BIT-MOODLE-2021-40692

Insufficient capability checks made it possible for teachers to download users outside of their courses...

Lost and Found Information System SQL Injection Vulnerability

Lost and Found Information System is a lost and found information system by oretnom23 individual developers. A SQL injection vulnerability exists in the Sourcecodester Lost and Found Information System version 1.0, which originates from the system's susceptibility to unauthenticated SQL injection...

Apple iOS and iPadOS Security Vulnerabilities

Apple iOS and Apple iPadOS are products of Apple Inc. Apple iOS is an operating system developed for mobile devices, and Apple iPadOS is an operating system for iPad tablets. A security vulnerability exists in Apple iOS version 17.4 and iPadOS version 17.4, which originates from an application th...

CVE-2024-23835 Suricata's pgsql: memory exhaustion use on record parsing

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to version 7.0.3, excessive memory use during pgsql parsing could lead to OOM-related crashes. This vulnerability is patched in 7.0.3. As workaround, users can disable the...

TP-LINK ER7206 OS Command Injection Vulnerability (CNVD-2024-13527)

The TP-LINK ER7206 is a multi-function Gigabit router from China P&L TP-LINK. An operating system command injection vulnerability exists in the TP-LINK ER7206 version 1.3.0 build 20230322 Rel.70591, which stems from a specially crafted HTTP request that could lead to arbitrary command injection. ...

Barangay Population Monitoring System SQL Injection Vulnerability

Barangay Population Monitoring System is a regional population monitoring system by the individual developer Remy Andrade. A security vulnerability exists in Barangay Population Monitoring System version 1.0, which originates from a SQL injection vulnerability in the file...

CVE-2024-25215

Employee Managment System v1.0 was discovered to contain a SQL injection vulnerability via the pwd parameter at /aprocess.php...

CVE-2024-0167

Dell Unity, versions prior to 5.4, contains an OS Command Injection Vulnerability in the svctopstats utility. An authenticated attacker could potentially exploit this vulnerability, leading to the ability to overwrite arbitrary files on the file system with root privileges...

CVE-2024-23673

Malicious code execution via path traversal in Apache Software Foundation Apache Sling Servlets Resolver.This issue affects all version of Apache Sling Servlets Resolver before 2.11.0. However, whether a system is vulnerable to this attack depends on the exact configuration of the system. If the...

The vulnerability of the FileProvider component in the macOS operating system allows a hacker to disclose protected information.

The vulnerability of the FileProvider component in the macOS operating system is related to the lack of protection for service data. Exploiting this vulnerability can allow an attacker to disclose protected information...

Arbitrary File Write

Nginx-UI is vulnerable to Arbitrary File Write vulnerability. The vulnerability is due to improper input validation when adding certificates. This issue can be exploited by an attacker to write into arbitrary paths in the system...

Remote code execution

Nginx-UI is a web interface to manage Nginx configurations. The Import Certificate feature allows arbitrary write into the system. The feature does not check if the provided user input is a certification/key and allows to write into arbitrary paths in the system. It's possible to leverage the...

PT-2024-2034 · Otrs · Otrs

Name of the Vulnerable Software and Affected Versions: OTRS versions 7.0.X through 7.0.48 OTRS versions 8.0.X through 8.0.37 OTRS versions 2023.X through 2023.1.1 Description: The issue is related to the handling of attachments in ticket comments, allowing another user to add attachments...

Authentication flaw

An authentication bypass vulnerability was found in overt-engine. This flaw allows the creation of users in the system without authentication due to a flaw in the CreateUserSession command...

The vulnerability of the DisableDevice function in the Wayland protocol implementation for X.Org XWayland, which is part of the X Window System X.Org Server, allows a attacker to trigger a service failure or execute arbitrary code.

The vulnerability of the DisableDevice function in the Wayland protocol implementation for X.Org XWayland, which is part of the X.Org Server for the X Window System, is related to buffer overflow attacks. Exploiting this vulnerability can allow an attacker to cause a service failure or execute...

Xxe

Electronic Deliverables Creation Support Tool Construction Edition prior to Ver1.0.4 and Electronic Deliverables Creation Support Tool Design & Survey Edition prior to Ver1.0.4 improperly restrict XML external entity references XXE. By processing a specially crafted XML file, arbitrary files on t...

CVE-2024-22380

Electronic Delivery Check System Ministry of Agriculture, Forestry and Fisheries The Agriculture and Rural Development Project Version March, Heisei 31 era edition Ver.14.0.001.002 and earlier improperly restricts XML external entity references XXE. By processing a specially crafted XML file,...

The vulnerability of the AIX operating system, related to the execution of operations beyond the buffer in memory, allows an attacker to execute arbitrary commands.

The vulnerability of the AIX operating system is related to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability allows an attacker to execute arbitrary commands using invscout...

Electronic Delivery Check System Security Vulnerability

MAFF Electronic Delivery Check System is an electronic delivery check system from MAFF Japan. A security vulnerability exists in Electronic Delivery Check System Ver.14.0.001.002 and earlier versions, which stems from the handling of specially crafted XML files that may lead to the exposure of...

CVE-2023-35020 IBM Sterling Control Center directory traversal

IBM Sterling Control Center 6.3.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system. IBM X-Force ID: 257874...