MGASA-2024-0172 Updated libxml2 packages fix a security vulnerability

An issue was discovered in libxml2 before 2.11.7 and 2.12.x before 2.12.5. When using the XML Reader interface with DTD validation and XInclude expansion enabled, processing crafted XML documents can lead to an xmlValidatePopElement use-after-free. CVE-2024-25062...

CVE-2024-2913 Race Condition Vulnerability in mintplex-labs/anything-llm

A race condition vulnerability exists in the mintplex-labs/anything-llm repository, specifically within the user invite acceptance process. Attackers can exploit this vulnerability by sending multiple concurrent requests to accept a single user invite, allowing the creation of multiple user...

PT-2024-22751 · Unknown · Anything-Llm

Name of the Vulnerable Software and Affected Versions: anything-llm affected versions not specified Description: A race condition vulnerability exists in the user invite acceptance process, allowing attackers to create multiple user accounts from a single invite link by sending multiple concurren...

CVE-2023-37328

GStreamer PGS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may va...

CVE-2023-51552 Foxit PDF Reader AcroForm Signature Use-After-Free Remote Code Execution Vulnerability

Foxit PDF Reader AcroForm Signature Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a...

CVE-2023-50235

CVE-2023-50235 affects Hancom Office Show. The vulnerability lies in PPT file parsing where a lack of proper validation of the length of user-supplied data before copying to a stack-based buffer can enable remote code execution in the context of the current process. The issue requires user intera...

CVE-2023-42092

CVE-2023-42092 affects Foxit PDF Reader (and Foxit PhantomPDF lineage). It is a Use-After-Free in Doc object handling that allows remote code execution by manipulating undocumented object existence checks, enabling code execution in the process context. User interaction is required (visiting a ma...

CVE-2023-42040 PDF-XChange Editor mailForm Use-After-Free Code Execution Vulnerability

PDF-XChange Editor mailForm Use-After-Free Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page ...

CVE-2023-39474 Inductive Automation Ignition downloadLaunchClientJar Remote Code Execution Vulnerability

Inductive Automation Ignition downloadLaunchClientJar Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. User interaction is required to exploit this vulnerability in that the target...

CVE-2023-38109 Foxit PDF Reader Doc Object Out-Of-Bounds Read Information Disclosure Vulnerability

Foxit PDF Reader Doc Object Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit...

CVE-2023-38080

Kofax Power PDF is affected by a PDF file parsing heap-based buffer overflow that leads to remote code execution. The flaw arises from insufficient validation of the length of user-supplied data before copying it into a fixed-size heap buffer, enabling code execution in the current process after ...

CVE-2023-35753

CVE-2023-35753 concerns D-Link DAP-2622. The DDP Set AG profile UUID component has a stack-based buffer overflow due to improper validation of user-supplied data length, enabling remote code execution with root privileges on routers. The vulnerability is exploitable by network-adjacent attackers ...

CVE-2023-32144

CVE-2023-32144 affects D-Link DAP-1360 devices (webproc /cgi-bin/webproc). The flaw is a stack-based buffer overflow in handling user-supplied data length, enabling remote code execution with root privileges when exploited by network-adjacent attackers. Public disclosures (ZDI-23-536, NVD entry) ...

Sante DICOM Viewer Pro 安全漏洞

Santesoft Sante DICOM Viewer Pro is a powerful viewer, anonymizer, converter and PACS client from Santesoft Cyprus. Works with DICOM files of all models and manufacturers. A security vulnerability exists in Sante DICOM Viewer Pro, which stems from a lack of proper validation of user-supplied data...

CVE-2024-23462

An Improper Validation of Integrity Check Value vulnerability in Zscaler Client Connector on MacOS allows a denial of service of the Client Connector binary and thus removing client functionality.This issue affects Client Connector on MacOS: before 3.4...

PT-2024-22941 · WordPress · Svs Pricing Tables

Name of the Vulnerable Software and Affected Versions: SVS Pricing Tables plugin for WordPress versions up to, and including, 1.0.4 Description: The issue is due to missing or incorrect nonce validation on the deletePricingTable function, making it possible for unauthenticated attackers to delete...

PT-2024-24191 · Infotel Conseil · Glpi

Name of the Vulnerable Software and Affected Versions: Infotel Conseil GLPI versions 10.X.X and after Description: The issue allows a remote attacker to execute arbitrary code via the insufficient validation of user-supplied input. Recommendations: For Infotel Conseil GLPI versions 10.X.X and...

Tenda 4G300 sub_4260F0 function buffer overflow vulnerability

Tenda 4G300 is a wireless router from Tenda China. A buffer overflow vulnerability exists in the Tenda 4G300 version 1.01.42, which originates from the parameter upfilen of the sub4260F0 function failing to correctly validate the length of the input data, and can be exploited by a remote attacker...

PT-2024-6394 · Artifex +6 · Artifex Ghostscript +6

Name of the Vulnerable Software and Affected Versions: Artifex Ghostscript versions prior to 10.03.1 Description: The issue is related to the incorrect input validation in the psi/zmisc1.c file of the Artifex Ghostscript software. This can allow a remote attacker to execute arbitrary code. The...

The vulnerability of the Offer LOV component of the Oracle Trade Management software, a business automation system within the Oracle E-Business Suite, allows an attacker to gain unauthorized access to protected information.

The vulnerability of the “Offer LOV” component of the Oracle Trade Management software for managing trading operations within the Oracle E-Business Suite is related to insufficient validation of input data. Exploiting this vulnerability could allow an attacker operating remotely to gain...