CVE-2024-45920

A Stored Cross-Site Scripting XSS vulnerability in Solvait 24.4.2 allows remote attackers to inject malicious scripts into the application. This issue arises due to insufficient input validation and sanitization in "Intrest" feature...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a security weakness in Certifi python-certifi [CVE-2024-39689]

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a security weakness in Certifi python-certifi, caused by the use of GLOBALTRUST root certificate CVE-2024-39689. Certifi python-certifi is used by our Speech Service runtimes. This vulnerabilitiy has been...

CVE-2024-46863: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: soc-acpi-intel-lnl-match: add missing empty item There is no linksnum in struct sndsocacpimach , and we test !link-numadr as a condition to end the loop in hdasdwmachineselect. So an empty item in struct...

PT-2024-6815 · Unknown · Zangi Private Messenger

Name of the Vulnerable Software and Affected Versions: Zangi Private Messenger affected versions not specified Description: The issue is related to weaknesses in the session key generation mechanism of the application. This could allow a remote attacker to implement a "man-in-the-middle" attack...

CVE-2024-45723 goTenna Pro ATAK Plugin Use of Cryptographically Weak Pseudo-Random Number Generator

The goTenna Pro ATAK Plugin does not use SecureRandom when generating passwords for sharing cryptographic keys. The random function in use makes it easier for attackers to brute force this password if the broadcasted encryption key is captured over RF. This only applies to the optional broadcast ...

Ceph Storage Authentication Bypass

The vulnerability of the Ceph storage system is related to deficiencies in authentication procedures. Exploiting this vulnerability allows a malicious actor, operating remotely, to gain access to confidential data and compromise its integrity...

GHSA-58VJ-CV5W-V4V6 Navidrome has Multiple SQL Injections and ORM Leak

Security Advisory: Multiple Vulnerabilities in Navidrome Summary Navidrome automatically adds parameters in the URL to SQL queries. This can be exploited to access information by adding parameters like password=... in the URL ORM Leak. Furthermore, the names of the parameters are not properly...

protobuf-java has potential Denial of Service issue

Summary When parsing unknown fields in the Protobuf Java Lite and Full library, a maliciously crafted message can cause a StackOverflow error and lead to a program crash. Reporter: Alexis Challande, Trail of Bits Ecosystem Security Team Affected versions: This issue affects all versions of both t...

CGA-Q4FH-WG3W-H9G4

Bulletin has no description...

CVE-2023-41611

Victure PC420 1.1.39 was discovered to use a weak and partially hardcoded key to encrypt data...

Citrix Workspace App Resource Control Privilege Escalation

The vulnerability of the Citrix Workspace App for Windows relates to insufficient resource control during its existence. Exploiting this vulnerability can allow attackers to enhance their privileges...

Forklift Controller Component Protected Information Disclosure

The vulnerability of the Forklift Controller component in the Red Hat Migration Toolkit for Virtualization stems from deficiencies in the authentication process. Exploiting this vulnerability can allow an attacker, operating remotely, to compromise protected information...

CVE-2023-41612

The Victure PC420 smart camera, specifically version 1.1.39 , is vulnerable due to the use of a weak encryption key for the enabled_telnet.dat file located on the Micro SD card. This flaw falls under CWE-798 (Use of Hard-coded Credentials), potentially allowing unauthorized access or configuratio...

CVE-2024-46751: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: btrfs: don't BUGON when 0 reference count at btrfslookupextentinfo Instead of doing a BUGON handle the error by returning -EUCLEAN, aborting the transaction and logging an error message...

OneNote Mac OS Bypass

The vulnerability of the Microsoft OneNote note-taking software for the Mac OS is related to improper verification of the cryptographic signature. Exploiting this vulnerability could allow an attacker to circumvent existing security restrictions by introducing malicious libraries...

ClamD Service Compromise DoS

The vulnerability of the ClamD service in the ClamAV antivirus software package is related to insufficient checking of unusual or exceptional states. Exploiting this vulnerability can allow an attacker to compromise system files or cause service failures...

CVE-2024-44153: Undefined Security Weakness

The issue was addressed with improved permissions logic. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7. An app may be able to access user-sensitive data...

CVE-2024-22013: Undefined Security Weakness

U-Boot environment is read from unauthenticated partition...

CVE-2024-46712: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Disable coherent dumb buffers without 3d Coherent surfaces make only sense if the host renders to them using accelerated apis. Without 3d the entire content of dumb buffers stays in the guest making all of the extra...

TDuckPro authorization issue vulnerability

TDuckCloud TDuckPro is an out-of-the-box data collection tool from TDuckCloud that supports data collection, questionnaires, appointment enrollment, workflow approvals, form collections, public inquiries, OCR image recognition, and other high-level features. An authorization issue vulnerability...