2851 matches found
PT-2024-28007 · Nato · Nato Nci Anet
Name of the Vulnerable Software and Affected Versions: NATO NCI ANET version 3.4.1 Description: The issue allows for Insecure Direct Object Reference via a modified ID field in a request for a private draft report that belongs to an arbitrary user. Recommendations: For NATO NCI ANET version 3.4.1...
DEBIAN-CVE-2022-48828
In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix iasize underflow iattr::iasize is a lofft, which is a signed 64-bit type. NFSv3 and NFSv4 both define file size as an unsigned 64-bit type. Thus there is a range of valid file size values an NFS client can send that is...
ThinkSAAS 安全漏洞
ThinkSAAS is ThinkSAAS open source a code completely open source , flexible and open building system program . ThinkSAAS version 3.7.0 SQL injection vulnerability exists , the vulnerability stems from the name parameter in the systemactionupdate.php lack of validation of external input SQL...
CVE-2024-40456
ThinkSAAS v3.7.0 was discovered to contain a SQL injection vulnerability via the name parameter at \system\action\update.php...
POODLE SSLV3.0 Security Issue Workaround for License Server
Citrix Licensing 11.12.1 for Windows might be vulnerable to the Padding Oracle On Downgraded Legacy Encryption POODLE vulnerability. POODLE affects older standards of encryption - Secure Socket Layer SSL version 3 but not the newer encryption method Transport Layer Security TLS. Citrix suggests t...
WordPress Tagbox plugin <= 3.3 - Cross Site Request Forgery (CSRF) vulnerability
Cross Site Request Forgery CSRF vulnerability discovered by Majed Refaea Patchstack Alliance in WordPress Plugin Taggbox versions = 3.3...
Use After Free
Overview Microsoft.AspNetCore.App.Runtime.linux-musl-x64 is a package providing a default set of APIs for building an ASP.NET Core application. Contains assets used for self-contained deployments. Affected versions of this package are vulnerable to Use After Free through the handling of HTTP/3...
Advanced Backups Security Vulnerability
Advanced Backups is a powerful backup mod for My World game by the individual developer Heather White. A security vulnerability exists in Advanced Backups v3.5.3 and earlier versions, which stems from a vulnerability that allows an attacker to write to arbitrary files by restoring a carefully...
PT-2024-5097 · Siemens · Sinema Remote Connect Server
Name of the Vulnerable Software and Affected Versions: SINEMA Remote Connect Server versions prior to V3.2 SP1 Description: A vulnerability has been identified in the SINEMA Remote Connect Server, related to errors in security mechanisms. This issue allows an unauthenticated attacker to access an...
UBUNTU-CVE-2024-5971
A vulnerability was found in Undertow, where the chunked response hangs after the body was flushed. The response headers and body were sent but the client would continue waiting as Undertow does not send the expected 0\r\n termination of the chunked response. This results in uncontrolled resource...
AZL-43204 CVE-2024-3651 affecting package python-idna for versions less than 3.7-1
A vulnerability was identified in the kjd/idna library, specifically within the idna.encode function, affecting version 3.6. The issue arises from the function's handling of crafted input strings, which can lead to quadratic complexity and consequently, a denial of service condition. This...
CVE-2024-27717
Cross Site Request Forgery vulnerability in Eskooly Free Online School Management Software v.3.0 and before allows a remote attacker to escalate privileges via the Token Handling component...
eSkooly Security Vulnerabilities
eSkooly is a free online school management software from eSkooly Inc. A security vulnerability exists in eSkooly version 3.0, which originates from the execution of arbitrary code via the searchby parameter of the allstudents.php component and the id parameter of the requestmanager.php component...
CVE-2024-5979 Denial of Service via Invalid Argument in h2oai/h2o-3
In h2oai/h2o-3 version 3.46.0, the runtool command in the rapids component allows the main function of any class under the water.tools namespace to be called. One such class, MojoConvertTool, crashes the server when invoked with an invalid argument, causing a denial of service...
PT-2024-20070 · Hms · Hms Anybus X-Gateway Ab7832-F
Name of the Vulnerable Software and Affected Versions: HMS Anybus X-Gateway AB7832-F version 3 Description: An issue was discovered that allows unauthenticated changes to a device's network configurations through the HICP protocol. Recommendations: For HMS Anybus X-Gateway AB7832-F version 3,...
Malicious code in cuevana-3-ver-john-wick-4-pelicula-completa-en-espanol-y-latino (npm)
--- -= Per source details. Do not edit below this line.=-...
WordPress UberMenu plugin <= 3.8.3 - Cross-Site Request Forgery to Settings Reset vulnerability
Cross-Site Request Forgery to Settings Reset vulnerability discovered by M.Awad in WordPress Plugin Uber Menu versions = 3.8.3...
Medium: iperf3
Issue Overview: It is possible for a malicious or malfunctioning client to send less than the expected amount of data to the server. If this happens, the server will hang indefinitely waiting for the remainder or until the connection gets closed. Because iperf3 is deliberately designed to service...