CVE-2024-47495

An Authorization Bypass Through User-Controlled Key vulnerability allows a locally authenticated attacker with shell access to gain full control of the device when Dual Routing Engines REs are in use on Juniper Networks Junos OS Evolved devices. This issue affects: Juniper Networks Junos OS Evolv...

CVE-2024-47495 Junos OS Evolved: In a dual-RE scenario a locally authenticated attacker with shell privileges can take over the device.

An Authorization Bypass Through User-Controlled Key vulnerability allows a locally authenticated attacker with shell access to gain full control of the device when Dual Routing Engines REs are in use on Juniper Networks Junos OS Evolved devices. This issue affects: Juniper Networks Junos OS Evolv...

Gradio vulnerable to SSRF in the path parameter of /queue/join

Impact What kind of vulnerability is it? Who is impacted? This vulnerability relates to Server-Side Request Forgery SSRF in the /queue/join endpoint. Gradio’s asyncsaveurltocache function allows attackers to force the Gradio server to send HTTP requests to user-controlled URLs. This could enable...

Gradio 安全漏洞

Gradio, an open-source Python library open-sourced by Hugging Face, is a method for demonstrating machine learning models through a friendly web interface. A security vulnerability exists in Gradio that stems from Gradio's asyncsaveurltocache function that allows an attacker to force the Gradio...

Juniper Junos OS Vulnerability (JSA88122)

The version of Junos OS installed on the remote host is affected by a vulnerability as referenced in the JSA88122 advisory. - An Authorization Bypass Through User-Controlled Key vulnerability allows a locally authenticated attacker with shell access to gain full control of the device when Dual...

CVE-2024-38815

VMware NSX contains a content spoofing vulnerability (CVE-2024-38815). An unauthenticated attacker can craft a URL that redirects victims to an attacker‑controlled domain, potentially leading to information disclosure. Affects VMware NSX and related NSX components; CVSSv3 base score up to 4.3 (Me...

CVE-2024-45746

An issue was discovered in Trusted Firmware-M through 2.1.0. User provided and controlled mailbox messages contain a pointer to a list of input arguments invec and output arguments outvec. These list pointers are never validated. Each argument list contains a buffer pointer and a buffer length...

CVE-2024-45330

A use of externally-controlled format string in Fortinet FortiAnalyzer versions 7.4.0 through 7.4.3, 7.2.2 through 7.2.5 allows attacker to escalate its privileges via specially crafted requests...

CVE-2024-47594 Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal (KMC)

SAP NetWeaver Enterprise Portal KMC does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting vulnerability in KMC servlet. An attacker could craft a script and trick the user into clicking it. When a victim who is registered on the portal clicks on such link,...

CVE-2024-47594 Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal (KMC)

SAP NetWeaver Enterprise Portal KMC does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting vulnerability in KMC servlet. An attacker could craft a script and trick the user into clicking it. When a victim who is registered on the portal clicks on such link,...

CVE-2024-47594

SAP NetWeaver Enterprise Portal (KMC) is affected by a Cross-Site Scripting vulnerability arising from insufficient encoding of user-controlled inputs in the KMC servlet. The PT-2024-7175 entry specifies affected software: SAP NetWeaver Enterprise Portal (KMC) versions 7.5, enabling remote attack...

CVE-2024-45278 Cross-Site Scripting (XSS) vulnerability in SAP Commerce Backoffice

SAP Commerce Backoffice does not sufficiently encode user controlled inputs, resulting in Cross-Site Scripting XSS vulnerability. After successful exploitation, an attacker can cause limited impact on confidentiality and integrity of the application...

CVE-2024-47316

Authorization Bypass Through User-Controlled Key vulnerability in Salon Booking System Salon booking system.This issue affects Salon booking system: from n/a through 10.9...

CVE-2024-47316

CVE-2024-47316 affects the WordPress Salon Booking System plugin (versions

CVE-2024-47316 WordPress Salon Booking Wordpress Plugin plugin <= 10.9 - Insecure Direct Object References (IDOR) vulnerability

Authorization Bypass Through User-Controlled Key vulnerability in Salon Booking System Salon booking system.This issue affects Salon booking system: from n/a through 10.9...

PT-2024-32528 · Unknown · Salon Booking System

Name of the Vulnerable Software and Affected Versions: Salon Booking System versions through 10.9 Description: The issue is related to an Authorization Bypass Through User-Controlled Key vulnerability. This vulnerability affects the Salon Booking System, allowing for potential unauthorized access...

CVE-2024-47316: Authorization Bypass Through User-Controlled Key

Authorization Bypass Through User-Controlled Key vulnerability in Dimitri Grassi Salon booking system salon-booking-system.This issue affects Salon booking system: from n/a through = 10.9...

cookie accepts cookie name, path, and domain with out of bounds characters

Impact The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. For example, serialize"userName=alert'XSS3'; Max-Age=2592000; a", value would result in "userName=alert'XSS3'; Max-Age=2592000; a=test", setting userName cookie to and ignoring value. ...

Next.js Authentication Bypass Info Disclosure

The vulnerability of the Next.js web application development software platform lies in the ability to bypass authentication by using a user-controlled key. Exploiting this vulnerability allows an attacker to disclose sensitive information by sending a non-dynamic cache from the server...

Oracle Linux 8 : cups-filters (ELSA-2024-7463)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-7463 advisory. - CVE-2024-47175 cups-filters: remote command injection via attacker controlled data in PPD file - CVE-2024-47076 cups-filters: cfGetPrinterAttributes...