EulerOS Virtualization 2.10.1 : grub2 (EulerOS-SA-2024-1358)

According to the versions of the grub2 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - An out-of-bounds write flaw was found in grub2's NTFS filesystem driver. This issue may allow an attacker to present a specially...

EulerOS 2.0 SP8 : grub2 (EulerOS-SA-2024-1270)

According to the versions of the grub2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An out-of-bounds write flaw was found in grub2's NTFS filesystem driver. This issue may allow an attacker to present a specially crafted NTFS...

CVE-2024-2053 Artica Proxy Unauthenticated LFI Protection Bypass Vulnerability

The Artica Proxy administrative web application will deserialize arbitrary PHP objects supplied by unauthenticated users and subsequently enable code execution as the "www-data" user. This issue was demonstrated on version 4.50 of the The Artica-Proxy administrative web application attempts to...

PT-2024-2550

Name of the Vulnerable Software and Affected Versions iPadOS versions prior to 17.4 iOS versions prior to 17.4 macOS versions prior to 13.6.7 watchOS affected versions not specified visionOS affected versions not specified tvOS affected versions not specified iOS 16.7.8 iPadOS 16.7.8 Description...

PT-2024-2546

Name of the Vulnerable Software and Affected Versions iPadOS versions prior to 16.7.6 iOS versions prior to 16.7.6 macOS Monterey versions prior to 12.7.4 macOS Sonoma versions prior to 14.4 macOS Ventura versions prior to 13.6.5 tvOS versions prior to 17.4 visionOS versions prior to 1.1 watchOS...

Artica Proxy Unauthenticated LFI Protection Bypass Vulnerability

Vulnerability Details Affected Vendor: Artica Affected Product: Artica Proxy Affected Version: 4.40 and 4.50 Platform: Debian 10 LTS CWE Classification: CWE-23: Relative Path Traversal CVE ID: CVE-2024-2053 2. Vulnerability Description The Artica Proxy administrative web application attempts to...

CVE-2024-1475

CVE-2024-1475 affects the WordPress plugin Coming Soon Maintenance Mode up to version 1.0.5. Root cause: Sensitive Information Exposure via the REST API that allows unauthenticated attackers to retrieve post/page content, bypassing plugin protection. Impact: unauthorized data disclosure of site c...

Innovs HR <= 1.0.3.4 - Employee Creation via CSRF

Description The plugin does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks such as adding them as employees. input type="hidden" name="maritalstatus" value="Single"...

CVE-2024-20725

Substance3D - Painter versions 9.1.1 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a...

PT-2024-2124 · Adobe · Acrobat Reader +4

Name of the Vulnerable Software and Affected Versions: Acrobat Reader versions 20.005.30539 through 23.008.20470 and earlier Adobe Acrobat 2020 and earlier Adobe Acrobat Reader Document Cloud versions prior to the fixed version Adobe Acrobat Document Cloud versions prior to the fixed version...

Huawei EulerOS: Security Advisory for grub2 (EulerOS-SA-2024-1141)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2023-47116

Label Studio is a popular open source data labeling tool. The vulnerability affects all versions of Label Studio prior to 1.11.0 and was tested on version 1.8.2. Label Studio's SSRF protections that can be enabled by setting the SSRFPROTECTIONENABLED environment variable can be bypassed to access...

The vulnerability of the software responsible for creating, monitoring, and orchestrating data processing scripts in Airflow is related to deficiencies in the deserialization mechanism. This allows attackers to replace the XCom data, thereby bypassing the protection provided by the “enable_xcom_pickling=False” configuration setting.

The vulnerability of the software used for creating, monitoring, and orchestrating data processing scripts in Airflow is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows an attacker to replace the XCom data, thereby bypassing the protection provided b...

USN-6611-1 exim4 vulnerability

It was discovered that Exim incorrectly handled certain requests. A remote attacker could possibly use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism...

EulerOS 2.0 SP9 : grub2 (EulerOS-SA-2023-3333)

According to the versions of the grub2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An out-of-bounds write flaw was found in grub2's NTFS filesystem driver. This issue may allow an attacker to present a specially crafted NTFS...

EulerOS Virtualization 2.9.1 : grub2 (EulerOS-SA-2024-1035)

According to the versions of the grub2 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - An out-of-bounds write flaw was found in grub2's NTFS filesystem driver. This issue may allow an attacker to present a specially...

EulerOS 2.0 SP11 : grub2 (EulerOS-SA-2023-3272)

According to the versions of the grub2 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An out-of-bounds write flaw was found in grub2's NTFS filesystem driver. This issue may allow an attacker to present a specially crafted NTFS...

PT-2023-26547 · Undefined · Undefined

Name of the Vulnerable Software and Affected Versions: No specific software or versions mentioned. Description: A vulnerability allows for the bypass of hardware-based kernel memory protection. Recommendations: At the moment, there is no information about a newer version that contains a fix for...

UBUNTU-CVE-2023-51764

Postfix through 3.8.5 allows SMTP smuggling unless configured with smtpddatarestrictions=rejectunauthpipelining and smtpddiscardehlokeywords=chunking or certain other options that exist in recent versions. Remote attackers can use a published exploitation technique to inject e-mail messages with ...

PT-2023-7999 · Eset · Eset Security For Microsoft Sharepoint Server +12

Name of the Vulnerable Software and Affected Versions: ESET NOD32 versions affected versions not specified ESET Internet Security versions affected versions not specified ESET Smart Security Premium versions affected versions not specified ESET Security Ultimate versions affected versions not...