PT-2024-27049

Name of the Vulnerable Software and Affected Versions: nukeviet versions 4.5 and earlier nukeviet-egov versions 1.2.02 and earlier Description: The issue is related to a Deserialization vulnerability, which can result in code execution. This can be achieved via the "/admin/extensions/download.php...

Apache OFBiz path traversal vulnerability (CNVD-2024-26187)

Apache OFBiz is the United States Apache Apache Foundation of a set of enterprise resource planning ERP system. The system provides a set of Java-based Web application components and tools. A path traversal vulnerability exists in Apache OFBiz versions prior to 18.12.14, which can be exploited by...

PT-2024-27269

Name of the Vulnerable Software and Affected Versions MLflow platform versions 0.9.0 and newer Description The issue allows deserialization of untrusted data, enabling a maliciously uploaded PyFunc model to run arbitrary code on an end user's system when interacted with. Recommendations For MLflo...

Important: git

Issue Overview: Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, repositories with submodules can be crafted in a way that exploits a bug in Git whereby it can be fooled into writing files not into the submodule's worktree but into a...

The vulnerability of the SetTelnetCfg function in the TELNET component of TOTOLINK CP450 router microprogramming software allows a intruder to execute arbitrary code.

The vulnerability of the SetTelnetCfg function in the TELNET component of TOTOLINK CP450 microprogramming software exists due to insufficient verification of input data. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code using the TELNET network protocol...

DAR-8000-10 Deserialization Vulnerability in AUO Electronic Devices (Shanghai) Co.

DAR-8000-10 is the Internet Behavior Audit Gateway from China AUO D-Link. AUO DAR-8000-10 20230922 and earlier versions have a deserialization vulnerability that originates from the unsafe deserialization of the parameter sql of the file /importhtml.php when receiving serialized data submitted by...

MGASA-2024-0182 Updated gdk-pixbuf2.0 packages fix security vulnerability

In GNOME GdkPixbuf aka gdk-pixbuf through 2.42.10, the ANI Windows animated cursor decoder encounters heap memory corruption in aniloadchunk in io-ani.c when parsing chunks in a crafted .ani file. A crafted file could allow an attacker to overwrite heap metadata, leading to a denial of service or...

Adobe Framemaker Buffer Overflow Vulnerability (CNVD-2024-27546)

Adobe Framemaker is the United States of America Odooby Adobe company's set of page layout software for writing and editing large or complex documents including structured documents. A security vulnerability exists in Adobe Framemaker, which is caused by improper boundary checking. An attacker...

Mozilla: Memory safety bugs fixed in Firefox 126, Firefox ESR 115.11, and Thunderbird 115.11

A flaw was found in Mozilla. The Mozilla Foundation Security Advisory describes this flaw as follows: Memory safety bugs present in Firefox 125, Firefox ESR 115.10, and Thunderbird 115.10. Some of these bugs showed evidence of memory corruption, and we presume that with enough effort, some of the...

Siemens PS/IGES Parasolid Translator Component Type Obfuscation Vulnerability (CNVD-2024-27525)

Parasolild Translators is a single-format translator toolkit for high-speed end-to-end translation between Parasolid and several industry formats such as STEP or IGES. A type confusion vulnerability exists in the Siemens PS/IGES Parasolid Translator component that can be exploited by an attacker ...

Siemens PS/IGES Parasolid Translator component out-of-bounds read vulnerability (CNVD-2024-24529)

Parasolild Translators is a single-format translator toolkit for high-speed end-to-end translation between Parasolid and several industry formats such as STEP or IGES. An out-of-bounds read vulnerability exists in the Siemens PS/IGES Parasolid Translator component, which can be exploited by an...

Siemens Solid Edge Out-of-Bounds Read Vulnerability (CNVD-2024-23111)

Siemens Solid Edge is a 3D CAD software from Siemens Germany. The software can be used for part design, assembly design, sheet metal design, welding design and other industries. Siemens Solid Edge suffers from an out-of-bounds read vulnerability that can be exploited by an attacker to execute cod...

PT-2024-40153 · Laravel · Laravel Encrypter

Name of the Vulnerable Software and Affected Versions: Laravel Encrypter affected versions not specified Description: The issue affects the Laravel Encrypter component, potentially causing decryption failure and returning false. An attacker can exploit this by manipulating the encrypted payload...

UBUNTU-CVE-2024-4771

A memory allocation check was missing which would lead to a use-after-free if the allocation failed. This could have triggered a crash or potentially be leveraged to achieve code execution. This vulnerability affects Firefox 126...

AZL-40676 CVE-2024-29165 affecting package hdf5 for versions less than 1.14.4-1

HDF5 through 1.14.3 contains a buffer overflow in H5Zfilterfletcher32, resulting in the corruption of the instruction pointer and causing denial of service or potential code execution...

AZL-40574 CVE-2024-29162 affecting package hdf5 for versions less than 1.14.4.3-1

HDF5 through 1.13.3 and/or 1.14.2 contains a stack buffer overflow in H5HGread, resulting in denial of service or potential code execution...

AZL-40663 CVE-2024-29159 affecting package hdf5 for versions less than 1.14.4-1

HDF5 through 1.14.3 contains a buffer overflow in H5Zfilterscaleoffset, resulting in the corruption of the instruction pointer and causing denial of service or potential code execution...

AZL-40726 CVE-2024-29157 affecting package hdf5 for versions less than 1.14.4-1

HDF5 through 1.14.3 contains a heap buffer overflow in H5HGread, resulting in the corruption of the instruction pointer and causing denial of service or potential code execution...

AZL-40555 CVE-2024-29158 affecting package hdf5 for versions less than 1.14.4.3-1

HDF5 through 1.14.3 contains a stack buffer overflow in H5FLarrmalloc, resulting in the corruption of the instruction pointer and causing denial of service or potential code execution...

CVE-2024-27818

The issue was addressed with improved memory handling. This issue is fixed in iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5. An attacker may be able to cause unexpected app termination or arbitrary code execution...