The permission model protects itself against path traversal attacks by calling path.resolve() on any paths given by the user. If the path is to be treated as a Buffer the implementation uses Buffer.from() to obtain a Buffer from the result of path.resolve(). By monkey-patching Buffer internals namely Buffer.prototype.utf8Write the application can modify the result of path.resolve() which leads to a path traversal vulnerability. This vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21. Please note that at the time this CVE was issued the permission model is an experimental feature of Node.js.

...

USN-6813-1 openjdk-21 vulnerabilities

It was discovered that the Hotspot component of OpenJDK 21 incorrectly handled certain exceptions with specially crafted long messages. An attacker could possibly use this issue to cause a denial of service. CVE-2024-21011 It was discovered that OpenJDK 21 incorrectly performed reverse DNS query...

CVE-2024-29973

UNSUPPORTED WHEN ASSIGNED The command injection vulnerability in the “setCookie” parameter in Zyxel NAS326 firmware versions before V5.21AAZF.17C0 and NAS542 firmware versions before V5.21ABAG.14C0 could allow an unauthenticated attacker to execute some operating system OS commands by sending a...

WordPress Essential Addons for Elementor plugin <= 5.9.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via Twitter Feed vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Twitter Feed vulnerability discovered by stealthcopter in WordPress Plugin Essential Addons for Elementor versions = 5.9.21...

PT-2024-5106 · Adobe · Dreamweaver

Name of the Vulnerable Software and Affected Versions: Adobe Dreamweaver versions 21.3 and earlier Description: The issue exists due to the improper neutralization of special elements used in an OS command, which could lead to arbitrary code execution by an attacker. Exploitation of this issue...

VulnCheck KEV: CVE-2023-4473

A command injection vulnerability in the web server of the Zyxel NAS326 firmware version V5.21AAZF.14C0 and NAS542 firmware version V5.21ABAG.11C0 could allow an unauthenticated attacker to execute some operating system OS commands by sending a crafted URL to a vulnerable device...

VulnCheck KEV: CVE-2024-32778

Missing Authorization vulnerability in Contest Gallery.This issue affects Contest Gallery: from n/a through 21.3.4...

WBSAirback Cross-Site Request Forgery Vulnerability

WBSAirback is a next generation storage and backup system from WBSAirback. A cross-site request forgery vulnerability exists in WBSAirback version 21.02.04, which can be exploited by an attacker to forge a malicious request to trick a victim into clicking on it to perform a sensitive operation...

CVE-2024-30384

An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine PFE of Juniper Networks Junos OS on EX4300 Series allows a locally authenticated attacker with low privileges to cause a Denial-of-Service Dos. If a specific CLI command is issued, a PFE crash wi...

Node.js 安全漏洞

Node.js is an open source, cross-platform JavaScript runtime environment. A security vulnerability exists in Node.js versions 18.x, 20.x, and 21.x. The vulnerability stems from the fact that an attacker can make the server completely unavailable by sending a small number of HTTP/2 framed packets...

WordPress Kanban Boards for WordPress plugin <= 2.5.21 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Yudistira Arya Patchstack Alliance in WordPress Plugin Kanban Boards for WordPress versions = 2.5.21...

CVE-2021-33138

creationtimestamp| type| source ---|---|--- 2024-02-23 22:27:13+00:00| seen| https://t.me/ctinow/192231...

Node.js Security Vulnerabilities

Node.js is an open source, cross-platform JavaScript runtime environment. A security vulnerability exists in Node.js versions 20 and 21 that stems from the presence of a path traversal vulnerability...

PT-2024-4035 · Node.Js +5 · Node.Js +5

Name of the Vulnerable Software and Affected Versions: Node.js versions 20 through 21 Description: The issue is related to the Node.js Permission Model, which has misleading documentation regarding the use of wildcards in file paths. Specifically, the documentation does not clarify that wildcards...

Microsoft Windows OLE Security Vulnerability

Microsoft Windows is a suite of operating systems for use on personal devices from the U.S.-based Microsoft Corporation Microsoft. A security vulnerability exists in Microsoft Windows OLE. The following products and editions are affected:Windows 10 Version 1809 for 32-bit Systems,Windows 10 Versi...

Microsoft Windows Kernel Security Vulnerability

Microsoft Windows Kernel is the kernel of the Windows operating system by Microsoft Corporation USA. A security vulnerability exists in the Microsoft Windows Kernel. The following products and versions are affected: Windows 11 version 21H2 for ARM64-based Systems,Windows 10 Version 21H2 for 32-bi...

PT-2024-19363 · Ibm · Ibm Semeru Runtime

Name of the Vulnerable Software and Affected Versions: IBM Semeru Runtime versions 8.0.302.0 through 8.0.392.0 IBM Semeru Runtime versions 11.0.12.0 through 11.0.21.0 IBM Semeru Runtime versions 17.0.1.0 through 17.0.9.0 IBM Semeru Runtime version 21.0.1.0 Description: The issue is related to the...

CVE-2024-23940

creationtimestamp| type| source ---|---|--- 2024-01-29 20:26:12+00:00| seen| https://t.me/ctinow/175516 2024-02-06 23:16:53+00:00| seen| https://t.me/ctinow/180385 2024-02-21 17:36:45+00:00| seen| https://t.me/ctinow/189831...

X.org Server Security Vulnerability

X.org Server is an open source free software from the X.org Foundation. A security vulnerability exists in versions of X.org Server prior to 21.1.11 that stems from incorrectly handling memory and could be exploited by an attacker to cause a denial of service, obtain sensitive information, or...

Oracle Database Server Security Vulnerability

Oracle Database Server is a set of relational database management system of the United States Oracle Oracle. The database management system provides data management, distributed processing and other functions. A security vulnerability exists in Oracle Database Server versions 19.3 through 19.21 a...