CVE-2024-54115

Out-of-bounds read vulnerability in the DASH module Impact: Successful exploitation of this vulnerability will affect availability...

CVE-2024-54116

Out-of-bounds read vulnerability in the M3U8 module Impact: Successful exploitation of this vulnerability may cause features to perform abnormally...

CVE-2024-54116

Out-of-bounds read vulnerability in the M3U8 module Impact: Successful exploitation of this vulnerability may cause features to perform abnormally...

CVE-2024-54100

Vulnerability of improper access control in the secure input module Impact: Successful exploitation of this vulnerability may cause features to perform abnormally...

RHEL 8 : ruby:2.5 (RHSA-2024:11001)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:11001 advisory. Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management task...

GHSA-C7XH-GJV4-4JGV kcp's impersonation allows access to global administrative groups

Impact Impersonation is a feature of the Kubernetes API, allowing to override user information. As downstream project, kcp inherits this feature. As per the linked documentation a specific level of privilege usually assigned to cluster admins is required for impersonation. The vulnerability in kc...

About the security content of iOS18.2 and iPadOS18.2

About the security content of iOS18.2 and iPadOS18.2 This document describes the security content of iOS 18.2 and iPadOS 18.2. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or...

CVE-2024-8259 Unauthenticated SQLi in Eryaz IT's NatraCar B2B Dealer Management Program

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Eryaz Information Technologies NatraCar B2B Dealer Management Program allows SQL Injection. This issue affects NatraCar B2B Dealer Management Program: through 09.12.2024. NOTE: The vendor was...

Oracle Linux 9 : osbuild-composer (ELSA-2024-9456)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-9456 advisory. 118-2.0.1 - Simplify repository names JIRA: OLDIS-35893 118-2 - Ensure build on latest golang: CVE-2024-34156 Tenable has extracted the preceding description...

AZL-53745 CVE-2024-50142 affecting package kernel for versions less than 5.15.173.1-1

In the Linux kernel, the following vulnerability has been resolved: xfrm: validate new SA's prefixlen using SA family when sel.family is unset This expands the validation introduced in commit 07bf7908950a "xfrm: Validate address prefix lengths in the xfrm selector." syzbot created an SA with...

Lack of proper access control on endpoint to delete evaluators

Description The /v1/evaluators/ route allows users to delete evaluators of a project by sending a DELETE request. However, the route lacks proper access control, such as middleware to ensure that only users with appropriate roles can delete evaluator data. The current implementation: Does not...

Mozilla Firefox和Mozilla Thunderbird 安全漏洞

Mozilla Firefox and Mozilla Thunderbird are both products of the Mozilla Foundation in the U.S. Mozilla Firefox is an open-source Web browser.Mozilla Thunderbird is a separate set of Mozilla Application Suite Email client software. The software supports IMAP, POP mail protocols, and HTML mail...

EulerOS 2.0 SP11 : vim (EulerOS-SA-2024-2570)

According to the versions of the vim packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Vim is an open source command line text editor. double-free in dialogchanged in Vim v9.1.0648. When abandoning a buffer, Vim may ask the user what to...

kernel: NFSD: Fix ia_size underflow

A vulnerability was found in the Linux kernel's NFSD, where an underflow in the iasize field can occur due to incorrect handling of file size types. When an NFS client sends a file size greater than the maximum value the system can handle, it can lead to an underflow in the iasize variable, causi...

CVE-2024-42038

Vulnerability of PIN enhancement failures in the screen lock module Impact: Successful exploitation of this vulnerability may affect service confidentiality, integrity, and availability...

The vulnerability of the mknotifyd software, a monitoring tool for IT infrastructure, allows a perpetrator to execute arbitrary commands.

The vulnerability of the mknotifyd software for monitoring IT infrastructure systems in Checkmk is related to improper elimination of separators. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

Candy Redis 2.1.2 Admin Page Disclosure

==================================================================================================================================== | Title : Candy Redis V2.1.2 HTML Form in redirect page Vulnerability | | Author : indoushka | | Tested on : windows 10 FrPro / browser : Mozilla firefox 125.0.1 64...

Paradox IP150 Internet Module 1.40.00 Cross Site Request Forgery

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 Paradox IP150 Internet Module Cross-Site Request Forgery Link: https://github.com/sbaresearch/advisories/tree/public/2024/SBA-ADV-20240321-01ParadoxCrossSiteRequestForgery Vulnerability Overview The Paradox IP150 Internet Module in version 1.40.00 i...

Exploit for Code Injection in Rejetto Http_File_Server

Unauthenticated RCE Flaw in Rejetto HTTP File Server CVE-2024...

DEBIAN-CVE-2024-4067

The NPM package micromatch prior to 4.0.8 is vulnerable to Regular Expression Denial of Service ReDoS. The vulnerability occurs in micromatch.braces in index.js because the pattern . will greedily match anything. By passing a malicious payload, the pattern matching will keep backtracking to the...