USN-7192-1 xfpt vulnerability

It was discovered that xfpt did not properly manage memory under certain circumstances. If a user were tricked into opening a specially crafted file, an attacker could possibly use this issue to cause the application to crash or execute arbitrary code...

Unsound usages of `u8` type casting in spl-token-swap

The library provides a safe public API unpack to cast u8 array to arbitrary types, which can cause to undefined behaviors. The length check of array can only prevent out-of-bound access on the return type. However, it can't prevent misaligned pointer when casting u8 pointer to a type aligned to...

CVE-2024-54100

Vulnerability of improper access control in the secure input module Impact: Successful exploitation of this vulnerability may cause features to perform abnormally...

MAL-2024-11377 Malicious code in ksdsjdksjmncnjsdmsnd (npm)

--- -= Per source details. Do not edit below this line.=-...

CVE-2024-11310

The DVC from TRCore has a Path Traversal vulnerability, allowing unauthenticated remote attackers to exploit this vulnerability to read arbitrary system files...

Intel IPP 代码问题漏洞

Intel IPP is a multithreaded software library from Intel Corporation USA. It is used in multimedia and data processing applications. A code issue vulnerability exists in Intel IPP versions prior to 2021.12.0 that stems from an uncontrolled search path. An attacker could exploit this vulnerability...

CVE-2024-30133

HCL Traveler for Microsoft Outlook HTMO is susceptible to a control flow vulnerability. The application does not sufficiently manage its control flow during execution, creating conditions in which the control flow can be modified in unexpected ways...

CVE-2024-50573

In JetBrains Hub before 2024.3.47707 improper access control allowed users to generate permanent tokens for unauthorized services...

CVE-2024-8602 XML Eternal Entity Attack in the Software Library taxstatement.jar

When the XML is read from the codes in the PDF and parsed using a DocumentBuilder, the default settings of the DocumentBuilder allow for an XXE XML External Entity attack. Further information on this can be found on the website of the Open Worldwide Application Security Project OWASP. An attacker...

CVE-2024-8602

CVE-2024-8602 concerns XXE in XML parsing from PDFs via the default DocumentBuilder settings in taxstatement.jar. Connected data confirms affected software: taxstatement.jar versions 2.2.2 and 2.2.4. Root cause: DocumentBuilder configured to allow external entities, enabling an XML external entit...

CVE-2024-6135 BT:Classic: Multiple missing buf length checks

BT:Classic: Multiple missing buf length checks...

CVE-2024-7078

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Semtek Informatics Software Consulting Inc. Semtek Sempos allows SQL Injection.This issue affects Semtek Sempos: through 31072024...

CVE-2024-45447

Access control vulnerability in the camera framework module Impact: Successful exploitation of this vulnerability may affect service confidentiality...

CVE-2024-38157

Azure IoT SDK Remote Code Execution Vulnerability...

USN-6904-1 pymongo vulnerability

It was discovered that PyMongo incorrectly handled certain BSON. An attacker could possibly use this issue to read sensitive information or cause a crash...

CVE-2024-38091

Microsoft WS-Discovery Denial of Service Vulnerability...

CVE-2023-37541

HCL Connections contains a broken access control vulnerability that may allow unauthorized user to update data in certain scenarios...

UBUNTU-CVE-2024-38276

Incorrect CSRF token checks resulted in multiple CSRF risks...

UBUNTU-CVE-2024-34001

Actions in the admin preset tool did not include the necessary token to prevent a CSRF risk...

CVE-2024-3979 COVESA vsomeip race condition

A vulnerability, which was classified as problematic, has been found in COVESA vsomeip up to 3.4.10. Affected by this issue is some unknown functionality. The manipulation leads to race condition. An attack has to be approached locally. The exploit has been disclosed to the public and may be used...