CVE-2023-4552

Improper Input Validation vulnerability in OpenText AppBuilder on Windows, Linux allows Probe System Files. An authenticated AppBuilder user with the ability to create or manage existing databases can leverage them to exploit the AppBuilder server - including access to its local file system. This...

CVE-2023-4552 Java Database Connectivity (JDBC) URL Manipulation

Improper Input Validation vulnerability in OpenText AppBuilder on Windows, Linux allows Probe System Files. An authenticated AppBuilder user with the ability to create or manage existing databases can leverage them to exploit the AppBuilder server - including access to its local file system. This...

CVE-2024-23616

A buffer overflow vulnerability exists in Symantec Server Management Suite version 7.9 and before. A remote, anonymous attacker can exploit this vulnerability to achieve remote code execution as SYSTEM...

Vinchin Backup And Recovery 7.2 syncNtpTime Command Injection

CVE ID: CVE-2024-22899 Title: Command Injection Vulnerability in Vinchin Backup and Recovery's syncNtpTime Function in Versions 7.2 and Earlier Description: A critical security vulnerability, identified as CVE-2024-22899, has been discovered in the syncNtpTime function of Vinchin Backup and...

IBM eFilm Workstation Security Breach

IBM eFilm Workstation is a software application for viewing medical images from International Business Machines IBM. A security vulnerability exists in IBM eFilm Workstation that stems from the presence of an improper privilege management vulnerability. An authenticated, local attacker could...

PT-2024-19968 · Symantec · Symantec Deployment Solution

Name of the Vulnerable Software and Affected Versions: Symantec Deployment Solution version 7.9 Description: A buffer overflow vulnerability exists when parsing UpdateComputer tokens. A remote, anonymous attacker can exploit this issue to achieve remote code execution as SYSTEM. Recommendations:...

PT-2024-19971 · Symantec · Symantec Server Management Suite

Name of the Vulnerable Software and Affected Versions: Symantec Server Management Suite versions prior to 7.9 Description: A buffer overflow vulnerability exists, allowing a remote, anonymous attacker to achieve remote code execution as SYSTEM. Recommendations: For Symantec Server Management Suit...

PT-2024-19976 · Ibm · Ibm Merge Healthcare Efilm Workstation

Name of the Vulnerable Software and Affected Versions: IBM Merge Healthcare eFilm Workstation affected versions not specified Description: An improper privilege management issue exists, allowing a local, authenticated attacker to escalate privileges to SYSTEM. Recommendations: At the moment, ther...

CVE-2024-23899

Jenkins Git server Plugin 99.va0826abcdfad and earlier does not disable a feature of its command parser that replaces an '@' character followed by a file path in an argument with the file's contents, allowing attackers with Overall/Read permission to read content from arbitrary files on the Jenki...

Code injection

Jenkins Matrix Project Plugin 822.v01b8c85d16d2 and earlier does not sanitize user-defined axis names of multi-configuration projects, allowing attackers with Item/Configure permission to create or replace any config.xml files on the Jenkins controller file system with content not controllable by...

CVE-2024-22415

jupyter-lsp is a coding assistance tool for JupyterLab code navigation + hover suggestions + linters + autocompletion + rename using Language Server Protocol. Installations of jupyter-lsp running in environments without configured file system access control on the operating system level, and with...

Design/Logic Flaw

jupyter-lsp is a coding assistance tool for JupyterLab code navigation + hover suggestions + linters + autocompletion + rename using Language Server Protocol. Installations of jupyter-lsp running in environments without configured file system access control on the operating system level, and with...

CVE-2024-22415 Unsecured endpoints in the jupyter-lsp server extension

jupyter-lsp is a coding assistance tool for JupyterLab code navigation + hover suggestions + linters + autocompletion + rename using Language Server Protocol. Installations of jupyter-lsp running in environments without configured file system access control on the operating system level, and with...

CVE-2024-22415

CVE-2024-22415 relates to the jupyter-lsp server extension for JupyterLab. The vulnerability stems from unsecured endpoints that, when the jupyter-server is exposed to untrusted networks, permit unauthorised access and modification of files outside the jupyter root. Fix: upgrade to version 2.2.2 ...

PT-2024-19406

Name of the Vulnerable Software and Affected Versions jupyter-lsp versions prior to 2.2.2 Description The issue affects installations of jupyter-lsp running in environments without configured file system access control and with jupyter-server instances exposed to non-trusted networks, allowing...

PYSEC-2024-2

In Appwrite CLI before 3.0.0, when using the login command, the credentials of the Appwrite user are stored in a /.appwrite/prefs.json file with 0644 as UNIX permissions. Any user of the local system can access those credentials...

PYSEC-2024-2

In Appwrite CLI before 3.0.0, when using the login command, the credentials of the Appwrite user are stored in a /.appwrite/prefs.json file with 0644 as UNIX permissions. Any user of the local system can access those credentials...

IBM Db2 安全漏洞

IBM DB2 is a relational database management system from International Business Machines IBM. The main execution environments for this system are UNIX, Linux, IBMi, z/OS, and Windows server versions. An elevation of privilege vulnerability exists in IBM DB2, which can be exploited by an attacker t...

Voltronic Power ViewPower Remote Code Execution Vulnerability (CNVD-2025-2159900)

Voltronic Power ViewPower is Voltronic Power's monitoring and management software for solar inverters. A remote code execution vulnerability exists in Voltronic Power ViewPower Pro, which is caused by a lack of proper validation of user-supplied data and can lead to deserialization of untrustwort...

Voltronic Power ViewPower Remote Code Execution Vulnerability (CNVD-2025-2159406)

Voltronic Power ViewPower is Voltronic Power's monitoring and management software for solar inverters. A remote code execution vulnerability exists in Voltronic Power ViewPower, which can be exploited by an attacker to execute code in the SYSTEM context...