CVE-2024-29943

An attacker was able to perform an out-of-bounds read or write on a JavaScript object by fooling range-based bounds check elimination. This vulnerability affects Firefox 124.0.1...

CVE-2024-28756

The SolarEdge mySolarEdge application before 2.20.1 for Android has a certificate verification issue that allows a Machine-in-the-middle MitM attacker to read and alter all network traffic between the application and the server...

PT-2024-22182 · Unknown · Propertyhive

Name of the Vulnerable Software and Affected Versions: PropertyHive versions prior to 2.0.10 Description: The issue is related to Deserialization of Untrusted Data. This can potentially lead to security risks if exploited. Recommendations: For versions prior to 2.0.10, update to version 2.0.10 or...

Distrobox 安全漏洞

Distrobox is an application by Luca Di Maio Personal Developer. Containers can be created using podman, docker or liipod. A security vulnerability exists in Distrobox versions prior to 1.7.0.1 that could allow an attacker to execute arbitrary code via command injection into an exported executable...

PT-2024-18255

Name of the Vulnerable Software and Affected Versions gradio versions prior to 4.19.2 Description A Cross-Site Request Forgery CSRF issue allows attackers to upload multiple large files to a victim's system if they are running Gradio locally. By crafting a malicious HTML page that triggers an...

PT-2024-22564 · Solaredge · Mysolaredge

Name of the Vulnerable Software and Affected Versions: SolarEdge mySolarEdge application version prior to 2.20.1 for Android Description: The issue is related to a certificate verification problem, allowing a Machine-in-the-middle MitM attacker to read and alter all network traffic between the...

RSSHub 安全漏洞

RSSHub is an RSS feed generator written in Node.js, distributed under the MIT license and maintained by DIYgod and other GitHub users. A security vulnerability exists in versions prior to RSSHub 1.0.0-master.a429472, which stems from a vulnerability that could allow a remote attacker to use the...

iTop DualSafe Password Manager & Digital Vault 安全漏洞

iTop DualSafe Password Manager & Digital Vault is a password manager extension from iTop Inc. A security vulnerability exists in iTop DualSafe Password Manager & Digital Vault versions prior to 1.4.24, which originated from a vulnerability that allows a local attacker to gain access to sensitive...

OAuthenticator 安全漏洞

OAuthenticator is an OAuth token library for the JupyerHub login handler. A security vulnerability exists in OAuthenticator versions prior to 16.3.0 that stems from incorrectly validating membership...

PT-2024-3990

Name of the Vulnerable Software and Affected Versions Progress Telerik Report Server versions 2024 Q1 10.0.24.305 or earlier Description The issue is related to an authentication bypass vulnerability in Progress Telerik Report Server, allowing an unauthenticated attacker to gain access to...

PT-2024-2324 · Progress · Progress Telerik Report Server

Name of the Vulnerable Software and Affected Versions: Progress® Telerik® Report Server versions prior to 2024 Q1 10.0.24.130 Description: A remote code execution attack is possible through an insecure deserialization vulnerability in the Progress® Telerik® Report Server. This vulnerability is...

DEBIAN-CVE-2024-2612

If an attacker could find a way to trigger a particular code path in SafeRefPtr, it could have triggered a crash or potentially be leveraged to achieve code execution. This vulnerability affects Firefox 124, Firefox ESR 115.9, and Thunderbird 115.9...

CVE-2024-2606

Passing invalid data could have led to invalid wasm values being created, such as arbitrary integers turning into pointer values. This vulnerability affects Firefox 124...

PT-2024-22547 · Unit4 · Unit4 Financials

Name of the Vulnerable Software and Affected Versions: Unit4 Financials by Coda versions prior to 2023Q4 Description: The issue allows a remote attacker to run arbitrary code via a crafted GET request using the cols parameter. This enables the attacker to potentially escalate privileges...

ZoneMinder Snapshots Remote Code Execution

import re import requests from bs4 import BeautifulSoup import argparse import base64 Exploit Title: Unauthenticated RCE in ZoneMinder Snapshots Date: 12 December 2023 Discovered by : @Unblvr1 Exploit Author: Ravindu Wickramasinghe @rvizx9 Vendor Homepage: https://zoneminder.com/ Software Link:...

Franklin Fueling System EVO Security Vulnerability

Franklin Fueling System EVO is a fuel station management system from Franklin Fueling System, Inc. A security vulnerability exists in the Franklin Fueling System EVO 550 and EVO 5000 that stems from a path traversal vulnerability. An attacker could exploit the vulnerability to access sensitive...

Meta4 HR security breach

Cegid Meta4 HR is a human resource management software HRM platform from Cegid Corporation. A security vulnerability exists in Meta4 HR version 819.001.022 and prior versions, which stems from a configuration page being placed on an Internet-facing web server, resulting in a file path being expos...

CVE-2024-27773

Unitronics Unistream Unilogic – Versions prior to 1.35.227 - CWE-348: Use of Less Trusted Source may allow RCE...

CVE-2024-27769

Unitronics Unistream Unilogic – Versions prior to 1.35.227 - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor may allow Taking Ownership Over Devices...

CVE-2024-27769

The CVE-2024-27769 vulnerability affects Unitronics Unistream Unilogic (Unitronics Unistream PLCs). Affected versions are prior to 1.35.227. The root cause is information disclosure to unauthorized actors, enabling disclosure of sensitive data and potentially allowing an attacker to take ownershi...