3596 matches found
PT-2024-10103
Name of the Vulnerable Software and Affected Versions rsync affected versions not specified Description The issue is related to an uncontrolled resource consumption in the rsync repository validator FORT. It can be exploited by a remote attacker to elevate their privileges. A malicious RPKI rsync...
Mattermost File Upload Vulnerability
Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from a file upload vulnerability that stems from the application's lack of effective validation of uploaded files. An attacker can exploit this vulnerability to upload malicious file...
ROS-20240826-26
A vulnerability in the Hotspot component of Oracle GraalVM Enterprise Edition virtual machines, Oracle GraalVM for JDK and Oracle Java SE software platform is associated with insufficient protection of service data. Exploitation of the vulnerability could allow an attacker acting remotely to gain...
SUSE CVE-2024-7974
Insufficient data validation in V8 API in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially exploit heap corruption via a crafted Chrome Extension. Chromium security severity: Medium...
CVE-2024-7795
Autel MaxiCharger AC Elite Business C50 AppAuthenExchangeRandomNum Stack-Based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Elite Business C50 EV chargers...
CVE-2024-6811 IrfanView WSQ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability
IrfanView WSQ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView. User interaction is required to exploit this vulnerability in that the target must visit a malicious pag...
SUSE: Security Advisory (SUSE-SU-2024:2980-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2024-43267
Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Qamar Sheeraz, Nasir Ahmad, GenialSouls Mega Addons For Elementor allows Stored XSS.This issue affects Mega Addons For Elementor: from n/a through 1.9...
PT-2024-6810 · Google +2 · Google Chrome +2
Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 129.0.6668.58 Microsoft Edge affected versions not specified Description: The issue is related to insufficient data validation in the Omnibox feature of Google Chrome and Microsoft Edge browsers. This could all...
CVE-2023-31366
Improper input validation in AMD μProf could allow an attacker to perform a write to an invalid address, potentially resulting in denial of service...
Adobe Acrobat Reader DC AcroForm Annotation Out-Of-Bounds Write Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adobe Acrobat Reader DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handli...
Siemens Omnivise T3000 Application Server Input Validation Improperity Vulnerability
The Omnivise T3000 is a distributed control system for fossil fuel and large renewable energy power plants. An improper input validation vulnerability exists in the Siemens Omnivise T3000 Application Server due to an affected system exposing an internal application port on a public network...
PT-2024-6131 · Sap · Sap Bex Web Java Runtime Export Web Service
Name of the Vulnerable Software and Affected Versions: SAP BEx Web Java Runtime Export Web Service affected versions not specified Description: The issue is related to insufficient validation of an XML document accepted from an untrusted source in the SAP BEx Web Java Runtime Export Web Service...
Calibre SQL Injection Vulnerability
Calibre is an open source free all-in-one eBook reading management and format conversion tool. Calibre version 7.15.0 and prior versions suffer from a SQL injection vulnerability that stems from the application's lack of validation of externally entered SQL statements. An attacker can exploit thi...
CVE-2024-7492 MainWP Child Reports <= 2.2 - Cross-Site Request Forgery to Arbitrary Options Update
The MainWP Child Reports plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2. This is due to missing or incorrect nonce validation on the networkoptionsaction function. This makes it possible for unauthenticated attackers to update arbitrary...
PT-2024-6296 · Mongodb +1 · Mongodb C Driver +4
Name of the Vulnerable Software and Affected Versions: MongoDB Server versions prior to 5.0.27 MongoDB Server versions prior to 6.0.16 MongoDB Server versions prior to 7.0.12 MongoDB Server versions prior to 7.3.3 MongoDB C Driver versions prior to 1.26.2 MongoDB PHP Driver versions prior to 1.18...
CVE-2024-7546
oFono SimToolKit Heap-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability allows local attackers to execute arbitrary code on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this...
PT-2024-8347 · Ivanti · Ivanti Itsm +1
Name of the Vulnerable Software and Affected Versions: Ivanti ITSM on-prem and Neurons for ITSM versions 2023.4 and earlier Description: The issue is related to improper certificate validation, which can be exploited by a remote attacker in a MITM position to create a token that would allow acces...
Apache OFBiz resolveURI Authentication Bypass Vulnerability
This vulnerability allows remote attackers to bypass authentication on affected installations of Apache OFBiz. Authentication is not required to exploit this vulnerability. The specific flaw exists within the implementation of the resolveURI method. The issue results from improper URI validation...
