Elber Cleber/3 Broadcast Multi-Purpose Platform 1.0.0 Authentication Bypass

Summary Cleber offers a powerful, flexible and modular hardware and software platform for broadcasting and contribution networks where customers can install up to six boards with no limitations in terms of position or number. Based on a Linux embedded OS, it detects the presence of the boards and...

Security Bulletin: AIX is affected by multiple vulnerabilities due to Python (CVE-2023-52425, CVE-2023-52426, CVE-2023-6597)

Summary Vulnerabilities in Python could allow a remote or local attacker to cause a denial of service CVE-2023-52425, CVE-2023-52426 or launch further attacks on the system CVE-2023-6597. Python is used by AIX as part of Ansible node management automation. Vulnerability Details CVEID:CVE-2023-524...

bind9: KeyTrap - Extreme CPU consumption in DNSSEC validator

Processing specially crafted responses coming from DNSSEC-signed zones can lead to uncontrolled CPU usage, leading to a Denial of Service in the DNSSEC-validating resolver side. This vulnerability applies only for systems where DNSSEC validation is enabled...

Positron Broadcast Signal Processor TRA7005 1.20 Authentication Bypass Exploit

The Positron Broadcast Digital Signal Processor TRA7005 version 1.20 suffers from an authentication bypass through a direct and unauthorized access to the password management functionality. The vulnerability allows attackers to bypass Digest authentication by manipulating the password endpoint...

Positron Broadcast Signal Processor TRA7005 v1.20 _Passwd Exploit

Summary The TRA7000 series is a set of products dedicated to broadcast, designed to guarantee an excellent quality-price ratio in compliance with current regulations and intended for individual broadcasters or radio networks. All models in the TRA7000 series are fully digital, using only...

CVE-2024-26728

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: fix null-pointer dereference on edid reading Use i2c adapter when there isn't auxmode in dclink to fix a null-pointer derefence that happens when running igt@kmsforceconnectorbasic in a system with DCN2.1 and HDM...

Dell PowerScale OneFS Incorrect Privilege Management Vulnerability

Dell PowerScale OneFS is an operating system from Dell USA. PowerScale OneFS operating system that provides horizontal scaling of NAS. An incorrect privilege management vulnerability exists in Dell PowerScale OneFS, which can be exploited by a local, high-privilege attacker to cause privilege...

Wear OS Security Bulletin—April 2024Stay organized with collectionsSave and categorize content based on your preferences.

The Wear OS Security Bulletin contains details of security vulnerabilities affecting the Wear OS platform. The full Wear OS update comprises the security patch level of 2024-04-05 or later from the April 2024 Android Security Bulletin in addition to all issues in this bulletin. We encourage all...

Exploit for Embedded Malicious Code in Tukaani Xz

CVE-2024-3094 Detection and Remediation Script This script is...

CVE-2024-29024

JumpServer is an open source bastion host and an operation and maintenance security audit system. An authenticated user can exploit the Insecure Direct Object Reference IDOR vulnerability in the file manager's bulk transfer by manipulating job IDs to upload malicious files, potentially compromisi...

CVE-2024-2929

A memory corruption vulnerability in Rockwell Automation Arena Simulation software could potentially allow a malicious user to insert unauthorized code to the software by corrupting the memory triggering an access violation. Once inside, the threat actor can run harmful code on the system. This...

Campcodes Complete Online Beauty Parlor Management System 安全漏洞

Campcodes Complete Online Beauty Parlor Management System is an online beauty parlor management system from Campcodes, Inc. A security vulnerability exists in Campcodes Complete Online Beauty Parlor Management System version 1.0, which originates from an SQL injection vulnerability in the email...

CVE-2021-47128 bpf, lockdown, audit: Fix buggy SELinux lockdown permission checks

In the Linux kernel, the following vulnerability has been resolved: bpf, lockdown, audit: Fix buggy SELinux lockdown permission checks Commit 59438b46471a "security,lockdown,selinux: implement SELinux lockdown" added an implementation of the lockeddown LSM hook to SELinux, with the aim to restric...

Design/Logic Flaw

A potential DLL hijacking vulnerability in the SanDisk PrivateAccess application for Windows that could lead to arbitrary code execution in the context of the system user. This vulnerability is only exploitable locally if an attacker has access to a copy of the user's vault or has already gained...

sssd bug fix update

An update is available for sssd. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The System Security Services Daemon SSSD service provides a set of daemons to...

CVE-2024-27922

CVE-2024-27922 affects TOMP Bare Server (node Bare Server) due to insecure handling of HTTP requests in the @tomphttp/bare-server-node package. The root cause relates to improper handling/validation of HTTP requests, which could allow manipulation of web traffic. Impact is described as potentiall...

BIT-ODOO-2021-44460

Improper access control in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier allows users with deactivated accounts to access the system with the deactivated account and any permission it still holds, via crafted RPC requests...

Improper Access Control

docassemble.base and docassemble.webapp are vulnerable to Improper Access Control. The vulnerability is due to improper validation of user-supplied input through URL parameters. An attacker can gain unauthorized access to information on the system by manipulating URLs to bypass access controls...

CVE-2024-0765

The CVE-2024-0765 entry concerns AnythingLLM where a default user on a multi‑user instance can call the /export-data endpoint, unzip/read the export, and exfiltrate system data at the saved state. The vulnerability relies on export functionality accessible to users with explicit system access at ...

Google Android suffers from an unspecified vulnerability (CNVD-2025-00873)

Google Android is a Linux-based open source operating system from Google. A security vulnerability exists in Google Android that stems from a logic error in the removePersistentDot method code of the SystemStatusAnimationSchedulerImpl.kt file, where a race condition may exist. No detailed...