CVE-2024-43831: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: Handle invalid decoder vsi Handle an invalid decoder vsi in vpudecinit to ensure the decoder vsi is valid for future use...

CVE-2022-33162

IBM Security Directory Integrator 7.2.0 and Security Verify Directory Integrator 10.0.0 does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources, at the privilege level of a standard unprivileged user. IBM X-Force I...

Oracle iStore User Management Unauthorized Access

The vulnerability of the User Management component of the Oracle iStore system, which is used for creating, managing, and personalizing online stores, and of the Oracle E-Business Suite system, which is used for automating business operations, is related to insufficient validation of input data...

edk2: Use of a Weak PseudoRandom Number Generator

A security flaw has been identified in the cryptographic system of EDK2, the open-source reference implementation of the UEFI specification. This vulnerability enables an unauthorized remote attacker to potentially expose sensitive information...

CVE-2024-39591 Missing Authorization check in SAP Document Builder

SAP Document Builder does not perform necessary authorization checks for one of the function modules resulting in escalation of privileges causing low impact on confidentiality of the application...

CVE-2024-5800

CVE-2024-5800 affects B&R Automation Runtime: Diffie-Hellman groups with insufficient strength are used in the SSL/TLS stack in versions before 6.0.2, enabling a network attacker to decrypt traffic. The vulnerability is tied to weak DH parameters in the TLS implementation, with impact limited to ...

PowerShell Privilege Escalation

The vulnerability of the PowerShell command line interface on Windows operating systems is related to insufficient validation of entered data. Exploiting this vulnerability can allow an attacker to gain increased privileges...

JetBrains TeamCity Authentication Data Compromise

The vulnerability of the Continuous Integration and Deployment Application Delivery system CI/CD of JetBrains TeamCity is related to deficiencies in the authentication process due to time differences when comparing tokens. Exploiting this vulnerability could allow a malicious actor to compromise...

restapi.service Privilege Escalation Command Injection

The vulnerability of the restapi.service file /lib/systemd/system/restapi.service in the software for creating wireless routers based on Debian RaspAP is related to the lack of measures taken to neutralize special elements used in commands, due to insufficient access control for users belonging t...

USN-6948-1 salt vulnerabilities

It was discovered that Salt incorrectly handled crafted web requests. A remote attacker could possibly use this issue to run arbitrary commands. CVE-2020-16846 It was discovered that Salt incorrectly created certificates with weak file permissions. CVE-2020-17490 It was discovered that Salt...

CVE-2024-42257: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ext4: use memtostrpad for svolumename As with the other strings in struct ext4superblock, svolumename is not NUL terminated. The other strings were marked in commit 072ebb3bffe6 "ext4: add nonstring annotations to ext4.h". Using...

Project-level Deploy Token Handler adminPushRules Deployment Token Creation

The vulnerability of the adminPushRules function in the Project-level Deploy Token Handler component of the software platform based on Git for collaborative code development on GitLab is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to crea...

CVE-2024-40719 CHANGING Information Technology TCBServiSign Windows Version - Inadequate Encryption Strength

The encryption strength of the authorization keys in CHANGING Information Technology TCBServiSign Windows Version is insufficient. When a remote attacker tricks a victim into visiting a malicious website, TCBServiSign will treat that website as a legitimate server and interact with it...

PT-2024-29954

Name of the Vulnerable Software and Affected Versions Elliptic package version 6.5.6 Description The issue concerns EDDSA signature malleability due to a missing signature length check, allowing zero-valued bytes to be removed or appended. This is a cryptographic weakness that can be exploited...

Changing TCBServiSign encryption vulnerability

Changing TCBServiSign is a cross-platform security control component from China-based Changing. An encryption issue vulnerability exists in versions prior to Changing TCBServiSign 1.0.24.0318, which stems from insufficient encryption strength of the authorization key, and can be exploited by a...

PT-2024-29956 · Elliptic +1 · Elliptic +1

Name of the Vulnerable Software and Affected Versions: Elliptic package version 6.5.6 Description: The issue concerns ECDSA signature malleability due to a missing check for whether the leading bit of r and s is zero. This results in a cryptographic weakness. There is no information provided abou...

Over 1 Million Domains at Risk of 'Sitting Ducks' Domain Hijacking Technique

Over a million domains are susceptible to takeover by malicious actors by means of what has been called a Sitting Ducks attack. The powerful attack vector, which exploits weaknesses in the domain name system DNS, is being exploited by over a dozen Russian-nexus cybercriminal actors to stealthily...

TOTOLINK EX1200L Buffer Overflow Vulnerability (CNVD-2025-15239)

TOTOLINK EX1200L is a dual-band wireless signal amplifier launched by China Gion Electronics, which is mainly used to extend Wi-Fi coverage. TOTOLINK EX1200L suffers from a buffer overflow vulnerability, which originates from the parameter week/sTime/eTime in the file /cgi-bin/cstecgi.cgi that ca...

Access Token Handler Information Disclosure

The vulnerability of the Access Token Handler component in the software integration control panel for IBM App Connect Enterprise is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to obtain confidential calendar information using ...

IBM i Registration Data Code Execution

The vulnerability of the IBM i operating system and the IBM Rational Development Studio for i application suite is related to insufficient protection of registration data. Exploiting this vulnerability could allow a perpetrator to execute arbitrary code with administrator privileges...