CVE-2024-36443

Swissphone DiCal-RED 4009 devices are affected by CVE-2024-36443 through a Missing Authentication for a Critical Function (CWE-306) flaw that lets a remote attacker read almost the entire file system via anonymous FTP. Public disclosures (SySS advisory SYSS-2024-036, PacketStorm entry) describe t...

CVE-2024-6337 Incorrect Authorization allows read access to issues in GitHub Enterprise Server

An Incorrect Authorization vulnerability was identified in GitHub Enterprise Server that allowed a GitHub App with only content: read and pullrequestwrite: write permissions to read issue content inside a private repository. This was only exploitable via user access token and installation access...

Jenkins Command Line Interface (CLI) Path Traversal Vulnerability

Jenkins Command Line Interface CLI contains a path traversal vulnerability that allows attackers limited read access to certain files, which can lead to code execution...

CVE-2024-42287 scsi: qla2xxx: Complete command early within lock

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Complete command early within lock A crash was observed while performing NPIV and FW reset, BUG: kernel NULL pointer dereference, address: 000000000000001c PF: supervisor read access in kernel mode PF:...

The vulnerability of the Personalization component of the Oracle Applications Framework, a web application development platform, within the Oracle E-Business Suite, allows an intruder to gain unauthorized access to read, modify, or delete data.

The vulnerability of the Personalization component of the Oracle Applications Framework, a platform for developing web applications in enterprise automation systems within the Oracle E-Business Suite, is related to improper authentication. Exploiting this vulnerability allows an attacker to gain...

CVE-2024-34727

In sdpucompareuuidwithattr of sdputils.cc, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2024-5999 · Adobe · Commerce +1

Name of the Vulnerable Software and Affected Versions: Adobe Commerce versions 2.4.7-p1 through 2.4.4-p9 and earlier Magento Open Source versions 2.4.7-p1 through 2.4.4-p9 and earlier Description: The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known a...

PT-2024-30269 · Jenkins +1 · Jenkins +1

Name of the Vulnerable Software and Affected Versions: Jenkins versions 2.470 and earlier Jenkins LTS versions 2.452.3 and earlier Description: The issue arises from a lack of permission check in an HTTP endpoint, allowing attackers with Overall/Read permission to access other users' "My Views"...

CVE-2024-39379

Acrobat for Edge versions 126.0.2592.81 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that...

CVE-2024-39379 Acrobat for Edge | Out-of-bounds Read (CWE-125)

Acrobat for Edge versions 126.0.2592.81 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that...

CVE-2024-41029

A vulnerability was found in the nvmem subsystem in the Linux kernel. This issue allows excessive permissions for the cell sysfs attribute, potentially exposing sensitive data beyond what is permitted for the main attribute. Mitigation Mitigation for this issue is either not available or the...

The vulnerability of the SCADA system MasterSCADA 4D, related to deficiencies in authentication procedures, allows a intruder to read and write arbitrary files.

The vulnerability of the SCADA system MasterSCADA 4D is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to perform read and write operations on arbitrary files...

The vulnerability of the AddGeneratedReport method in the SolarWinds Access Rights Manager (ARM) access control software allows a perpetrator to gain read, modify, or delete access to data.

The vulnerability of the AddGeneratedReport method in the SolarWinds Access Rights Manager ARM access control software is related to incorrect restrictions on the path name to the restricted directory. Exploiting this vulnerability could allow a malicious actor to gain read, modify, or delete...

The vulnerability of the PAM system for JumpServer is related to incorrect restrictions on the path name to the restricted directory. This allows a intruder to gain unauthorized access to read any files in the Celery container.

The vulnerability of the PAM system for privileged access control in JumpServer is related to incorrect restrictions on the path name to the restricted directory. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized read access to arbitrary files i...

UBUNTU-CVE-2024-5321

A security issue was discovered in Kubernetes clusters with Windows nodes where BUILTIN\Users may be able to read container logs and NT AUTHORITY\Authenticated Users may be able to modify container logs...

OpenJDK: Range Check Elimination (RCE) pre-loop limit overflow (8320548)

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Hotspot. Supported versions that are affected are Oracle Java SE: 8u411, 8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM for JDK: 17.0.11, 21.0.3, 22.0....

CVE-2024-21150

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards component: Web Runtime SEC. Supported versions that are affected are Prior to 9.2.8.2. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards...

CVE-2024-21155

Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems component: User Interface. The supported version that is affected is 8.8. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle ZFS Storage Appliance Kit...

CVE-2024-21139

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics component: Analytics Web Answers. Supported versions that are affected are 7.0.0.0.0, 7.6.0.0.0 and 12.2.1.4.0. Easily exploitable vulnerability allows low privileged attacker with network access via...

UBUNTU-CVE-2024-21164

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. Supported versions that are affected are Prior to 7.0.20. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromi...