MAL-2024-1002 Malicious code in erc20-testenv (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1ba12fa784008a111d1c5f54bbb19cf4807564ce4e06434d4a10eae96767350a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Bricks < 1.9.6.1 - Unauthenticated Remote Code Execution

Description The plugin does not prevent unauthenticated visitors from running code on vulnerable sites. PoC Run the following JS on any site using the theme: await fetch"/wp-json/bricks/v1/renderelement", "credentials": "include", "headers": "Content-Type": "application/json" , "body":...

Intel Unite Access Control Error Vulnerability

Intel Unite is a suite of enterprise meeting collaboration solutions from Intel Corporation USA. A security vulnerability previously existed in Intel Unite Client software version 4.2.35041, which stemmed from improper access control in the affected product. It could allow authenticated users to...

Intel VROC software security vulnerability

Intel VROC software is an application from Intel Corporation USA. A security vulnerability exists in Intel VROC software prior to version 8.0.8.1001, which stems from an uncontrolled search path element issue that could lead to privilege escalation via local access by an authenticated user...

Intel ACAT software security vulnerability

Intel ACAT is an open source platform from Intel Corporation. A security vulnerability exists in Intel ACAT software prior to version 2.0.0, which stems from an incorrect default privilege issue that could lead to privilege escalation via local access by an authenticated user...

CVE-2024-1485 Registry-support: decompress can delete files outside scope via relative paths

A flaw was found in the decompression function of registry-support. This issue can be triggered if an unauthenticated remote attacker tricks a user into parsing a devfile which uses the parent or plugin keywords. This could download a malicious archive and cause the cleanup process to overwrite o...

Heap overflow

A vulnerability has been identified in Tecnomatix Plant Simulation V2201 All versions V2201.0012, Tecnomatix Plant Simulation V2302 All versions V2302.0006. The affected application is vulnerable to heap-based buffer overflow while parsing specially crafted WRL files. This could allow an attacker...

BELL-CVE-2024-1454

Bulletin has no description...

BELL-CVE-2023-52429

Bulletin has no description...

CVE-2024-1062 389-ds-base: a heap overflow leading to denail-of-servce while writing a value larger than 256 chars (in log_entry_attr)

A heap overflow flaw was found in 389-ds-base. This issue leads to a denial of service when writing a value larger than 256 chars in logentryattr...

CVE-2024-25740

A memory leak flaw was found in the UBI driver in drivers/mtd/ubi/attach.c in the Linux kernel through 6.7.4 for UBIIOCATT, because kobj-name is not released...

PT-2024-11518 · Ibm · Ibm Robotic Process Automation

Name of the Vulnerable Software and Affected Versions: IBM Robotic Process Automation version 21.0.2 Description: The issue allows user ids to be exposed across tenants. Recommendations: For IBM Robotic Process Automation version 21.0.2, at the moment, there is no information about a newer versio...

CVE-2024-24337

CSV Injection vulnerability in '/members/moremember.pl' and '/admin/aqbudgets.pl' endpoints in Koha Library Management System version 23.05.05 and earlier allows attackers to to inject DDE commands into csv exports via the 'Budget' and 'Patrons Member' components...

CVE-2023-45718 HCL Sametime is impacted by a failure to invalidate sessions

Sametime is impacted by a failure to invalidate sessions. The application is setting sensitive cookie values in a persistent manner in Sametime Web clients. When this happens, cookie values can remain valid even after a user has closed out their session...

Sensitive Information Disclosure

github.com/rancher/rancher is vulnerable to Sensitive Information Disclosure. This vulnerability arises due to the exposure of various sensitive data, including HTTP headers, credentials, and API Server calls, leaked into Rancher's audit logs when AUDITLEVEL is set to 1 or above. An attacker can...

CVE-2024-25677

In Min before 1.31.0, local files are not correctly treated as unique security origins, which allows them to improperly request cross-origin resources. For example, a local file may request other local files through an XML document...

CVE-2024-23749

KiTTY versions 0.76.1.13 and before is vulnerable to command injection via the filename variable, occurs due to insufficient input sanitization and validation, failure to escape special characters, and insecure system calls at lines 2369-2390. This allows an attacker to add inputs inside the...

CVE-2024-0242 Unauthorized access to settings in Qolsys IQ Panel 4 and IQ4 Hub

Under certain circumstances IQ Panel4 and IQ4 Hub panel software prior to version 4.4.2 could allow unauthorized access to settings...

CVE-2024-1329 Nomad Vulnerable to Arbitrary Write Through Symlink Attack

HashiCorp Nomad and Nomad Enterprise 1.5.13 up to 1.6.6, and 1.7.3 template renderer is vulnerable to arbitrary file write on the host as the Nomad client user through symlink attacks. This vulnerability, CVE-2024-1329, is fixed in Nomad 1.7.4, 1.6.7, and 1.5.14...

PT-2024-12874

Name of the Vulnerable Software and Affected Versions Atos Unify OpenScape Voice Trace Manager versions prior to V8 R0.9.11 Description The issue allows authenticated path traversal in the user interface. Recommendations For versions prior to V8 R0.9.11, update to V8 R0.9.11 or later to resolve t...