Sylius 安全漏洞

Sylius is an open source e-commerce platform based on the Symfony framework from the Polish company Sylius. A security vulnerability exists in Sylius version v2.0.2, which stems from the inclusion of a rate limiting issue. An attacker exploiting this vulnerability could conduct a brute force...

CVE-2020-8489

Insufficient protection of the inter-process communication functions in ABB System 800xA Information Management all published versions enables an attacker authenticated on the local system to inject data, affecting the runtime values to be stored in the archive, or making Information Management...

CVE-2024-47614

async-graphql is a GraphQL server library implemented in Rust. async-graphql before 7.0.10 does not limit the number of directives for a field. This can lead to Service Disruption, Resource Exhaustion, and User Experience Degradation. This vulnerability is fixed in 7.0.10...

CVE-2024-29205

An Improper Check for Unusual or Exceptional Conditions vulnerability in the web component of Ivanti Connect Secure 9.x, 22.x and Ivanti Policy Secure 9.x, 22.x allows a remote unauthenticated attacker to send specially crafted requests in-order-to cause service disruptions...

CVE-2024-5552

kubeflow/kubeflow is vulnerable to a Regular Expression Denial of Service ReDoS attack due to inefficient regular expression complexity in its email validation mechanism. An attacker can remotely exploit this vulnerability without authentication by providing specially crafted input that causes th...

CVE-2024-5328

A Server-Side Request Forgery SSRF vulnerability exists in the lunary-ai/lunary application, specifically within the endpoint '/auth/saml/tto/download-idp-xml'. The vulnerability arises due to the application's failure to validate user-supplied URLs before using them in server-side requests. An...

CVE-2024-45207

DLL injection in Veeam Agent for Windows can occur if the system's PATH variable includes insecure locations. When the agent runs, it searches these directories for necessary DLLs. If an attacker places a malicious DLL in one of these directories, the Veeam Agent might load it inadvertently,...

The vulnerabilities in the modules msm/eva/msm_cvp_buf.c and msm/eva/msm_cvp.c of the embedded chips from Qualcomm allow a hacker to cause a service failure.

The vulnerability of the msm/eva/msmcvpbuf.c and msm/eva/msmcvp.c modules in Qualcomm’s embedded software is related to insufficient checking of input data. Exploiting this vulnerability can allow an attacker to cause malfunctions in the device...

mysql: Client: mysqldump unspecified vulnerability (CPU Apr 2024)

A flaw was found in the MySQL Server product of Oracle MySQL component: Client: mysqldump. Difficult to exploit vulnerability allows unauthenticated attacker with logon to the infrastructure where MySQL Server executes to compromise MySQL Server. Successful attacks of this vulnerability can resul...

The vulnerability of the ogs_dbi_auth_info() function (lib/dbi/subscription.c), which is used for creating and managing the NR/LTE Open5GS mobile network, allows a perpetrator to cause a service failure.

The vulnerability of the ogsdbiauthinfo function lib/dbi/subscription.c, which is used for creating and managing the NR/LTE Open5GS mobile network, is related to the unlimited distribution of resources. Exploiting this vulnerability could allow a remote attacker to cause service interruptions...

The vulnerability of the WindowServer component in MacOS operating systems allows a hacker to trigger a service failure.

The vulnerability of the WindowServer component in MacOS operating systems is related to resource management errors. Exploiting this vulnerability can allow a malicious actor to cause service interruptions remotely...

The vulnerability of the xsk_map_delete_elem function in the Linux operating system’s kernel allows a hacker to cause a service failure.

The vulnerability of the xskmapdeleteelem function in the Linux operating system is related to memory writing beyond the allocated buffer. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability of Moxa’s Ethernet switch microprogramming software lies in the fact that the operation output goes beyond the buffer in memory, allowing a hacker to trigger a service failure.

The vulnerability of Moxa’s Ethernet switch microprogramming software lies in the fact that the operation output escapes the buffer boundaries and enters memory. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

The vulnerability of the DXA demultiplexer in the FFmpeg multimedia library allows a hacker to cause a service failure.

The vulnerability of the DXA demultiplexer in the FFmpeg multimedia library is related to a numerical overflow condition. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability in Firefox and Firefox ESR web browsers, as well as in the Thunderbird email client, relates to reading data beyond the allowed buffer limits, allowing an attacker to cause a service failure.

The vulnerabilities in web browsers Firefox and Firefox ESR, as well as the Thunderbird email client, are related to reading data from buffer areas beyond the allowed limits. Exploiting these vulnerabilities can allow a remote attacker to cause service interruptions...

The vulnerability of components related to DRM, AMD, and display kernels in the Linux operating system allows a hacker to trigger a service failure.

The vulnerability of components such as DRM, AMD, and display kernels in the Linux operating system is related to improper validation of input data. Exploiting this vulnerability can allow an attacker to cause service failures...

The vulnerability of the dcmdata component in the library for working with the DICOM format allows a perpetrator to cause a service failure.

The vulnerability of the dcmdata component in the DICOM format processing library is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability could allow a malicious actor to cause service failures...

The vulnerability of the ea_get() function in the JFS file system (fs/jfs/xattr.c) of Linux operating systems allows a malicious actor to gain unauthorized access to protected information or cause service failures.

The vulnerability of the eaget function in the JFS file system driver fs/jfs/xattr.c in Linux operating systems is related to incorrect handling of data read from a damaged file system. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information or cau...

The vulnerability of the read_hexstring() function in the tcprewrite editor for editing and replaying PCAP files, allows a hacker to cause a service failure.

The vulnerability of the readhexstring function in the tcprewrite tool for editing and replaying PCAP files involves pointer manipulation. Exploiting this vulnerability could allow an attacker to cause service interruptions remotely...

The vulnerability of the mgmt_mesh_foreach() function in the net/bluetooth/mgmt_util.c module of operating systems running on Linux allows a attacker to compromise the confidentiality, integrity, and accessibility of protected information, or cause service failures.

The vulnerability of the mgmtmeshforeach function in the net/bluetooth/mgmtutil.c module of Linux operating systems is related to iterating over an inappropriate list called mgmtpending, which contains elements of type struct mgmtpendingCmd instead of struct mgmtmeshtx. Exploiting this...