CVE-2024-27602

Alldata version V0.4.6 is affected by an Incorrect Access Control vulnerability that leads to the leakage of interface documents for multiple modules. Specifically, the /api/system/v2/api-docs module is exposed, potentially revealing sensitive internal technical details. To minimize risk, it is r...

CVE-2024-27602

Alldata V0.4.6 is vulnerable to Incorrect Access Control. A total of many modules interface documents have been leaked.For example, the /api/system/v2/api-docs module...

Updated kernel,kmod-xtables-addons,kmod-virtualbox packages fix bugs and provide mitigations

Upstream kernel version 6.6.22 contain bug fixes and mitigations. The kmod-virtualbox and kmod-xtables-addons packages have been updated to work with this new kernel. For information about the mitigations see the changelog...

USN-6588-2: PAM vulnerability

USN-6588-1 fixed a vulnerability in PAM. This update provides the corresponding updates for Ubuntu 14.04 LTS, Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS. Original advisory details: Matthias Gerstner discovered that the PAM pamnamespace module incorrectly handled special files when performing director...

CVE-2024-24725

Gibbon through 26.0.00 allows remote authenticated users to conduct PHP deserialization attacks via columnOrder in a POST request to the modules/System%20Admin/importrun.php&type=externalAssessment&step=4 URI...

[SECURITY] Fedora 40 Update: baresip-3.10.1-1.fc40

A modular SIP user-agent with support for audio and video, and many IETF standards such as SIP, SDP, RTP/RTCP and STUN/TURN/ICE for both, IPv4 and IPv6. Additional modules provide support for audio codecs like Codec2, G.711, G.722, G.726, GSM, L16, MPA and Opus, audio drivers like ALSA, GStreamer...

MELSEC-Q Series Processor Code Execution

The vulnerability of the modules of the central processor in microprogrammed logic controllers of the MELSEC-Q Series and MELSEC-L Series is related to a full-integer overflow. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary code...

PT-2024-22901 · Ros2 · Ros2

Name of the Vulnerable Software and Affected Versions: ROS2 Robot Operating System 2 Humble Hawksbill versions 2 Description: A command injection issue has been found, allowing remote attackers to execute arbitrary code, escalate privileges, and obtain sensitive information via External Command...

PT-2024-21176

Name of the Vulnerable Software and Affected Versions AMSS++ version 4.31 Description The issue allows SQL injection through the "/amssplus/modules/book/main/bookdetail khet person.php" endpoint, in multiple parameters. This could allow a remote attacker to send a specially crafted SQL query to t...

PT-2024-21151

Name of the Vulnerable Software and Affected Versions AMSS++ version 4.31 Description The issue allows SQL injection through the "/amssplus/modules/book/main/select send.php" API endpoint, specifically in the sd index parameter. This could enable a remote attacker to send a specially crafted SQL...

org.springframework:spring-portlet (2.0.3), org.springframework:spring-remoting (2.0.3) +4 more potentially affected by CVE-2024-22259 via org.springframework:spring-web (2.0.3)

org.springframework:spring-web MAVEN version 2.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-web and may be impacted: - org.springframework:spring-portlet 2.0.3 - org.springframework:spring-remoting 2.0.3 -...

Metasploit Wrap-Up 03/15/2024

New module content 3 GitLab Password Reset Account Takeover Authors: asterion04 and h00die Type: Auxiliary Pull request: 18716 contributed by h00die Path: admin/http/gitlabpasswordresetaccounttakeover AttackerKB reference: CVE-2023-7028 Description: This adds an exploit module that leverages an...

CVE-2024-0803

Integer Overflow or Wraparound vulnerability in Mitsubishi Electric Corporation MELSEC-Q Series and MELSEC-L Series CPU modules allows a remote unauthenticated attacker to execute malicious code on a target product by sending a specially crafted packet...

CVE-2024-0802

Incorrect Pointer Scaling vulnerability in Mitsubishi Electric Corporation MELSEC-Q Series and MELSEC-L Series CPU modules allows a remote unauthenticated attacker to read arbitrary information from a target product or execute malicious code on a target product by sending a specially crafted pack...

CVE-2024-1917

Integer Overflow or Wraparound vulnerability in Mitsubishi Electric Corporation MELSEC-Q Series and MELSEC-L Series CPU modules allows a remote unauthenticated attacker to execute malicious code on a target product by sending a specially crafted packet...

CVE-2024-1917

CVE-2024-1917 is an Integer Overflow/Wraparound vulnerability in Mitsubishi Electric MELSEC-Q/L Series CPU modules that allows a remote unauthenticated attacker to execute malicious code by sending a crafted packet. Affected products include MELSEC-Q Series and MELSEC-L Series CPU modules (e.g., ...

CVE-2024-1916

The CVE-2024-1916 issue affects Mitsubishi Electric MELSEC-Q/L Series CPU modules. A remote, unauthenticated attacker can exploit an Integer Overflow or Wraparound condition by sending a specially crafted packet to execute arbitrary code on affected devices. Affected products include MELSEC-Q Ser...

CVE-2024-1916

Integer Overflow or Wraparound vulnerability in Mitsubishi Electric Corporation MELSEC-Q Series and MELSEC-L Series CPU modules allows a remote unauthenticated attacker to execute malicious code on a target product by sending a specially crafted packet...

CVE-2024-1915

Summary: CVE-2024-1915 affects Mitsubishi Electric MELSEC-Q/L Series CPU modules (Q03UDECPU, Q04/06/10/13/20/26/50/100UDEHCPU, Q03/04/06/13/26UDVCPU, Q04/06/13/26UDPVCPU, and MELSEC-L Series L02/06/26CPU(-P), L26CPU(-P)BT). A remote, unauthenticated attacker can trigger an Incorrect Pointer Scali...

CVE-2024-1917: Integer Overflow or Wraparound

Integer Overflow or Wraparound vulnerability in Mitsubishi Electric Corporation MELSEC-Q Series and MELSEC-L Series CPU modules allows a remote unauthenticated attacker to execute malicious code on a target product by sending a specially crafted packet...