Windows Digital Media Elevation of Privilege Vulnerability

...

CVE-2024-12365 W3 Total Cache <= 2.8.1 - Authenticated (Subscriber+) Missing Authorization to Server-Side Request Forgery

The W3 Total Cache plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the isw3tcadminpage function in all versions up to, and including, 2.8.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to obtain...

CVE-2024-47894

creationtimestamp| type| source ---|---|--- 2025-01-13 10:35:39+00:00| seen| https://infosec.exchange/users/cve/statuses/113820600810317629 2025-01-13 11:15:33+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lfmmc2zhcf2t 2025-01-13 11:47:31+00:00| seen|...

SAP GUI 安全漏洞

SAP GUI is an application from SAP, a German company. graphical user interface for SAP systems. A security vulnerability exists in SAP GUI for Windows that stems from storing user input on the client PC to improve usability, and an attacker is able to read this data...

CVE-2025-23128

CVE-2025-23128 is rejected/not used per the description.

CVE-2025-23127

CVE-2025-23127 entry is rejected/not used; it does not represent an active vulnerability entry.

Apps That Are Spying on Your Location

404 Media and Wired are reporting on all the apps that are spying on your location, based on a hack of the location data company Gravy Analytics: The thousands of apps, included in hacked files from location data company Gravy Analytics, include everything from games like Candy Crush to dating ap...

CVE-2025-22145

Carbon (PHP DateTime extension) has a vulnerability where unsanitized input passed to Carbon::setLocale could lead to arbitrary file include if a PHP file is uploaded in a folder that is includable. This affects users of the Carbon extension and is mitigated by fixes in Carbon release 3.8.4 and 2...

Huawei HarmonyOS 授权问题漏洞

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. A command authentication bypass vulnerability exists in the Huawei HarmonyOS Findnetwork module, which can be exploited by an attacker to submit a special...

Security update for gtk3

This update for gtk3 fixes the following issues: CVE-2024-6655: Fixed library injection from current working directory bsc1228120. Other fixes: - Updated to version 3.24.43 Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or...

CVE-2024-45550 Improper Validation of Array Index in DSP Services

Memory corruption occurs when invoking any IOCTL-calling application that executes all MCDM driver IOCTL calls...

Upcoming CVE for End-of-Life Node.js Versions

Upcoming CVE for End-of-Life Node.js Versions The Node.js Project is committed to ensuring the security and reliability of applications built on Node.js. As part of this commitment, we regularly review measures to help our users stay informed about security risks. Announcement We will soon issue ...

Legacy App Migration: Transforming Outdated Systems

Businesses are perpetually under pressure to innovate in a fast-paced digital era. But legacy applications, written with outdated…...

CVE-2024-56513 Karmada PULL Mode Cluster Privilege Escalation

Karmada is a Kubernetes management system that allows users to run cloud-native applications across multiple Kubernetes clusters and clouds. Prior to version 1.12.0, the PULL mode clusters registered with the karmadactl register command have excessive privileges to access control plane resources...

PT-2025-30843

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel’s DRM scheduler where scheduled fences may not be properly signaled when a job is killed. This can occur when a job from one application depends on a...

Connected contraptions cause conniption for 2024

The holidays are upon us, which means now is the perfect time for gratitude, warmth, and—because modern society has thrust it upon us—gift buying. It’s Bluey and dig kits and LEGOs for kids, Fortnite and AirPods and backpacks for tweens, and, for an adult you particularly love, it’s televisions,...

The vulnerability of the SAP GUI graphical user interface for Windows lies in the insufficient protection of operational data, allowing an intruder to gain unauthorized access to protected information.

The vulnerability of the SAP GUI graphical user interface for Windows relates to the display of a password used to access the SAP system. This vulnerability stems from insufficient protection of administrative data. Exploiting this vulnerability could allow an intruder to gain unauthorized access...

K000149093: Apache Struts vulnerability CVE-2024-53677

Security Advisory Description File upload logic in Apache Struts is flawed. An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. This issue affects Apach...

[SECURITY] Fedora 41 Update: ofono-2.14-1.fc41

oFono.org is a place to bring developers together around designing an infrastructure for building mobile telephony GSM/UMTS applications. oFono includes a high-level D-Bus API for use by telephony applications. oFono also includes a low-level plug-in API for integrating with telephony stacks,...

The vulnerability of the platform for monitoring, managing, and improving LLM applications, related to bypassing authentication using a user-controlled key, allows attackers to influence the integrity and confidentiality of protected information.

The vulnerability of the platform for monitoring, managing, and improving LLM applications involves bypassing authentication by using a user-controlled key. Exploiting this vulnerability allows an attacker to influence the integrity and confidentiality of protected information by manipulating the...