ZKTeco BioTime security vulnerability

Zkteco BioTime is a powerful web-based time and attendance management software from the Chinese company Zkteco. A security vulnerability exists in ZKTeco BioTime v.8.5.4 and prior versions that could allow a remote attacker to gain access to sensitive information via the authentication and...

CVE-2024-1602

CVE-2024-1602 affects parisneo/lollms-webui, with a stored XSS that leads to Remote Code Execution. Attacker can exploit inadequate sanitization/validation of model output data to inject JavaScript that runs in the user’s browser and can trigger a request to /execute_code to establish a reverse s...

CVE-2024-1602 Stored XSS leading to RCE in parisneo/lollms-webui

parisneo/lollms-webui is vulnerable to stored Cross-Site Scripting XSS that leads to Remote Code Execution RCE. The vulnerability arises due to inadequate sanitization and validation of model output data, allowing an attacker to inject malicious JavaScript code. This code can be executed within t...

CVE-2024-30736

CVE-2024-30736 entry is rejected/not used; withdrawn by CNA with no vulnerability evidence.

CVE-2024-30719

CVE-2024-30719 is rejected; this candidate is not used and does not reflect an active vulnerability entry.

CVE-2024-30733

CVE-2024-30733 entry is rejected/not used.

CVE-2024-3313

SUBNET Solutions Inc. has identified vulnerabilities in third-party components used in PowerSYSTEM Server 2021 and Substation Server 2021...

CVE-2024-3313 SUBNET PowerSYSTEM Server and Substation Server Reliance on Insufficiently Trustworthy Component

SUBNET Solutions Inc. has identified vulnerabilities in third-party components used in PowerSYSTEM Server 2021 and Substation Server 2021...

CVE-2024-3313

CVE-2024-3313 concerns vulnerabilities in third-party components used by SUBNET PowerSYSTEM Server 2021 and Substation Server 2021 (versions 4.07.00 and earlier). The root cause is reliance on an insufficiently trustworthy third-party component. The issue has been assigned CVE-2024-3313 with CVSS...

Security Bulletin: IBM QRadar Deployment Intelligence app for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. IBM QRadar Deployment Intelligence app for IBM QRadar SIEM has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2023-46234 DESCRIPTION: browserify...

Security Bulletin: IBM Operational Decision Manager for March 2024 - Multiple CVEs addressed

Summary IBM Operational Decision Manager is vulnerable to multiple remote code execution and denial of service attacks in third party and open source used in the product for various functions. See full list below. The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2007-4559...

PT-2024-23582 · Unknown · Ros2 Galactic Geochelone

Name of the Vulnerable Software and Affected Versions: ROS2 Galactic Geochelone versions 2 Description: An insecure deserialization vulnerability has been identified, allowing attackers to execute arbitrary code and obtain sensitive information via crafted input to the Data Serialization and...

PT-2024-25126 · Unknown · Powersystem Server 2021 +1

Name of the Vulnerable Software and Affected Versions: PowerSYSTEM Server 2021 Substation Server 2021 Description: The issue concerns vulnerabilities in third-party components used by the software. Recommendations: For PowerSYSTEM Server 2021, update to a version that addresses the vulnerabilitie...

QEMU Resource Management Error Vulnerability

QEMU Quick Emulator is a set of simulation processor software. The software is fast and cross-platform. A resource management error vulnerability exists in QEMU virtio, which stems from a double-release vulnerability in virtio-gpu, virtio-serial-bus, and virtio-crypto, with an insufficient...

CVE-2024-30683

CVE-2024-30683 entry is rejected/not used and does not represent an active vulnerability entry.

SUSE-SU-2024:1157-1 Security update for cdi-apiserver-container, cdi-cloner-container, cdi-controller-container, cdi-importer-container, cdi-operator-container, cdi-uploadproxy-container, cdi-uploadserver-container, containerized-data-importer

This update for cdi-apiserver-container, cdi-cloner-container, cdi-controller-container, cdi-importer-container, cdi-operator-container, cdi-uploadproxy-container, cdi-uploadserver-container, containerized-data-importer fixes the following issues: - rebuild against current security and bugfixes...

CVE-2024-30667

This CVE entry is rejected and not used; it does not represent an active vulnerability entry.

iOS iPadOS Location Access

The vulnerability of the Accessibility component in iOS and iPadOS operating systems is related to deficiencies in access control. Exploiting this vulnerability can allow a malicious actor to gain access to the user’s location...

CVE-2021-4438 kyivstarteam react-native-sms-user-consent SmsUserConsentModule.kt registerReceiver improper export of android application components

A vulnerability, which was classified as critical, has been found in kyivstarteam react-native-sms-user-consent up to 1.1.4 on Android. Affected by this issue is the function registerReceiver of the file android/src/main/java/ua/kyivstar/reactnativesmsuserconsent/SmsUserConsentModule.kt. The...

CVE-2024-30249

CVE-2024-30249 affects Cloudburst Network (RakNet-based components) prior to version 1.0.0.CR1-20240330.101522-15. The root cause is a DoS/UDP amplification vulnerability in RakNet connection handling that can be leveraged to attack a third party or trigger host service suspension. A fix exists i...