claudiasmh.com Cross Site Scripting vulnerability OBB-3919487

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2022-40745 IBM Aspera Faspex information disclosure

IBM Aspera Faspex 5.0.0 through 5.0.7 could allow a local user to obtain sensitive information due to weaker than expected security. IBM X-Force ID: 236452...

The vulnerability of the software’s user interface for running large language models (LLMs) like GPT NVIDIA ChatRTX for Windows allows a hacker to execute arbitrary code, cause service failures, or disclose sensitive information.

The vulnerability of the user interface of the software for running large language models LLM GPT NVIDIA ChatRTX for Windows exists due to the lack of measures taken to protect the web page structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code, cause service...

The vulnerability of the NTPSyncWithHost function in TOTOLINK EX200 router microprogramming software allows a hacker to execute arbitrary code.

The vulnerability of the NTPSyncWithHost function in TOTOLINK EX200 router microprogramming software is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using the hostTime parameter...

WordPress SP Project & Document Manage plugin <= 4.71 - Auth. SQL Injection vulnerability

Auth. SQL Injection vulnerability discovered by CatFather Patchstack Alliance in WordPress Plugin SP Project & Document Manager versions = 4.71...

PT-2024-4886 · Oracle · Oracle Complex Maintenance

Name of the Vulnerable Software and Affected Versions: Oracle Complex Maintenance, Repair, and Overhaul versions 12.2.3 through 12.2.13 Description: The issue exists due to insufficient input validation in the LOV component of the Oracle Complex Maintenance, Repair, and Overhaul product, part of...

PT-2024-3488 · Brocade · Brocade Sannav

Name of the Vulnerable Software and Affected Versions: Brocade SANnav versions affected versions not specified Description: The issue is related to inadequate access control in the software, which could allow a remote attacker to impact the confidentiality, integrity, and availability of protecte...

The vulnerability of the Microsoft Defender for IoT’s threat detection mechanism lies in the lack of measures to neutralize special elements used in the operating system’s command set, allowing attackers to execute arbitrary code.

The vulnerability of the Microsoft Defender for IoT threat detection mechanism is related to the lack of measures taken to neutralize special elements used in the operating system’s command set. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Keras 2 Lambda Layers Allow Arbitrary Code Injection in TensorFlow Models

Overview Lambda Layers in third party TensorFlow-based Keras models allow attackers to inject arbitrary code into versions built prior to Keras 2.13 that may then unsafely run with the same permissions as the running application. For example, an attacker could use this feature to trojanize a...

HCL Technologies HCL Launch 安全漏洞

HCL Technologies HCL Launch is a versatile, enterprise-grade continuous delivery automation software from HCL Technologies, Inc. for handling the most complex deployment processes in DevOps. A security vulnerability exists in HCL Technologies HCL DevOps Deploy and HCL Launch that stems from...

PT-2024-3358 · Netcat · Netcat

Name of the Vulnerable Software and Affected Versions: Netcat affected versions not specified Description: The issue is related to weaknesses in the authentication mechanism of the Netcat CMS system. Exploitation of this issue may allow a remote attacker to gain access to protected information...

VulnCheck KEV: CVE-2024-2667

The InstaWP Connect -- 1-click WP Staging & Migration plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file validation in the /wp-json/instawp-connect/v1/config REST API endpoint in all versions up to, and including, 0.1.0.22. This makes it possible for...

The vulnerability of Zoom’s video conferencing software, related to deficiencies in authentication procedures, allows attackers to disclose protected information.

The vulnerability of Zoom, a video conferencing software, is related to deficiencies in authentication procedures. Exploiting this vulnerability allows a malicious actor to disclose protected information...

CVE-2023-47542

A improper neutralization of special elements used in a template engine CWE-1336 in FortiManager versions 7.4.1 and below, versions 7.2.4 and below, and 7.0.10 and below allows attacker to execute unauthorized code or commands via specially crafted templates...

PT-2024-3115 · Microsoft · Ole Db Driver For Sql Server +1

Name of the Vulnerable Software and Affected Versions: Microsoft OLE DB Driver for SQL Server affected versions not specified Description: The issue exists due to insufficient input validation in the Microsoft OLE DB Driver for SQL Server. This allows a remote attacker to execute arbitrary code...

PT-2024-2831 · Microsoft · Defender For Iot

Name of the Vulnerable Software and Affected Versions: Microsoft Defender for IoT affected versions not specified Description: The issue is related to insufficient access control in Microsoft Defender for IoT, which could allow a remote attacker to elevate their privileges. Recommendations: At th...

The vulnerability of the SSH library wolfSSH, related to deficiencies in authentication procedures, allows attackers to circumvent existing security restrictions.

The vulnerability of the SSH library wolfSSH is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to circumvent existing security restrictions remotely...

The vulnerability of the Continuous Integration and Deployment Application Delivery system (CI/CD) of JetBrains TeamCity, related to deficiencies in the authentication mechanism, allows a hacker to register arbitrary users in the system.

The vulnerability of the Continuous Integration and Deployment Application Delivery system CI/CD of JetBrains TeamCity is related to deficiencies in the authentication mechanism. Exploiting this vulnerability could allow a malicious actor, operating remotely, to register arbitrary users in the...

CVE-2023-50313 IBM WebSphere Application Server information disclosure

IBM WebSphere Application Server 8.5 and 9.0 could provide weaker than expected security for outbound TLS connections caused by a failure to honor user configuration. IBM X-Force ID: 274812...

The vulnerability of software for remote management and monitoring of the Intel Local Manageability Service arises from insufficient protection of registration data, allowing attackers to gain unauthorized access to protected information.

The vulnerability of the software for remote management and monitoring of the Intel Local Manageability Service is related to insufficient protection of registration data. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...