Microsoft Defender for IoT Remote Code Execution Vulnerability

...

PT-2024-23715 · Bento4 · Bento4

Name of the Vulnerable Software and Affected Versions: Bento4 Bento version 1.6.0-641 Description: The issue allows a remote attacker to execute arbitrary code via the AP4 BitReader::ReadCache function at Ap4Utils.cpp component. This is a Buffer Overflow vulnerability. Recommendations: For Bento4...

PT-2024-23718 · Bento4 · Bento4

Name of the Vulnerable Software and Affected Versions: Bento4 Bento version 1.6.0-641 Description: An issue in Bento4 Bento allows a remote attacker to execute arbitrary code via the Ap4MdhdAtom.cpp, AP4 MdhdAtom::AP4 MdhdAtom, mp4fragment. Recommendations: For Bento4 Bento version 1.6.0-641,...

CVE-2024-23119 Centreon insertGraphTemplate SQL Injection Remote Code Execution Vulnerability

Centreon insertGraphTemplate SQL Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Centreon. Authentication is required to exploit this vulnerability. The specific flaw exists within the...

Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of...

CVE-2024-2942 Campcodes Online Examination System deleteQuestionExe.php sql injection

A vulnerability, which was classified as critical, was found in Campcodes Online Examination System 1.0. This affects an unknown part of the file /adminpanel/admin/query/deleteQuestionExe.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack...

PT-2024-2423 · Apache · Apache Doris

Name of the Vulnerable Software and Affected Versions: Apache Doris versions 1.2.0 through 2.0.4 Description: The issue is related to the download of code without integrity check in Apache Doris, which may result in remote command execution. An attacker authorized to create a JDBC catalog can use...

MGASA-2024-0077 Updated libtiff packages fix security vulnerabilities

LibTIFF is vulnerable to an integer overflow. This flaw allows remote attackers to cause a denial of service application crash or possibly execute an arbitrary code via a crafted tiff image, which triggers a heap-based buffer overflow. CVE-2023-40745 A vulnerability was found in libtiff due to...

EUVD-2024-1162

OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration. Similarly to the GHSL-2023-250 issue, AlertUtil::validateExpression is also called from EventSubscriptionRepository.prepare,...

PT-2024-22561 · Raspap · Raspap

Name of the Vulnerable Software and Affected Versions: RaspAP aka raspap-webgui versions 3.0.9 and earlier Description: The issue allows remote attackers to read the /etc/passwd file via a crafted request. Recommendations: For RaspAP aka raspap-webgui versions 3.0.9 and earlier, update to a versi...

CVE-2024-28753

RaspAP aka raspap-webgui through 3.0.9 allows remote attackers to read the /etc/passwd file via a crafted request...

SUSE-SU-2024:0793-1 Security update for gstreamer-plugins-bad

This update for gstreamer-plugins-bad fixes the following issues: - CVE-2023-44446: Fixed use-after-free remote code execution vulnerability via MXF file bsc1217213...

PT-2024-12435 · Sourcecodester · Lost/Found Information System

Name of the Vulnerable Software and Affected Versions: Sourcecodester Lost and Found Information System version 1.0 Description: The issue concerns an unauthenticated SQL Injection vulnerability at the "/items/view&id=" endpoint, which can be escalated to remote command execution. Recommendations...

PT-2024-20802 · Pdfmake · Pdfmake

Name of the Vulnerable Software and Affected Versions: pdfmake version 0.2.9 Description: An issue in pdfmake allows remote attackers to run arbitrary code via a crafted POST request to the /pdf endpoint. Note that the behavior of the /pdf endpoint is intentional and only available after installi...

SUSE SLES15: dpdk / dpdk-devel / dpdk-kmp-default / dpdk-thunderx / etc (SUSE-SU-2024:0576-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:0576-1 advisory. - Fixed a regression caused by incomplete fix for CVE-2022-2132 bsc1219187. Tenable has extracted the preceding description block directly...

CVE-2023-42498

Reflected cross-site scripting XSS vulnerability in the Language Override edit screen in Liferay Portal 7.4.3.8 through 7.4.3.97, and Liferay DXP 2023.Q3 before patch 5, and 7.4 update 4 through 92 allows remote attackers to inject arbitrary web script or HTML via the...

CVE-2024-1344 Encrypted database credentials in LaborOfficeFree

Encrypted database credentials in LaborOfficeFree affecting version 19.10. This vulnerability allows an attacker to read and extract the username and password from the database of 'LOFservice.exe' and 'LaborOfficeFree.exe' located in the '%programfilesx86%\LaborOfficeFree' directory. This user ca...

CVE-2024-24216

Zentao v18.0 to v18.10 was discovered to contain a remote code execution RCE vulnerability via the checkConnection method of /app/zentao/module/repo/model.php...

CVE-2015-10129 planet-freo auth.inc.php comparison

A vulnerability was found in planet-freo up to 20150116 and classified as problematic. Affected by this issue is some unknown functionality of the file admin/inc/auth.inc.php. The manipulation of the argument auth leads to incorrect comparison. The attack may be launched remotely. The complexity ...

Updated zlib packages fix a security vulnerability

Updated zlib packages fix a security vulnerability: Directory traversal vulnerability in the doextractcurrentfile function in miniunz.c in miniunzip in minizip before 1.1-5 might allow remote attackers to write to arbitrary files via a crafted entry in a ZIP archive...