CVE-2024-43089

In updateInternal of MediaProvider.java , there is a possible access of another app's files due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2024-31831

Name of the Vulnerable Software and Affected Versions baltic-it TOPqw Webportal versions 1.35.287.1 through 1.35.290 Description The issue concerns a Cross-Site Scripting XSS vulnerability in the file upload function of the "QWKalkulation" tool. To exploit this vulnerability, an attacker must be...

PT-2024-31828

Name of the Vulnerable Software and Affected Versions baltic-it TOPqw Webportal versions 1.35.283.2 through 1.35.283.3 Description The login form of the baltic-it TOPqw Webportal at "/Apps/TOPqw/Login.aspx" is vulnerable to SQL injection. The vulnerability exists in the txtUsername parameter, whi...

PT-2024-31829

Name of the Vulnerable Software and Affected Versions baltic-it TOPqw Webportal version 1.35.283.2 Description The issue is related to Incorrect Access Control in the User Management function, specifically in the /Apps/TOPqw/BenutzerManagement.aspx endpoint. This allows a low-privileged user to...

New Flaws in Citrix Virtual Apps Enable RCE Attacks via MSMQ Misconfiguration

Cybersecurity researchers have disclosed new security flaws impacting Citrix Virtual Apps and Desktop that could be exploited to achieve unauthenticated remote code execution RCE The issue, per findings from watchTowr, is rooted in the Session Recording component that allows system administrators...

November 12, 2024—KB5046613 (OS Builds 19044.5131 and 19045.5131) - EXPIRED

None None...

PT-2024-8776

Name of the Vulnerable Software and Affected Versions: Microsoft Excel versions affected versions not specified Microsoft 365 Apps for Enterprise versions affected versions not specified Microsoft Office versions affected versions not specified Microsoft Office Long Term Servicing Channel version...

Checking excessively long DSA keys or parameters may be very slow

OpenSSL contains an unbounded computation flaw when performing checks on excessively large DSA keys or parameters, which could lead to a denial-of-service DoS attack. The OpenSSL pkey, pkeyparam command line apps, and FIPS providers are affected...

PT-2024-8155 · Microsoft · 365 Apps For Enterprise +2

Name of the Vulnerable Software and Affected Versions: Microsoft Office versions affected versions not specified Microsoft Excel versions affected versions not specified Microsoft 365 Apps for Enterprise versions affected versions not specified Description: The issue is related to a buffer overfl...

PT-2024-8550 · Microsoft · 365 Apps For Enterprise +2

Name of the Vulnerable Software and Affected Versions: Microsoft Excel affected versions not specified Microsoft Office affected versions not specified 365 Apps for Enterprise affected versions not specified Description: The issue is related to a memory usage problem after memory has been freed,...

PT-2024-8515

Name of the Vulnerable Software and Affected Versions Citrix Virtual Apps and Desktops CVAD versions 1912 LTSR, 2203, 2402, and 2407 Description The issue is related to insecure privilege management in the Session Recording component of Citrix Virtual Apps and Desktops CVAD, allowing an attacker ...

Citrix Systems Virtual Apps and Desktops security vulnerabilities

Citrix Systems Virtual Apps and Desktops is a virtualization software from Citrix Systems, Inc. that provides virtual desktops and virtual applications for any operating system. A security vulnerability exists in Citrix Systems Virtual Apps and Desktops that stems from the ability to access...

Microsoft Graphics Component resource management error vulnerability

Microsoft Graphics Component is a graphics driver component from Microsoft Corporation USA. A resource management error vulnerability exists in Microsoft Graphics Component. An attacker exploiting this vulnerability could remotely execute code. The following products and editions are...

Citrix Systems Virtual Apps and Desktops security vulnerabilities

Citrix Systems Virtual Apps and Desktops is virtual software from Citrix Systems, Inc. that provides virtual desktops and virtual applications for any operating system. A security vulnerability exists in Citrix Systems Virtual Apps and Desktops that stems from the ability to access privileges and...

KLA77110 PE vulnerability in Microsoft Apps

An elevation of privilege vulnerability was found in Microsoft Apps. Malicious users can exploit this vulnerability to gain privileges. Original advisories CVE-2024-49051 Exploitation CVE list CVE-2024-49051 high Solution Install necessary updates from the KB section, that are listed in your...

Citrix-Virtual-Apps-XEN-Exploit

CVE-2024-xxxx Citrix Virtual Apps and Desktops XEN Unauthen...

CVE-2024-51760: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ristretto Apps Dashing Memberships dashing-memberships allows Reflected XSS.This issue affects Dashing Memberships: from n/a through = 1.1...

CVE-2024-11026

CVE-2024-11026 affects Intelligent Apps Freenow App 12.10.0 on Android. The issue resides in the Keystore Handler’s SSL.java (ch/qos/logback/core/net/ssl/SSL.java), where the argument DEFAULT_KEYSTORE_PASSWORD is manipulated with the input value “changeit,” resulting in a hard-coded password. Thi...

CVE-2024-50811

hopetree izone lts c011b48 contains a server-side request forgery SSRF vulnerability in the active push function as \apps\tool\apis\bdpush.py does not securely filter user input through pushurls and geturls...

CVE-2024-50810: Improper Neutralization of Input During Web Page Generation

hopetree izone lts c011b48 contains a Cross Site Scripting XSS vulnerability in the article comment function. In \apps\comment\views.py, AddCommintView does not securely filter user input and renders it directly to the frontend page through templates...