CVE-2024-53144: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcievent: Align BR/EDR JUSTWORKS paring with LE This aligned BR/EDR JUSTWORKS method with LE which since 92516cd97fd4 "Bluetooth: Always request for user confirmation for Just Works" always request user confirmation wi...

Chunghwa Telecom tbm-client security vulnerability

Chunghwa Telecom tbm-client is an application from Chunghwa Telecom China. A security vulnerability exists in Chunghwa Telecom tbm-client versions 0.3.15 through 0.3.20, which stems from the presence of arbitrary file deletion and lack of CSRF protection, as well as an absolute path traversal...

export_log Application Interface Compromise

The vulnerability of the “exportlog” application interface in the microprogramming devices of the multifunctional wireless access points Advantech EKI-6333AC-2G, EKI-6333AC-2GD, and EKI-6333AC-1GPO exists due to the failure to take measures to neutralize the special elements used in the operating...

REFLASH_DDU_FindFile Code Execution

The vulnerability of the REFLASHDDUFindFile function in the Visteon Infotainment automotive application platform exists due to the lack of measures to neutralize specific elements. Exploiting this vulnerability allows a hacker to execute arbitrary code in the basic operating system...

CVE-2023-38483

Missing Authorization vulnerability in dylanblokhuis Instant CSS instant-css allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Instant CSS: from n/a through = 1.1.4...

PT-2024-36553 · Weasis · Weasis

Name of the Vulnerable Software and Affected Versions: Weasis version 4.5.1 Description: The issue concerns a hardcoded key for symmetric encryption of proxy credentials in the ui/pref/ProxyPrefView.java file within the weasis-core component of Weasis. This hardcoded key is used for the symmetric...

SUSE CVE-2024-45719

Inadequate Encryption Strength vulnerability in Apache Answer. This issue affects Apache Answer: through 1.4.0. The ids generated using the UUID v1 version are to some extent not secure enough. It can cause the generated token to be predictable. Users are recommended to upgrade to version 1.4.1,...

CVE-2024-54474: Undefined Security Weakness

The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15.2, macOS Sonoma 14.7.2, macOS Ventura 13.7.2. An app may be able to access user-sensitive data...

Active Directory Certificate Services Privilege Escalation

The vulnerability of Active Directory Certificate Services on Windows operating systems is related to deficiencies in the authentication process. Exploiting this vulnerability can allow attackers to gain increased privileges...

Drupal Kernel Privilege Escalation

The vulnerability of the Drupal CMS system’s kernel is related to deficiencies in authentication procedures. Exploiting this vulnerability can allow attackers to enhance their privileges remotely...

sigstore has insufficient validation of integration timestamp during verification

Summary Versions of sigstore-python newer than 2.0.0 but prior to 3.6.0 perform insufficient validation of the "integration time" present in "v2" and "v3" bundles during the verification flow: the "integration time" is verified if a source of signed time such as an inclusion promise is present, b...

php: XML loading external entity without being enabled

A flaw was found in PHP due to inadequate validation of user-supplied XML input. By leveraging specially crafted XML code, a remote attacker could obtain sensitive information by viewing the contents of arbitrary files on the system or initiating requests to external systems. This issue may allow...

Method Exposure

orchid/platform is vulnerable to Method Exposure. The vulnerability is due to inadequate access control in the asynchronous modal functionality of the Orchid Platform, allows arbitrary methods within the Screen class to be called without proper validation, enabling attackers to exploit the expose...

Siemens SICAM A8000 CP-8031 and CP-8050 Firmware Decryption Vulnerability

The SICAM A8000 RTU Remote Terminal Unit is a modular device for remote control and automation applications in all areas of energy supply. A firmware decryption vulnerability exists in the Siemens SICAM A8000 CP-8031 and CP-8050 due to the fact that the affected devices contain a secure element...

DOMPurify XSS

The vulnerability of the JavaScript library for secure cleaning and protection of HTML code, DOMPurify, is related to deficiencies in the validation of input data containing XSS attack indicators. Exploiting this vulnerability can allow a remote attacker to execute cross-site scripting attacks...

MSA Safety FieldServer security vulnerabilities

MSA Safety FieldServer is a building automation solution from MSA Safety USA. A security vulnerability exists in MSA Safety FieldServer versions prior to 7.0.0 that stems from the FieldServer gateway's authentication on all devices being implemented with an insecure shared key that is static acro...

CVE-2024-47547

Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x contains a weak mechanism for its users to change their passwords which leaves authentication vulnerable to brute force attacks...

CVE-2024-11149: Undefined Security Weakness

In OpenBSD 7.4 before errata 014, vmm4 did not restore GDTR limits properly on Intel VMX CPUs...

SonicWALL SMA100 security vulnerability

The SonicWALL SMA100 is a secure access gateway appliance from SonicWALL USA. The SonicWALL SMA100 suffers from a cryptographic issue vulnerability that stems from the use of a weakly encrypted pseudo-random number generator in the backup code generator. An attacker could exploit the vulnerabilit...

XRDP Authentication Bypass

The vulnerability of the XRDP remote access authentication mechanism is related to deficiencies in the retry limit for authentication attempts, which is controlled by the MaxLoginRetry parameter set in the configuration file /etc/xrdp/sesman.ini. Exploiting this vulnerability allows a malicious...