DEBIAN-CVE-2023-52631

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Fix an NULL dereference bug The issue here is when this is called from ntfsloadattrlist. The "size" comes from le32tocpuattr-res.datasize so it can't overflow on a 64bit systems but on 32bit systems the "+ 1023" can...

Hikvision DS-7604NI-K1 安全漏洞

Hikvision DS-7604NI-K1 is a network video recorder from Hikvision China. A security vulnerability exists in Hikvision DS-7604NI-K1 V4.30.096 build221220 and earlier versions, which stems from insufficient validation of parameters in messages, and can be exploited by an attacker to send a speciall...

DJI Mavic和Matrice 安全漏洞

DJI Mavic and DJI Matrice are both products of the Chinese company DJI.DJI Mavic is a series of drones.DJI Matrice is a series of commercial drone platforms. A security vulnerability exists in the DJI Mavic 3, Matrice 300, and Matrice M30 that stems from the use of weak credentials that could all...

AZL-37134 CVE-2024-28085 affecting package util-linux for versions less than 2.39.2-2

wall in util-linux through 2.40, often installed with setgid tty permissions, allows escape sequences to be sent to other users' terminals through argv. Specifically, escape sequences received from stdin are blocked, but escape sequences received from argv are not blocked. There may be plausible...

AZL-42523 CVE-2024-2955 affecting package wireshark 4.0.8-1

T.38 dissector crash in Wireshark 4.2.0 to 4.0.3 and 4.0.0 to 4.0.13 allows denial of service via packet injection or crafted capture file...

UBUNTU-CVE-2024-2955

T.38 dissector crash in Wireshark 4.2.0 to 4.0.3 and 4.0.0 to 4.0.13 allows denial of service via packet injection or crafted capture file...

CVE-2024-2599

File upload restriction evasion vulnerability in AMSS++ version 4.31. This vulnerability could allow an authenticated user to potentially obtain RCE through webshell, compromising the entire infrastructure...

CVE-2024-2596

Vulnerability in AMSS++ version 4.31, which does not sufficiently encode user-controlled input, resulting in a Cross-Site Scripting XSS vulnerability through /amssplus/modules/mail/main/selectsend.php, in multiple parameters. This vulnerability could allow a remote attacker to send a specially...

CVE-2024-2589

Vulnerability in AMSS++ version 4.31 that allows SQL injection through /amssplus/modules/book/main/bookdetailschoolperson.php, in multiple parameters. This vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in th...

CVE-2024-2592

Vulnerability in AMSS++ version 4.31 that allows SQL injection through /amssplus/modules/person/picshow.php, in the 'personid' parameter. This vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the DB...

CVE-2024-2590

Vulnerability in AMSS++ version 4.31 that allows SQL injection through /amssplus/modules/mail/main/selectsend.php, in the 'sdindex' parameter. This vulnerability could allow a remote attacker to send a specially crafted SQL query to the server and retrieve all the information stored in the DB...

AMSS++ SQL Injection Vulnerability

AMSS++ is a tool for the office management support system of Amssplus. An SQL injection vulnerability exists in AMSS++ version 4.31, which stems from an SQL injection vulnerability in the sdindex parameter of the /amssplus/modules/book/main/selectsend2.php page...

AMSS++ Cross-Site Scripting Vulnerability

AMSS++ is a tool for the office administration support system of Amssplus. A cross-site scripting vulnerability exists in AMSS++ version 4.31, which stems from a cross-site scripting vulnerability in multiple parameters on the /amssplus/admin/index.php page...

PT-2024-21245 · Amss++ · Amss++

Name of the Vulnerable Software and Affected Versions: AMSS++ version 4.31 Description: The issue is related to insufficient encoding of user-controlled input, resulting in a Cross-Site Scripting XSS vulnerability. This vulnerability can be exploited through the...

PT-2024-21181 · Amss++ · Amss++

Name of the Vulnerable Software and Affected Versions: AMSS++ version 4.31 Description: The issue allows SQL injection through the /amssplus/admin/index.php endpoint, in the id parameter. This could enable a remote attacker to send a specially crafted SQL query to the server and retrieve all the...

CVE-2023-4839

The WP Go Maps for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 9.0.32 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to...

PT-2024-18094 · Themeisle · Orbit Fox

Name of the Vulnerable Software and Affected Versions: The Orbit Fox by ThemeIsle plugin for WordPress versions up to, and including, 2.10.30 Description: The issue is related to Stored Cross-Site Scripting via the Pricing Table widget in the $settings'title tags' parameter due to insufficient...

The vulnerability of the DVFS (Dynamic Voltage and Frequency Scaling) function in the Tegra 30 embedded system operating system drivers allows a hacker to cause a service failure.

The vulnerability of the DVFS Dynamic Voltage and Frequency Scaling function in the Tegra 30 embedded system’s Linux kernel drivers is related to improper cleaning or release of resources. Exploiting this vulnerability can allow an attacker to cause service failures...

SUSE CVE-2024-26621

In the Linux kernel, the following vulnerability has been resolved: mm: hugememory: don't force huge page alignment on 32 bit commit efa7df3e3bb5 "mm: align larger anonymous mappings on THP boundaries" caused two issues 1 2 reported on 32 bit system or compat userspace. It doesn't make too much...

mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2023)

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are 8.0.34 and prior. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful...