7-Zip Qcow Handler Infinite Loop DoS Vulnerability - Windows

7zip is prone to a qcow handler infinite loop denial of service DoS vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Lobe Chat 代码问题漏洞

Lobe Chat is an open source, high-performance chatbot framework open-sourced by LobeHub. A code issue vulnerability exists in Lobe Chat versions prior to 1.19.13, which stems from vulnerability to server-side request forgery attacks that could allow an attacker to launch an attack without logging...

PYSEC-2024-187

virtualenv before 20.26.6 allows command injection through the activation scripts for a virtual environment. Magic template strings are not quoted correctly when replacing. NOTE: this is not the same as CVE-2024-9287...

JetBrains WebStorm < 2024.3 Code Execution

The version of JetBrains WebStorm installed on the remote host is prior to 2024.3 . It is, therefore, affected by a code execution vulnerability as referenced in the vendor advisory. Code Execution can occur in Untrusted Project mode via specifically constructed type definitions in the installer...

RSA Security NetWitness Platform 安全漏洞

RSA Security NetWitness Platform is a comprehensive platform from RSA Security USA that accelerates threat detection and response. It collects and analyzes data from all capture points logs, packets, netflow, endpoints, and IoT and compute platforms physical, virtual, and cloud, enriching data wi...

FreeScout 安全漏洞

FreeScout is an ultra-lightweight and powerful free open source helpdesk and shared inbox built using PHP Laravel framework by FreeScout, Inc. A security vulnerability exists in versions of FreeScout prior to 1.0.65. An attacker can exploit the vulnerability to authenticate as an arbitrary user...

PT-2024-35152 · Unknown · Stirling-Pdf

Name of the Vulnerable Software and Affected Versions: Stirling-PDF versions prior to 0.32.0 Description: The issue in Stirling-PDF allows any unauthenticated user to execute JavaScript code in the context of the user due to the Merge functionality taking untrusted user input file name and using ...

WordPress plugin WP EIS SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection...

Ollama < 0.1.46 Multiple Vulnerabilities

The version of Ollama installed on the remote host is prior to 0.1.46. It is, therefore, affected by multiple vulnerabilities: - An issue was discovered in Ollama before 0.1.46. An attacker can use two HTTP requests to upload a malformed GGUF file containing just 4 bytes starting with the GGUF...

Cursor 输入验证错误漏洞

Cursor is an AI code editor from the Cursor open source. An input validation error vulnerability exists in versions prior to Cursor 20240927, which stems from the fact that if a user generates terminal commands via Cursor's Terminal Cmd-K/Ctrl-K functionality, an attacker could potentially...

AZL-51159 CVE-2024-50041 affecting package kernel for versions less than 5.15.173.1-1

In the Linux kernel, the following vulnerability has been resolved: i40e: Fix macvlan leak by synchronizing access to macfilterhash This patch addresses a macvlan leak issue in the i40e driver caused by concurrent access to vsi-macfilterhash. The leak occurs when multiple threads attempt to modif...

WordPress Jetpack plugin < 13.9.1 - Authenticated Arbitrary Feedback Access vulnerability

Authenticated Arbitrary Feedback Access vulnerability discovered by Marc Montpas in WordPress Plugin Jetpack versions 13.9.1...

Nagios XI 安全漏洞

Nagios XI is a suite of IT infrastructure monitoring solutions from the US-based Nagios. The solution supports monitoring and alerting of applications, services, operating systems, and more. A security vulnerability exists in Nagios XI versions prior to 5.11.3 2024R1, which stems from an inabilit...

PT-2024-32584 · Yith · Yith Woocommerce Product Add-Ons

Name of the Vulnerable Software and Affected Versions: YITH WooCommerce Product Add-Ons versions prior to 4.13.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Reflected XSS. Recommendations...

CVE-2024-47847

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows Cross-Site Scripting XSS.This issue affects Mediawiki - Cargo: from 3.6.X before 3.6.1...

PT-2025-2777

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.6.74 Description: A possible null pointer dereference issue has been identified in the Linux kernel. This issue occurs when the request lock function is called and lkb-lkb resource is not assigned yet, which...

PT-2024-32381 · Unknown · Computer Vision Annotation Tool

Name of the Vulnerable Software and Affected Versions: Computer Vision Annotation Tool CVAT versions prior to 2.19.0 Description: The Computer Vision Annotation Tool CVAT is an interactive video and image annotation tool for computer vision. A malicious CVAT user with permissions to create or edi...

Eliz Panel SQL注入漏洞

Eliz Panel is a control panel from Eliz Corporation. A SQL injection vulnerability exists in Eliz Panel versions prior to 2.3.24, which arises from an improper neutralization of a particular element used, allowing commands to be executed via SQL injection...

Contao 路径遍历漏洞

Contao is Contao open source a set of open source content management system CMS developed using PHP. The system supports search engines, rights management and CSS frameworks. A path traversal vulnerability exists in versions prior to Contao 4.13.49, which stems from a back-end authenticated user...

Man D-Tale 跨站脚本漏洞

Man D-Tale is a pandas data structure visualization tool from Man. A cross-site scripting vulnerability exists in Man D-Tale versions prior to 3.14.1 that stems from vulnerability to remote code execution attacks and allows an attacker to run malicious code on the server...