RuvarOA 安全漏洞

RuvarOA is an office automation system of Ruvar China. A SQL injection vulnerability exists in RuvarOA v6.01 and v12.01, which originates from the id parameter of the /SysManage/sysblogtemplatenew.aspx file that lacks validation of externally entered SQL statements. An attacker can exploit this...

PT-2024-40719 · Git +1 · Matio

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a crash type of UNKNOWN READ, with a crash state involving repeated calls to Mat VarPrint. No information is provided about the...

PYSEC-2024-207

Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. In versions 0.3.10 and prior, using the slice builtin can result in a double eval vulnerability when the buffer argument is either msg.data, self.code or .code and either the start or length arguments have side-effects...

CVE-2024-32459 FreeRDP Out-Of-Bounds Read in ncrush_decompress

FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients and servers that use a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch the issue. No known workarounds are available...

CVE-2024-32040 FreeRDP vulnerable to integer underflow in nsc_rle_decode

FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version of FreeRDP prior to 3.5.0 or 2.11.6 and have connections to servers using the NSC codec are vulnerable to integer underflow. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, do not...

PT-2024-5034

Name of the Vulnerable Software and Affected Versions: Bouncy Castle Java BC Java versions 1.78 and earlier Bouncy Castle Java LTS BC Java LTS versions 2.73.6 and earlier Bouncy Castle FIPS Java API BC-FJA versions 1.0.2.5 and earlier Bouncy Castle C .Net versions 2.3.1 and earlier Bamboo Data...

PT-2024-3032 · Unknown +1 · Kv Replay Viewer +2

Name of the Vulnerable Software and Affected Versions: KV STUDIO versions 11.64 and earlier KV REPLAY VIEWER versions 2.64 and earlier VT5-WX15/WX12 versions 6.02 and earlier Description: An out-of-bounds write vulnerability exists, which may lead to information disclosure or arbitrary code...

PT-2024-40693 · Git +1 · Tarantool

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a crash type of UNKNOWN READ with a crash state of NULL, as reported by OSS-Fuzz. No additional details are provided about the...

CVE-2024-30386

CVE-2024-30386 is a Use-After-Free vulnerability in the Layer 2 Address Learning Daemon (l2ald) of Juniper Networks Junos OS and Junos OS Evolved. In EVPN-VXLAN deployments, state updates processed by adjacent systems may flow in an unsafe order, causing l2ald to crash and restart, leading to a D...

PT-2024-20323 · Canimaan Software · Clamav

Name of the Vulnerable Software and Affected Versions: Canimaan Software LTD ClamXAV versions 3.1.2 through 3.6.1 Description: An issue in Canimaan Software LTD ClamXAV allows a local attacker to escalate privileges via the ClamXAV helper tool component. Recommendations: For versions 3.1.2 throug...

PT-2024-12374 · Qualcomm · 215 Mobile Firmware +307

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue involves memory corruption that occurs while processing the finish sign command, specifically when attempting to pass a rsp buffer. This can...

PT-2024-23486 · Unknown · Mighty Classic Pros/Cons

Name of the Vulnerable Software and Affected Versions: Mighty Classic Pros And Cons versions 2.0.9 and earlier Description: The issue is related to improper neutralization of input during web page generation, which leads to a Cross-site Scripting XSS vulnerability, specifically Stored XSS...

CVE-2024-25580

An issue was discovered in gui/util/qktxhandler.cpp in Qt before 5.15.17, 6.x before 6.2.12, 6.3.x through 6.5.x before 6.5.5, and 6.6.x before 6.6.2. A buffer overflow and application crash can occur via a crafted KTX image file...

PT-2024-2483

Name of the Vulnerable Software and Affected Versions latchset Jose versions prior to 11 Description The issue is related to an uncontrolled resource consumption in the latchset Jose module for signing and encrypting JSON objects. This can be exploited by an attacker to cause a denial of service...

OESA-2024-1291 aops-zeus security update

A host and user manager service which is the foundation of aops. Security Fixes: In aops-zeus software versions 1.2.01.4.1, there is a vulnerability in the plugin management command of the zeus/conf/constant file. Through this vulnerability, an attacker can implant arbitrary commands to be execut...

PT-2024-2557 · Vinchin · Vinchin Backup & Recovery

Name of the Vulnerable Software and Affected Versions: Vinchin Backup and Recovery versions 7.2 and earlier Description: The issue is related to the getVerifydiyResult function, which is vulnerable to Authenticated Remote Code Execution RCE. This vulnerability can be exploited by a remote attacke...

Musicshelf Security Breach

Musicshelf is a music shelf software by RedNesto Individual Developer. It is used to help manage sheet music and various related assets. A security vulnerability exists in Musicshelf versions 1.0, 1.1, which stems from iofabricsdkandroidservices in the component SHA-1Handler contains unknown...

CVE-2024-1299 Privilege Chaining in GitLab

A privilege escalation vulnerability was discovered in GitLab affecting versions 16.8 prior to 16.8.4 and 16.9 prior to 16.9.2. It was possible for a user with custom role of managegroupaccesstokens to rotate group access tokens with owner privileges...

PT-2024-20504 · Unknown · W3Speedster

Name of the Vulnerable Software and Affected Versions: W3SPEEDSTER versions prior to 7.20 Description: A Cross-Site Request Forgery CSRF issue affects the software, allowing unauthorized actions to be performed on behalf of a user. Recommendations: For versions prior to 7.20, update to version 7....

CVE-2024-23805

Undisclosed requests can cause the Traffic Management Microkernel TMM to terminate. For the Application Visibility and Reporting module, this may occur when the HTTP Analytics profile with URLs enabled under Collected Entities is configured on a virtual server and the DB variables...