Oracle Solaris 安全漏洞

Oracle Solaris is a UNIX operating system from Oracle Corporation USA. A security vulnerability exists in Oracle Solaris version 11 that stems from a flaw in a file system component that could lead to a system takeover...

Ubuntu 24.04 LTS : Linux kernel (Azure) vulnerabilities (USN-7384-1)

"The remote Ubuntu 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7384-1 advisory. Michael Randrianantenaina discovered that the Bluetooth driver in the Linux Kernel contained an improper access control vulnerability. A nearby attacker...

Bykea: Lack of Feedback Validation Permits Arbitrary Driver Ratings

The vulnerability discovered by @bugbountywithmarco in Bykea's feedback system allowed authenticated passengers to submit feedback for drivers they had not actually ridden with. The exploit was limited to trips the attacker legitimately owned, and each trip could only affect one driver rating at ...

DEBIAN-CVE-2024-9632

A flaw was found in the X.org server. Due to improperly tracked allocation size in XkbSetCompatMap, a local attacker may be able to trigger a buffer overflow condition via a specially crafted payload, leading to denial of service or local privilege escalation in distributions where the X.org serv...

PT-2024-16131

Name of the Vulnerable Software and Affected Versions Wildfly affected versions not specified Description A flaw in the Wildfly deployment system allows a user to perform Cross-site scripting, enabling an attacker or insider to execute a deployment with a malicious payload. This could trigger...

cups-filters: libcupsfilters: `cfGetPrinterAttributes` API does not perform sanitization on returned IPP attributes

A flaw was found in OpenPrinting CUPS. In certain conditions, a remote attacker can add a malicious printer or directly hijack an existing printer by replacing the valid IPP URL with a malicious one. Also, it is possible that due to a lack of validation of IPP attributes returned by the server,...

cups-filters: libcupsfilters: `cfGetPrinterAttributes` API does not perform sanitization on returned IPP attributes

A flaw was found in OpenPrinting CUPS. In certain conditions, a remote attacker can add a malicious printer or directly hijack an existing printer by replacing the valid IPP URL with a malicious one. Also, it is possible that due to a lack of validation of IPP attributes returned by the server,...

CVE-2024-5132

CVE-2024-5132 entry is rejected/not used and does not represent an active vulnerability entry.

The vulnerability of the QTS, QuTS hero, and QuTScloud operating systems for QNAP network devices stems from the lack of measures taken to neutralize special elements used in the operating system’s command set. This allows attackers to execute arbitrary commands.

The vulnerability of the QTS, QuTS hero, and QuTScloud operating systems for QNAP network devices is related to the lack of measures taken to neutralize special elements used in the operating system’s command set. Exploiting this vulnerability allows a remote attacker to execute arbitrary command...

The vulnerability of the AppleGraphicsControl component in the macOS operating system allows a hacker to execute arbitrary code.

The vulnerability of the AppleGraphicsControl component in the macOS operating system is related to writing beyond the buffer boundaries. Exploiting this vulnerability could allow an attacker to execute arbitrary code using a specially created file...

The vulnerability of the DIAEnergie industrial energy consumption management system, related to the use of pre-set accounting data, allows a perpetrator to execute arbitrary codes.

The vulnerability of the DIAEnergie energy consumption management system involves the use of pre-set accounting data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by uploading executable files into specific directories...

The vulnerability of the system check function in Cisco IOS XE for Cisco Catalyst 9200 Series network devices allows a hacker to execute arbitrary code.

The vulnerability of the Cisco IOS XE software’s network device authentication function on the Cisco Catalyst 9200 series devices is related to improper verification of the cryptographic signature. Exploiting this vulnerability allows an attacker to execute arbitrary code...

SUSE CVE-2013-6891

lppasswd in CUPS before 1.7.1, when running with setuid privileges, allows local users to read portions of arbitrary files via a modified HOME environment variable and a symlink attack involving .cups/client.conf...

The vulnerability of the file system of Juniper Networks Junos OS router series cSRX allows a attacker to enhance their privileges.

The vulnerability of the file system of Juniper Networks Junos OS router series cSRX lies in the way passwords are stored in a recoverable format. Exploiting this vulnerability can allow attackers to increase their privileges...

The vulnerability of the `ntfs_names_full_collate` function in the NTFS file system, which allows a malicious actor to execute arbitrary code with elevated privileges on the FUSE NTFS-3G module.

The vulnerability of the ntfsnamesfullcollate function in the NTFS file system is related to buffer overflows in dynamic memory. Exploiting this vulnerability allows an attacker to execute arbitrary code with elevated privileges using a specially created NTFS image file...

The vulnerability of the OTRS ticket request system, related to the disclosure of information, allows a violator to gain access to confidential data.

The vulnerability of the OTRS ticket request system is related to the disclosure of information. Exploiting this vulnerability allows a malicious actor, who operates remotely, to gain access to confidential data...

CVE-2021-44087

A Remote Code Execution RCE vulnerability exists in Sourcecodester Attendance and Payroll System v1.0 which allows an unauthenticated remote attacker to upload a maliciously crafted PHP via photo upload...

The vulnerability of the centralized system for managing emergency messages and events in CAMS, compared to distributed systems like CENTUM, allows a intruder to cause system failures, including the suppression of emergency signals.

The vulnerability of the centralized system for managing emergency messages and events in CAMS distributed systems like CENTUM is related to the use of pre-set account data. Exploiting this vulnerability could allow a malicious actor to cause server failures, including the suppression of emergenc...

kernel: xfs: raw block device data leak in XFS_IOC_ALLOCSP IOCTL

A data leak flaw was found in the way XFSIOCALLOCSP IOCTL in the XFS filesystem allowed for size increase of files with unaligned size. A local attacker could use this flaw to leak data on the XFS filesystem otherwise not accessible to them...

Google Android 安全漏洞

Google Android is a Linux-based open source operating system from Google. A security vulnerability exists in Google Android 9, 10, 11, and 12, which can be exploited by an attacker to cause a local privilege escalation...