TNB Mobile Solutions Cockpit 安全漏洞

TNB Mobile Solutions Cockpit is a mobile solution management platform from TNB Mobile Solutions. A security vulnerability exists in TNB Mobile Solutions Cockpit versions prior to v2.13 that stems from the presence of a hard-coded credentials issue...

CLSA-2024-1726163202 expat: Fix of 3 CVEs

The release version was raised because it corresponds to version 13 - CVE-2024-45490: reject negative len for XMLParseBuffer to prevent improper restriction of XML External Entity Reference - CVE-2024-45491: prevent integer overflow in dtdCopy - CVE-2024-45492: prevent integer overflow in...

CVE-2024-44720

SeaCMS v13.1 was discovered to an arbitrary file read vulnerability via the component adminsafe.php...

Joplin 跨站脚本漏洞

Joplin is an open source note-taking and to-do list application from the individual developer Laurent Cozic. A cross-site scripting vulnerability exists in Joplin version 3.0.13 that stems from processing HTML content without properly escaping or handling symbols, which allows cross-site scriptin...

PT-2024-31221 · Seacms · Seacms

Name of the Vulnerable Software and Affected Versions: SeaCMS version 13.1 Description: A Server-Side Request Forgery SSRF issue was discovered in SeaCMS. This issue occurs via the url parameter at the "/admin reslib.php" API endpoint. Recommendations: For SeaCMS version 13.1, as a temporary...

puppet-pulpcore: An authentication bypass vulnerability exists in pulpcore

An authentication bypass vulnerability has been identified in Pulpcore when deployed with Gunicorn versions prior to 22.0, due to the puppet-pulpcore configuration. This issue arises from Apache's modproxy not properly unsetting headers because of restrictions on underscores in HTTP headers,...

puppet-foreman: An authentication bypass vulnerability exists in Foreman

An authentication bypass vulnerability has been identified in Foreman when deployed with External Authentication, due to the puppet-foreman configuration. This issue arises from Apache's modproxy not properly unsetting headers because of restrictions on underscores in HTTP headers, allowing...

CVE-2024-34637

Improper access control in WindowManagerService prior to SMR Sep-2024 Release 1 in Android 12, and SMR Jun-2024 Release 1 in Android 13 and Android 14 allows local attackers to bypass restrictions on starting services from the background...

CVE-2024-38811

VMware Fusion 13.x before 13.6 contains a code-execution vulnerability due to the usage of an insecure environment variable. A malicious actor with standard user privileges may exploit this vulnerability to execute code in the context of the Fusion application...

CVE-2024-44683

Seacms v13 is vulnerable to Cross Site Scripting XSS via admin-video.php...

PT-2024-31303 · Seacms · Seacms

Name of the Vulnerable Software and Affected Versions: Seacms version 13.1 Description: The issue allows attackers to control IP parameters written to the data/admin/ip.php file when the action is set, potentially resulting in arbitrary command execution. This occurs due to a vulnerability in the...

SeaCMS 安全漏洞

SeaCMS is a free, open source web content management system written in PHP by SeaCMS. The system has been designed primarily to manage video-on-demand resources. A cross-site scripting vulnerability exists in SeaCMS version v13, which originates from a cross-site scripting vulnerability contained...

WordPress GiveWP plugin <= 3.13.0 - Missing Authorization to Unauthenticated Event Settings Update vulnerability

Missing Authorization to Unauthenticated Event Settings Update vulnerability discovered by villu164 in WordPress Plugin GiveWP versions = 3.13.0...

PT-2024-30052 · Seacms · Seacms

Name of the Vulnerable Software and Affected Versions: SeaCMS version 13.0 Description: The issue is related to a remote code execution vulnerability. Although the admin editplayer.php file imposes restrictions on edited files, attackers can bypass these restrictions and write code. This allows...

undertow: response write hangs in case of Java 17 TLSv1.3 NewSessionTicket

A vulnerability was found in Undertow, where the chunked response hangs after the body was flushed. The response headers and body were sent but the client would continue waiting as Undertow does not send the expected 0\r\n termination of the chunked response. This results in uncontrolled resource...

SUSE CVE-2023-33976

TensorFlow is an end-to-end open source platform for machine learning. arrayops.upperbound causes a segfault when not given a rank 2 tensor. The fix will be included in TensorFlow 2.13 and will also cherrypick this commit on TensorFlow 2.12...

GHSA-GJH7-XX4R-X345 TensorFlow has segfault in array_ops.upper_bound

Impact arrayops.upperbound causes a segfault when not given a rank 2 tensor. Patches We have patched the issue in GitHub commit 915884fdf5df34aaedd00fc6ace33a2cfdefa586. The fix will be included in TensorFlow 2.13. We will also cherrypick this commit in TensorFlow 2.12.1. For more information...

AZL-47242 CVE-2023-33976 affecting package tensorflow for versions less than 2.11.1-2

TensorFlow is an end-to-end open source platform for machine learning. arrayops.upperbound causes a segfault when not given a rank 2 tensor. The fix will be included in TensorFlow 2.13 and will also cherrypick this commit on TensorFlow 2.12...

TensorFlow 输入验证错误漏洞

TensorFlow is a suite of end-to-end open source platforms for machine learning open-sourced by TensorFlow. An input validation error vulnerability exists in TensorFlow versions prior to 2.13.0, which stems from arrayops.upperbound causing a segmentation error when a 2nd order tensor is not...

CVE-2024-40829

The issue was addressed with improved checks. This issue is fixed in watchOS 10.6, iOS 17.6 and iPadOS 17.6, iOS 16.7.9 and iPadOS 16.7.9, macOS Ventura 13.6.8. An attacker may be able to view restricted content from the lock screen...