BELL-CVE-2023-52652

Bulletin has no description...

CVE-2023-47212

A heap-based buffer overflow vulnerability exists in the comment functionality of stb vorbis.c v1.22. A specially crafted .ogg file can lead to an out-of-bounds write. An attacker can provide a malicious file to trigger this vulnerability...

Navidrome Parameter Tampering vulnerability

Summary Parameter tampering is a vulnerability where an attacker has the ability to manipulate parameter values in the HTTP requests. Details The attacker is able to change the parameter values in the body and successfully impersonate another user. In this case, the attacker created a playlist,...

PT-2024-41124 · Ооо 'Симпл 1' · Simpleone Platform

Уязвимость программного обеспечения SimpleOne Platform, связанная с непринятием мер по нейтрализации scipt-related тэгов html на веб-странице. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, внедрить HTML-тег с указанием ссылки на внешний ресурс...

PT-2024-25191 · Typora · Typora

Name of the Vulnerable Software and Affected Versions: Typora versions 1.0.0 through 1.7 Description: The issue is related to a cross-site scripting XSS vulnerability in the Markdown editor, which allows attackers to execute arbitrary code by uploading Markdown files. Recommendations: For version...

CVE-2024-32211

An issue in LOGINT LoMag Inventory Management v1.0.20.120 and before allows a local attacker to obtain sensitive information via the UserClass.cs and Settings.cs components...

CVE-2024-33442

An issue in flusity-CMS v.2.33 allows a remote attacker to execute arbitrary code via the addpost.php component...

Authorization Bypass

roundup is vulnerable to Authorization Bypass. The vulnerability is due to improper property permissions checks, allowing unauthorized manipulation or access to restricted properties through certain methods...

Sensitive Information Exposure

RhodeCode and Kallithea is vulnerable to Sensitive Information Exposure. The vulnerability is due to a lack of admin authentication which allows remote users to obtain API keys and other sensitive information via the getrepo API method...

Cross Site Scripting(XSS)

roundup is vulnerable to Cross Site Scripting XSS. The vulnerability is due to improper escape mechanisms within templating.py, which allows an attacker to preform cross site scripting...

BELL-CVE-2024-26927

Bulletin has no description...

OSV-2024-390 Heap-buffer-overflow in H5O__cache_chk_serialize

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=67889 Crash type: Heap-buffer-overflow READ Crash state: H5Ocachechkserialize H5Cgenerateimage H5Cflushsingleentry...

OSV-2024-341 UNKNOWN READ in PointerVector.h

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=67287 Crash type: UNKNOWN READ Crash state: PointerVector.h...

PT-2024-41445 · Ооо "Вебсофт Девелопмент" · Websoft Hcm

Уязвимость программного обеспечения автоматизации HR-процессов Websoft HCM связана с непринятием мер по защите структуры веб-страницы. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, провести атаку межсайтового скриптинга XSS путём внедрения специально сформированного...

CVE-2024-33101

A stored cross-site scripting XSS vulnerability in the component /action/anti.php of ThinkSAAS v3.7.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the word parameter...

CVE-2024-27322

Deserialization of untrusted data can occur in the R statistical programming language, on any version starting at 1.4.0 up to and not including 4.4.0, enabling a maliciously crafted RDS R Data Serialization formatted file or R package to run arbitrary code on an end user’s system when interacted...

Server Side Template Injection

changedetection.io is vulnerable to Remote Command Execution. The vulnerability is due to improper sanitization of user summited input, which allows an attacker to execute arbitrary code on the host...

CVE-2023-52726

Open Networking Foundation SD-RAN ONOS onos-ric-sdk-go 0.8.12 allows infinite repetition of the processing of an error in the Subscribe function implementation for the subscribed indication stream...

CVE-2024-33338

Cross Site Scripting vulnerability in jizhicms v.2.5.4 allows a remote attacker to obtain sensitive information via a crafted article publication request...

PT-2024-30276 · Hubbank · Hubbank

Name of the Vulnerable Software and Affected Versions: HubBank version 1.0.2 Description: The issue allows a registered user to upload malicious PHP files via upload document fields, resulting in webshell execution. This is a critical unrestricted file upload vulnerability. Recommendations: For...