CVE-2024-54681 Ossur Mobile Logic Application Command Injection

Multiple bash files were present in the application's private directory. Bash files can be used on their own, by an attacker that has already full access to the mobile platform to compromise the translations for the application...

Ossur Mobile Logic Application 安全漏洞

Ossur Mobile Logic Application is an intelligent application for bionic prosthetics from Ossur. A security vulnerability exists in Ossur Mobile Logic Application versions prior to 1.5.5 that originates from exposing sensitive system information to unauthorized control...

CVE-2024-57757

JeeWMS before v2025.01.01 was discovered to contain a permission bypass in the component /interceptors/AuthInterceptor.cava...

CVE-2024-48893

An improper neutralization of input during web page generation vulnerability CWE-79 in FortiSOAR 7.3.0 through 7.3.3, 7.2.1 through 7.2.2 may allow an authenticated attacker to perform a stored cross site scripting XSS attack via the creation of malicious playbook...

CVE-2025-23032 Cross-Site Scripting (XSS) Stored endpoint 'adicionar_escala.php' parameter 'escala' in WeGIA

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. A Stored Cross-Site Scripting XSS vulnerability was identified in the adicionarescala.php endpoint of the WeGIA application. This vulnerability allows attackers to inject malicious scripts int...

CVE-2024-53935

The com.callos14.callscreen.colorphone aka iCall OS17 - Color Phone Flash application through 4.3 for Android enables any application with no permissions to place phone calls without user interaction by sending a crafted intent via the com.callos14.callscreen.colorphone.DialerActivity component...

CVE-2024-53934

The CVE-2024-53934 issue affects the Color Phone Call Screen Themes app (com.windymob.callscreen.ringtone.callcolor.colorphone) up to version 1.1.2 for Android. A crafted intent to the DialerActivity component (com.frovis.androidbase.call.DialerActivity) enables any other app, with no permissions...

CVE-2024-1609

In OPPOStore iOS App, there's a possible escalation of privilege due to improper input validation...

Delta Electronics DRASimuCAD STP Resolution Type Obfuscation Code Execution Vulnerability

Delta Electronics DRASimuCAD is a robot simulation integration platform developed by Delta Electronics. A type confusion vulnerability exists in the parsing of the Delta Electronics DRASimuCAD STP file, which can be exploited by an attacker to submit a special file request and trick the user into...

CVE-2024-38819

Applications serving static resources through the functional web frameworks WebMvc.fn or WebFlux.fn are vulnerable to path traversal attacks. An attacker can craft malicious HTTP requests and obtain any file on the file system that is also accessible to the process in which the Spring application...

Bun has an Application-level Prototype Pollution vulnerability in the runtime native API for Glo

Versions of the package bun before 1.1.30 are vulnerable to Prototype Pollution due to improper input sanitization. An attacker can exploit this vulnerability through Bun's APIs that accept objects...

CVE-2024-12603

A logic vulnerability in the the mobile application com.transsion.applock can lead to bypassing the application password...

CVE-2024-28141

The web application is not protected against cross-site request forgery attacks. Therefore, an attacker can trick users into performing actions on the application when they visit an attacker-controlled website or click on a malicious link. E.g. an attacker can forge malicious links to reset the...

CVE-2024-28141 Cross-Site Request-Forgery

The web application is not protected against cross-site request forgery attacks. Therefore, an attacker can trick users into performing actions on the application when they visit an attacker-controlled website or click on a malicious link. E.g. an attacker can forge malicious links to reset the...

CVE-2024-28141

CVE-2024-28141 describes a Cross-Site Request Forgery vulnerability in a web application used by Image Access Scan2Net. The issue allows an attacker to trick authenticated users into performing actions on the application (e.g., resetting an admin password or creating new users) when visiting a ma...

CVE-2024-50625

Digi ConnectPort LTS prior to 1.4.12 is affected by a vulnerability in the web application’s file upload handling that allows manipulation of the file path via POST requests. This can enable arbitrary file uploads within specific directories and potentially lead to privilege escalation when combi...

Chinese APT Gelsemium Targets Linux Systems with New WolfsBane Backdoor

The China-aligned advanced persistent threat APT actor known as Gelsemium has been observed using a new Linux backdoor dubbed WolfsBane as part of cyber attacks likely targeting East and Southeast Asia. That's according to findings from cybersecurity firm ESET based on multiple Linux samples...

CVE-2024-42389 Use of Out-of-range Pointer Offset in Mongoose Web Server library

Use of Out-of-range Pointer Offset vulnerability in Cesanta Mongoose Web Server v7.14 allows an attacker to send an unexpected TLS packet and force the application to read unintended heap memory space...

Lack of unique constraint validation allows overwriting evaluators

Description The application allows the creation of evaluators without enforcing a unique constraint on the combination of projectId and slug. This allows an attacker to overwrite existing data by submitting a POST request with the same slug as an existing evaluator. Since the backend lacks databa...

MGASA-2024-0351 Updated python-werkzeug packages fix security vulnerability

Werkzeug is a Web Server Gateway Interface web application library. Applications using werkzeug.formparser.MultiPartParser corresponding to a version of Werkzeug prior to 3.0.6 to parsing multipart/form-data requests e.g. all flask applications are vulnerable to a relatively simple but effective...