265 matches found
DEBIAN-CVE-2024-36891
In the Linux kernel, the following vulnerability has been resolved: mapletree: fix masemptyarearev null pointer dereference Currently the code calls masstart followed by masdataend if the maple state is MASTART, but masstart may return with the maple state node == NULL. This will lead to a null...
CVE-2024-35550
The idccms v1.35 cloud management agent system is vulnerable to a Cross-Site Request Forgery (CSRF) vulnerability. The flaw exists in the /admin/infoWeb_deal.php component, specifically when the mudi parameter is set to rev . This vulnerability allows an attacker to perform unauthorized requests ...
CVE-2024-35550: Cross-Site Request Forgery (CSRF)
idccms v1.35 was discovered to contain a Cross-Site Request Forgery CSRF via the component /admin/infoWebdeal.php?mudi=rev...
CVE-2024-35559: Cross-Site Request Forgery (CSRF)
idccms v1.35 was discovered to contain a Cross-Site Request Forgery CSRF via the component /admin/infoMovedeal.php?mudi=rev&nohrefStr=close...
CVE-2024-35558: Cross-Site Request Forgery (CSRF)
idccms v1.35 was discovered to contain a Cross-Site Request Forgery CSRF via the component /admin/cadeal.php?mudi=rev&nohrefStr=close...
CVE-2024-35011: Cross-Site Request Forgery (CSRF)
idccms v1.35 was discovered to contain a Cross-Site Request Forgery CSRF via the component /admin/infoTypedeal.php?mudi=rev&nohrefStr=close...
PT-2024-3752 · D Link · D-Link Dir-619L
Name of the Vulnerable Software and Affected Versions: D-Link DIR-619L Rev.B version 2.06B1 Description: A buffer overflow issue in the /bin/boa via formTcpipSetup function of the D-Link DIR-619L router's firmware allows remote authenticated users to trigger a denial of service DoS through the...
PT-2024-4102
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to a null pointer dereference in the mas empty area rev function within the lib/maple tree.c module of the Linux kernel. This occurs when mas start is called followe...
CVE-2022-48704 drm/radeon: add a force flush to delay work when radeon
In the Linux kernel, the following vulnerability has been resolved: drm/radeon: add a force flush to delay work when radeon Although radeon card fence and wait for gpu to finish processing current batch rings, there is still a corner case that radeon lockup work queue may not be fully flushed, an...
NEXSYS-ONE security vulnerabilities
NEXSYS-ONE is a cloud platform from NEXSYS-ONE, Inc. A security vulnerability exists in versions prior to NEXSYS-ONE Rev. 15320 that stems from the presence of path traversal, which allows a remote attacker to obtain sensitive information...
CVE-2024-27301 Privilege Escalation Abusing installer in SupportApp
Support App is an opensource application specialized in managing Apple devices. It's possible to abuse a vulnerability inside the postinstall installer script to make the installer execute arbitrary code as root. The cause of the vulnerability is the fact that the shebang !/bin/zsh is being used...
CVE-2024-27301 Privilege Escalation Abusing installer in SupportApp
Support App is an opensource application specialized in managing Apple devices. It's possible to abuse a vulnerability inside the postinstall installer script to make the installer execute arbitrary code as root. The cause of the vulnerability is the fact that the shebang !/bin/zsh is being used...
CVE-2024-25331
DIR-822 Rev. B Firmware v2.02KRB09 and DIR-822-CA Rev. B Firmware v2.03WWb01 suffer from a LAN-Side Unauthenticated Remote Code Execution RCE vulnerability elevated from HNAP Stack-Based Buffer Overflow...
CVE-2024-23174
An issue was discovered in the PageTriage extension in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2. XSS can occur via the rev-deleted-user, pagetriage-tags-quickfilter-label, pagetriage-triage, pagetriage-filter-date-range-format-placeholder,...
CVE-2024-23174
An issue was discovered in the PageTriage extension in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2. XSS can occur via the rev-deleted-user, pagetriage-tags-quickfilter-label, pagetriage-triage, pagetriage-filter-date-range-format-placeholder,...
CVE-2024-23174: Improper Neutralization of Input During Web Page Generation
An issue was discovered in the PageTriage extension in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2. XSS can occur via the rev-deleted-user, pagetriage-tags-quickfilter-label, pagetriage-triage, pagetriage-filter-date-range-format-placeholder,...
GHSA-J9RC-W3WV-FV62 XWiki Platform vulnerable to reflected cross-site scripting through revision parameter in content menu
Impact XWiki is vulnerable to reflected cross-site scripting RXSS via the rev parameter that is used in the content of the content menu without escaping. If an attacker can convince a user to visit a link with a crafted parameter, this allows the attacker to execute arbitrary actions in the name ...
CVE-2023-46732
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki is vulnerable to reflected cross-site scripting RXSS via the rev parameter that is used in the content of the content menu without escaping. If an attacker can convince a user to visit a...
CVE-2023-46732: Improper Neutralization of Input During Web Page Generation
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. XWiki is vulnerable to reflected cross-site scripting RXSS via the rev parameter that is used in the content of the content menu without escaping. If an attacker can convince a user to visit a...
