thunderbird installed on the remote Windows host is prior to 128.4.3. It is, therefore, affected by a vulnerability as referenced in the mfsa2024-61 advisory. - Using remote content in OpenPGP encrypted messages can lead to the disclosure of plaintext. CVE-2024-11159 Note that Ness...
Mozilla Thunderbird < 128.4.3
The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 128.4.3. It is, therefore, affected by a vulnerability as referenced in the mfsa2024-61 advisory. - Using remote content in OpenPGP encrypted messages can lead to the disclosure of plaintext. CVE-2024-11159 Note...
PT-2024-34471 · Inovance · Inovance Hcplc Am402-Cpu1608Tptn +2
Name of the Vulnerable Software and Affected Versions: Inovance HCPLC AM401-CPU1608TPTN version 21.38.0.0 Inovance HCPLC AM402-CPU1608TPTN version 41.38.0.0 Inovance HCPLC AM403-CPU1608TN version 81.38.0.0 Description: A buffer overflow in the RecvSocketData function allows attackers to cause a...
CVE-2024-51750 Element allows a malicious homeserver can modify events leading to unrenderable events or rooms
Element is a Matrix web client built using the Matrix React SDK. A malicious homeserver can send invalid messages over federation which can prevent Element Web and Desktop from rendering single messages or the entire room containing them. This was patched in Element Web and Desktop 1.11.85...
CVE-2024-51750 Element allows a malicious homeserver can modify events leading to unrenderable events or rooms
Element is a Matrix web client built using the Matrix React SDK. A malicious homeserver can send invalid messages over federation which can prevent Element Web and Desktop from rendering single messages or the entire room containing them. This was patched in Element Web and Desktop 1.11.85...
kernel: Reapply "drm/qxl: simplify qxl_fence_wait"
In the Linux kernel, the following vulnerability has been resolved: Reapply "drm/qxl: simplify qxlfencewait" This reverts commit 07ed11afb68d94eadd4ffc082b97c2331307c5ea. Stephen Rostedt reports: "I went to run my tests on my VMs and the tests hung on boot up. Unfortunately, the most I ever got o...
Description of the security update for Microsoft Exchange Server 2019 and 2016: November 12, 2024 (KB5044062)
None None...
PT-2024-34881 · Unknown · Element Desktop +1
Name of the Vulnerable Software and Affected Versions: Element Web and Desktop versions prior to 1.11.85 Description: A malicious homeserver can send invalid messages over federation, which can prevent Element Web and Desktop from rendering single messages or the entire room containing them...
Element 安全漏洞
Element is a Matrix web collaboration client from Element Open Source. A security vulnerability exists in Element versions prior to 1.11.85, which originates from a malicious master server that sends invalid messages...
element-web -- several vulnerabilities
Element team reports: Versions of Element Web and Desktop earlier than 1.11.85 do not check if thumbnails for attachments, stickers and images are coherent. It is possible to add thumbnails to events trigger a file download once clicked. A malicious homeserver can send invalid messages over...
AZL-52608 CVE-2024-52533 affecting package glib for versions less than 2.71.0-3
gio/gsocks4aproxy.c in GNOME GLib before 2.82.1 has an off-by-one error and resultant buffer overflow because SOCKS4CONNMSGLEN is not sufficient for a trailing '\0' character...
CVE-2024-51489
Ampache is a web based audio/video streaming application and file manager. The current implementation of token parsing does not adequately validate CSRF tokens when users send messages to one another. This vulnerability could be exploited to forge CSRF attacks, allowing an attacker to send messag...
CVE-2024-51488 Insufficient Validation in Delete Message in Ampache
Ampache is a web based audio/video streaming application and file manager. The current implementation of token parsing does not adequately validate CSRF tokens when users delete messages. This vulnerability could be exploited to forge CSRF attacks, allowing an attacker to delete messages to any...
Moodle reflected XSS via H5P error message
A flaw was found in moodle. H5P error messages require additional sanitizing to prevent a reflected cross-site scripting XSS risk...
CVE-2024-43439
A flaw was found in moodle. H5P error messages require additional sanitizing to prevent a reflected cross-site scripting XSS risk...
CVE-2024-43439
CVE-2024-43439 describes a vulnerability in Moodle where H5P error messages are not sufficiently sanitized, enabling a reflected cross-site scripting (XSS) risk. The connected advisories and reports consistently state that the issue arises from insufficient sanitization in H5P error messages, wit...