SUSE CVE-2024-36017

In the Linux kernel, the following vulnerability has been resolved: rtnetlink: Correct nested IFLAVFVLANLIST attribute validation Each attribute inside a nested IFLAVFVLANLIST is assumed to be a struct iflavfvlaninfo so the size of such attribute needs to be at least of sizeofstruct iflavfvlaninf...

Atlassian Confluence 2.6.0 < 7.19.22 / 7.20.x < 8.5.9 / 8.6.x < 8.9.1 DoS (CONFSERVER-95834)

The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-95834 advisory. - Denial of Service due to improper input validation vulnerability for HTTP/2 requests in Apache Tomcat. When processing an HTTP/2 request, if the...

go-spacemesh 代码问题漏洞

go-spacemesh is a node-wide implementation of the Go Spacemesh protocol open-sourced by Spacemesh. A code issue vulnerability exists in go-spacemesh versions prior to 1.37.1, which stems from failing to check a previous ATX as the latest valid ATX when validating incoming ATX...

CVE-2023-40485 Maxon Cinema 4D SKP File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability

Maxon Cinema 4D SKP File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Maxon Cinema 4D. User interaction is required to exploit this vulnerability in that the target must...

WordPress Plugin Ninja Forms Contact Form 输入验证错误漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An input validation error...

SAP NetWeaver Code Issue Vulnerability (CNVD-2024-20440)

SAP NetWeaver is the German SAP SAP company's set of service-oriented integrated application platform. The platform mainly for SAP applications to provide development and runtime environment. A code issue vulnerability exists in SAP NetWeaver that stems from insufficient input validation, which c...

CVE-2024-3101

In mintplex-labs/anything-llm, an improper input validation vulnerability allows attackers to escalate privileges by deactivating 'Multi-User Mode'. By sending a specially crafted curl request with the 'multiusermode' parameter set to false, an attacker can deactivate 'Multi-User Mode'. This acti...

CVE-2024-3101 Privilege Escalation via Improper Input Validation in mintplex-labs/anything-llm

In mintplex-labs/anything-llm, an improper input validation vulnerability allows attackers to escalate privileges by deactivating 'Multi-User Mode'. By sending a specially crafted curl request with the 'multiusermode' parameter set to false, an attacker can deactivate 'Multi-User Mode'. This acti...

CVE-2022-47894 Apache Zeppelin SAP: connecting to a malicious SAP server allowed it to perform XXE

Improper Input Validation vulnerability in Apache Zeppelin SAP.This issue affects Apache Zeppelin SAP: from 0.8.0 before 0.11.0. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance t...

CVE-2023-52343

In SecurityCommand message after as security has been actived., there is a possible improper input validation. This could lead to remote information disclosure no additional execution privileges needed...

Mageia: Security Advisory (MGASA-2024-0081)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

The vulnerability of the box_add() function in the virtuoso-opensource web application development platform allows a hacker to trigger a service failure.

The vulnerability of the boxadd function in the virtuoso-opensource web application development platform exists due to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to cause service failures after executing the SELECT operator...

HTML Injection

phpmyfaq is vulnerable to HTML injection. The vulnerability is due to insufficient validation on the contentLink parameter, this allowing an attacker to inject HTML code that can affect other users...

The vulnerability of the FILTER_VALIDATE_EMAIL function in the phpMyFAQ web application, which allows a hacker to execute arbitrary code.

The vulnerability of the FILTERVALIDATEEMAIL function in the phpMyFAQ web application is related to the lack of security measures for the structure of the web page. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

CVE-2024-20838

Improper validation vulnerability in Samsung Internet prior to version 24.0.3.2 allows local attackers to execute arbitrary code...

CVE-2024-20838

Improper validation vulnerability in Samsung Internet prior to version 24.0.3.2 allows local attackers to execute arbitrary code...

Huawei HarmonyOS Wearables Security Vulnerability

Huawei HarmonyOS Wearables is an electronic watch from Huawei, a Chinese company. A security vulnerability exists in Huawei HarmonyOS Wearables, which stems from an input validation type of vulnerability in the telephony module...

CVE-2024-0864 RCE in Laragon

Enabling Simple Ajax Uploader plugin included in Laragon open-source software allows for a remote code execution RCE attack via an improper input validation in a fileupload.php file which serves as an example. By default, Laragon is not vulnerable until a user decides to use the aforementioned...

CVE-2024-23320 Apache DolphinScheduler: Arbitrary js execution as root for authenticated users

Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server. This issue is a legacy of CVE-2023-49299. We didn't fix it completely in CVE-2023-49299, and we added one more patch to fix it. This...

CVE-2024-1648

electron-pdf version 20.0.0 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate the HTML content entered by the user...