Medium: openssl-snapsafe

Issue Overview: Issue summary: Calling the OpenSSL API function SSLselectnextproto with an empty supported client protocols buffer may cause a crash or memory contents to be sent to the peer. Impact summary: A buffer overread can have a range of potential consequences such as unexpected applicati...

CVE-2024-44166

A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Ventura 13.7, macOS Sonoma 14.7, macOS Sequoia 15. An app may be able to access user-sensitive data...

CVE-2024-44163

The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.7, macOS Sonoma 14.7, macOS Sequoia 15. A malicious application may be able to access private information...

CVE-2024-40791

A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Ventura 13.7, iOS 17.7 and iPadOS 17.7, iOS 18 and iPadOS 18, macOS Sonoma 14.7, macOS Sequoia 15. An app may be able to access information about a user's contacts...

Apple macOS 安全漏洞

Apple macOS is a proprietary operating system developed by Apple Inc. for Mac computers. A security vulnerability exists in Apple macOS version 15, which originates from an application with root privileges that may be able to access private information...

PT-2025-2675 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 13.7.3 macOS versions prior to 14.7.3 macOS versions prior to 15 Description: A privacy issue was addressed with improved private data redaction for log entries. This issue may allow an app to access contacts. The...

SUSE CVE-2019-1000021

slixmpp version before commit 7cd73b594e8122dddf847953fcfc85ab4d316416 contains an incorrect Access Control vulnerability in XEP-0223 plugin Persistent Storage of Private Data via PubSub options profile, used for the configuration of default access model that can result in all of the contacts of...

CVE-2024-37136

Dell Path to PowerProtect, versions 1.1, 1.2, contains an Exposure of Private Personal Information to an Unauthorized Actor vulnerability. A remote high privileged attacker could potentially exploit this vulnerability, leading to information exposure...

CVE-2024-42364 homepage DNS rebinding vulnerability (GHSL-2024-096)

Homepage is a highly customizable homepage with Docker and service API integrations. The default setup of homepage 0.9.1 is vulnerable to DNS rebinding. Homepage is setup without certificate and authentication by default, leaving it to vulnerable to DNS rebinding. In this attack, an attacker will...

PT-2024-29899 · Homepage · Homepage

Name of the Vulnerable Software and Affected Versions: Homepage version 0.9.1 Description: The default setup of Homepage is vulnerable to DNS rebinding due to the lack of certificate and authentication. An attacker can exploit this by changing the DNS records of their domain to the internal IP...

Memos 安全漏洞

Memos is a Memos open source open source hosted meme center with knowledge management and social features. A security vulnerability exists in Memos 0.20.1 and prior versions that stems from the presence of a CORS misconfiguration that could allow an attacking website to make cross-origin requests...

CVE-2024-40804

The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.6. A malicious application may be able to access private information...

CVE-2023-42943

A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sonoma 14. An app may be able to read sensitive location information...

PT-2024-22106 · Apple · Macos Monterey +3

Name of the Vulnerable Software and Affected Versions: macOS Sonoma versions prior to 14.6 macOS Monterey versions prior to 12.7.6 macOS Ventura versions prior to 13.6.8 Description: A privacy issue was addressed with improved private data redaction for log entries. An app may be able to access...

PT-2024-31038 · Apple · Ios +2

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 13.6.8 macOS versions prior to 12.7.6 iOS versions prior to 16.7.9 iPadOS versions prior to 16.7.9 iOS versions prior to 17.6 iPadOS versions prior to 17.6 macOS versions prior to 14.6 Description: A privacy issue was...

kernel: can: j1939: j1939_netdev_start(): fix UAF for rx_kref of j1939_priv

In the Linux kernel, the following vulnerability has been resolved: can: j1939: j1939netdevstart: fix UAF for rxkref of j1939priv It will trigger UAF for rxkref of j1939priv as following. cpu0 cpu1 j1939skbindsocket0, ndev0, ... j1939netdevstart j1939skbindsocket1, ndev0, ... j1939netdevstart...

Medium: edk2

Issue Overview: Issue summary: Calling the OpenSSL API function SSLselectnextproto with an empty supported client protocols buffer may cause a crash or memory contents to be sent to the peer. Impact summary: A buffer overread can have a range of potential consequences such as unexpected applicati...

Exploit for Exposure of Private Personal Information to an Unauthorized Actor in Follow-Redirects_Project Follow-Redirects

CVE-2022-0155 Proof-of-Concept PoC This repository contains...

CVE-2024-6396 Arbitrary File Overwrite and Data Exfiltration in aimhubio/aim

A vulnerability in the backuprun function in aimhubio/aim version 3.19.3 allows remote attackers to overwrite any file on the host server and exfiltrate arbitrary data. The vulnerability arises due to improper handling of the runhash and repo.path parameters, which can be manipulated to create an...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure via the embed feature. An attacker can access unpublished or private resource data by inferring the slug or URL of the resource that can be embedded. Note: This is only exploitable if the resource allows embedding a...