PT-2024-7329 · Intel · Seamless Firmware Updates

Name of the Vulnerable Software and Affected Versions: IntelR reference platforms affected versions not specified Description: A race condition in Seamless Firmware Updates for some IntelR reference platforms may allow a privileged user to potentially enable denial of service via local access. Th...

PT-2024-7300

Name of the Vulnerable Software and Affected Versions: IntelR Processors affected versions not specified Description: The issue is related to improper finite state machines FSMs in hardware logic, which may allow a privileged user to potentially enable a denial of service via local access. The...

SAP NetWeaver Application Server 安全漏洞

SAP NetWeaver Application Server is an application server from SAP, Germany. A security vulnerability exists in SAP NetWeaver Application Server that originates from a program that allows a user with elevated privileges to execute a program that displays data over the network...

SAP NetWeaver Application Server 安全漏洞

SAP NetWeaver Application Server is an application server from SAP, Germany. A security vulnerability exists in SAP NetWeaver Application Server that stems from an RFC-enabled function module that allows a low-privileged user to delete any user's workplace favorites...

CVE-2024-39718

An improper input validation vulnerability that allows a low-privileged user to remotely remove files on the system with permissions equivalent to those of the service account...

CVE-2024-39715

A code injection vulnerability that allows a low-privileged user with REST API access granted to remotely upload arbitrary files to the VSPC server using REST API, leading to remote code execution on VSPC server...

CVE-2024-39718

An improper input validation vulnerability that allows a low-privileged user to remotely remove files on the system with permissions equivalent to those of the service account...

CVE-2024-40718

A server side request forgery vulnerability allows a low-privileged user to perform local privilege escalation through exploiting an SSRF vulnerability...

CVE-2024-40718

CVE-2024-40718 is an SSRF-based vulnerability that lets a low-privileged user escalate to the local system in Veeam products. Affected components include Veeam Backup & Replication (older 12.x builds like 12.1.2.172 and earlier), Veeam Agent for Linux (<= 6.2.0.101), Veeam ONE (12.1.x), Veeam ...

CVE-2024-39718

An improper input validation vulnerability that allows a low-privileged user to remotely remove files on the system with permissions equivalent to those of the service account...

CVE-2024-39715

A code injection vulnerability that allows a low-privileged user with REST API access granted to remotely upload arbitrary files to the VSPC server using REST API, leading to remote code execution on VSPC server...

CVE-2024-39718

CVE-2024-39718 is a vulnerability in Veeam Backup & Replication 12.x (notably affected builds include 12.1.2.172 and earlier) where a low-privileged user can remotely remove files with the service account’s permissions due to improper input validation. Connected sources confirm this CVE affects m...

CVE-2024-39718

An improper input validation vulnerability that allows a low-privileged user to remotely remove files on the system with permissions equivalent to those of the service account...

CVE-2024-40709

A missing authorization vulnerability allows a local low-privileged user on the machine to escalate their privileges to root level...

CVE-2024-38651

A code injection vulnerability can allow a low-privileged user to overwrite files on that VSPC server, which can lead to remote code execution on VSPC server...

CVE-2024-39714

CVE-2024-39714 – Veeam Service Provider Console (VSPC) Connected sources confirm a code-injection vulnerability in VSPC that allows a low-privileged user to upload arbitrary files to the server, resulting in remote code execution on the VSPC server. The issue is documented across multiple feeds w...

CVE-2024-38651

CVE-2024-38651 affects Veeam Service Provider Console (VSPC); a low-privileged user can overwrite files on the VSPC server, enabling remote code execution. The vulnerability is listed under VSPC issue details and is addressed in VSPC 8.1 (build 8.1.0.21377). Exploit status is not detailed in the ...

Veeam Service Provider Console 安全漏洞

Veeam Service Provider Console is a cloud-enabled platform from Veeam USA. A security vulnerability exists in Veeam Service Provider Console version 8.0.0.19552 and previous versions 8, which stems from the inclusion of a code injection vulnerability that allows a low privileged user with REST AP...

K000140953: libarchive vulnerability CVE-2023-30571

Security Advisory Description Libarchive through 3.6.2 can cause directories to have world-writable permissions. The umask call inside archivewritediskposix.c changes the umask of the whole process for a very short period of time; a race condition with another thread can lead to a permanent umask...

GHSA-C34R-238X-F7QX Remote Code Execution Vulnerability via SSTI in Fides Webserver Jinja Email Templating Engine

Summary The Email Templating feature uses Jinja2 without proper input sanitization or rendering environment restrictions, allowing for Server-Side Template Injection that grants Remote Code Execution to privileged users. A privileged user refers to an Admin UI user with the default Owner or...