CVE-2024-6396

A vulnerability in the backuprun function in aimhubio/aim version 3.19.3 allows remote attackers to overwrite any file on the host server and exfiltrate arbitrary data. The vulnerability arises due to improper handling of the runhash and repo.path parameters, which can be manipulated to create an...

Medium: java-17-amazon-corretto

Issue Overview: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Hotspot. Supported versions that are affected are Oracle Java SE: 8u431-perf, 11.0.25, 17.0.13, 21.0.5, 23.0.1; Oracle GraalVM for JDK: 17.0.13,...

The vulnerability of the `ksmbd_vfs_stream_read()` function in the KSMBD daemon of the Linux operating system allows a hacker to disclose protected information and cause service failures.

The vulnerability of the ksmbdvfsstreamread function in the KSMBD daemon of the Linux operating system is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability can allow a remote attacker to disclose sensitive information and cause service failures by...

The vulnerability of the GraphQL Query Handler component of the software platform based on Git, which is used for collaborative code development in GitLab EE/CE, allows a perpetrator to access confidential information.

The vulnerability of the GraphQL Query Handler component in the Git-based software platform, which is used for collaborative code development in GitLab EE/CE, is related to the absence of authentication. Exploiting this vulnerability allows a malicious actor to gain access to confidential...

HPESBNW04770 rev.2 - HPE Telco Service Orchestrator, Remote Unauthorized Data Injection Vulnerabilities

Potential Security Impact: Remote: Unauthorized Data Injection SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Telco Service Orchestrator - Prior to v5.2.0 CVSS Scores: | CVE | CVSS Vector | Base Score | | --- | --- | --- | | CVE-2024-52798 |...

CVE-2024-51462 IBM QRadar WinCollect Agent data manipulation

IBM QRadar WinCollect Agent 10.0.0 through 10.1.12 could allow a remote attacker to inject XML data into parameter values due to improper input validation of assumed immutable data...

IBM QRadar WinCollect Agent 安全漏洞

IBM QRadar WinCollect Agent is an agent program from International Business Machines IBM that collects and sends Windows event logs. A security vulnerability exists in IBM QRadar WinCollect Agent versions 10.0.0 through 10.1.12, which arises from improper validation of inputs for assumed immutabl...

PT-2025-1134

Name of the Vulnerable Software and Affected Versions Ivanti EPM versions before 2024 January-2025 Security Update Ivanti EPM versions before 2022 SU6 January-2025 Security Update Description The issue is related to an absolute path traversal in Ivanti EPM, which can be exploited by a remote...

HPESBNW04772 rev.1 - Aruba CX 10000 Switch Series, Traffic Handling Vulnerability

Potential Security Impact: Remote: Unauthorized Access to Data SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. Aruba CX 10000 Switch Series See summary for affected versions. Affected Products HPE Aruba Networking CX 10000 Switch Series running the following CX Operating System...

CVE-2024-25037

IBM Cognos Controller 11.0.0 through 11.0.1 and IBM Controller 11.1.0 could allow a remote attacker to obtain sensitive information when a stack trace is returned in the browser...

CVE-2024-5591

IBM Jazz Foundation 7.0.2, 7.0.3, and 7.1.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system...

The vulnerability of Dell RecoverPoint’s data protection software for virtual machines, related to the use of strictly encrypted credentials, allows attackers to gain unauthorized access to protected information.

The vulnerability of Dell RecoverPoint’s data protection software for virtual machines relates to the use of strictly encrypted authentication credentials. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information remotely...

CVE-2024-49820

IBM Security Guardium Key Lifecycle Manager 4.1, 4.1.1, 4.2.0, and 4.2.1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using man i...

ansible-core: Unsafe Tagging Bypass via hostvars Object in Ansible-Core

A flaw was found in Ansible-Core. This vulnerability allows attackers to bypass unsafe content protections using the hostvars object to reference and execute templated content. This issue can lead to arbitrary code execution if remote data or module outputs are improperly templated within playboo...

LightFTP 安全漏洞

LightFTP is a lightweight FTP service by hfiref0x individual developers. A security vulnerability exists in LightFTP version 2.3, which stems from a lack of thread security on the server and can be caused to crash by anomalous data sent by an anonymous user from a remote network...

The vulnerability of the HTTP client library for Python urllib3, related to improper resource transfer between components, allows attackers to gain unauthorized access to protected information.

The vulnerability of the HTTP client library for Python urllib3 is related to improper handling of the Proxy-Authorization header during redirects between sources. Exploiting this vulnerability can allow a remote attacker to gain unauthorized access to protected information...

PT-2025-3052

Name of the Vulnerable Software and Affected Versions visionOS versions prior to 2.2 tvOS versions prior to 18.2 Safari versions prior to 18.2 watchOS versions prior to 11.2 iOS versions prior to 18.2 iPadOS versions prior to 18.2 macOS Sequoia versions prior to 15.2 Description The issue is...

PT-2024-34547 · Jepaas · Jepaas

Name of the Vulnerable Software and Affected Versions: JEPAAS version 7.2.8 Description: The issue allows a remote user to submit a specially crafted query via the /je/rbac/rbac/loadLoginCount API endpoint in the dateVal parameter. This could enable an attacker to retrieve all the information...

CVE-2024-48868

An improper neutralization of CRLF sequences 'CRLF Injection' vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers to modify application data. We have already fixed the vulnerability in the following version...

CVE-2024-48867

An improper neutralization of CRLF sequences 'CRLF Injection' vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers to modify application data. We have already fixed the vulnerability in the following version...