CGA-Q4FH-WG3W-H9G4

Bulletin has no description...

CVE-2023-41611

Victure PC420 1.1.39 was discovered to use a weak and partially hardcoded key to encrypt data...

CVE-2023-41612

Victure PC420 firmware 1.1.39 was found to use a weak encryption key for the file enabled_telnet.dat on the Micro SD card. The affected component is the device’s software/firmware handling that file; the weakness is tied to the encryption key rather than a code path detail in the provided documen...

The vulnerability of the Citrix Workspace App for Windows lies in its insufficient resource control during its existence. This allows attackers to increase their privileges.

The vulnerability of the Citrix Workspace App for Windows relates to insufficient resource control during its existence. Exploiting this vulnerability can allow attackers to enhance their privileges...

The vulnerability of the Forklift Controller component of the Red Hat Migration Toolkit for Virtualization allows a attacker to exploit the protected information.

The vulnerability of the Forklift Controller component in the Red Hat Migration Toolkit for Virtualization stems from deficiencies in the authentication process. Exploiting this vulnerability can allow an attacker, operating remotely, to compromise protected information...

The vulnerability of the Microsoft OneNote software for the Mac OS allows a hacker to circumvent existing security restrictions.

The vulnerability of the Microsoft OneNote note-taking software for the Mac OS is related to improper verification of the cryptographic signature. Exploiting this vulnerability could allow an attacker to circumvent existing security restrictions by introducing malicious libraries...

The vulnerability of the ClamD service in the ClamAV antivirus software package allows a hacker to compromise system files or cause service failures.

The vulnerability of the ClamD service in the ClamAV antivirus software package is related to insufficient checking of unusual or exceptional states. Exploiting this vulnerability can allow an attacker to compromise system files or cause service failures...

TDuckPro 授权问题漏洞

TDuckCloud TDuckPro is an out-of-the-box data collection tool from TDuckCloud that supports data collection, questionnaires, appointment enrollment, workflow approvals, form collections, public inquiries, OCR image recognition, and other high-level features. An authorization issue vulnerability...

The vulnerability of the Kibana data visualization service, related to deficiencies in the deserialization mechanism, allows attackers to execute arbitrary code.

The vulnerability of the Kibana data visualization service is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows an attacker to execute arbitrary code using a specially created YAML document...

Lenovo XClarity Controller (XCC) Vulnerabilities - Lenovo Support US

No description provided...

Expired OTP Usage

Keycloak is vulnerable to Expired OTP Usage. The vulnerability is due to OTP codes generated by FreeOTP remaining valid for an additional 30 seconds beyond their expiration time, increasing the attack window and surface by allowing two OTPs to be valid simultaneously...

PT-2024-6257 · Microsoft · Windows +2

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified DHCP Server Service affected versions not specified Remote Desktop Licensing Service affected versions not specified Description: The issue is related to a denial-of-service vulnerability that can be...

Ivanti EPM 安全漏洞

Ivanti EPM is a one-stop shop for managing user profiles and all client devices from Ivanti USA. A security vulnerability exists in Ivanti EPM that stems from a weak authentication issue contained in the patch management. An authenticated remote attacker could exploit the vulnerability to gain...

The vulnerability of the Git-based software platform for collaborative code development on GitLab stems from deficiencies in the authentication process, which allows unauthorized users to gain unauthorized access to protected information.

The vulnerability of the Git-based software platform for collaborative code development on GitLab is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

CVE-2024-42343

Loway - CWE-204: Observable Response Discrepancy...

IBM Maximo Application Suite 加密问题漏洞

IBM Maximo Application Suite is a single platform for intelligent asset management, monitoring, maintenance, computer vision, security and reliability from International Business Machines IBM. An encryption issue vulnerability exists in IBM Maximo Application Suite versions 8.10, 8.11, and 9.0,...

CVE-2024-45394 Secret encryption vulnerable to brute-force attacks

Authenticator is a browser extension that generates two-step verification codes. In versions 7.0.0 and below, encryption keys for user data were stored encrypted at-rest using only AES-256 and the EVPBytesToKey KDF. Therefore, attackers with a copy of a user's data are able to brute-force the...

The vulnerability of the two-factor authentication (2FA) mechanism of the Docker-based deployment and email server management tool, mailcow:dockerized, allows attackers to bypass 2FA protection and gain unauthorized access.

The vulnerability of the two-factor authentication 2FA mechanism in the Docker-based mailcow:dockerized deployment and management system is related to the lack of security measures for the website structure. Exploiting this vulnerability allows an attacker to bypass 2FA protection and gain...

The vulnerability of Zoom’s video conferencing software lies in the insufficient protection of registration data, allowing attackers to disclose sensitive information.

The vulnerability of Zoom’s video conferencing software relates to insufficient protection of registration data. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information that is protected by the system...

CVE-2024-8158 User impersonation for lib9p based 9p fileservers

A bug in the 9p authentication implementation within lib9p allows an attacker with an existing valid user within the configured auth server to impersonate any other valid filesystem user. This is due to lib9p not properly verifying that the uname given in the Tauth and Tattach 9p messages matches...