AVTECH Software Room Alert 4E 安全漏洞

AVTECH Software Room Alert 4E is an environmental monitoring device from AVTECH Software, Inc. A security vulnerability exists in AVTECH Software Room Alert 4E version v4.4.0, which originates from a vulnerability that allows an attacker to gain access to SMTP credentials in plaintext via a craft...

PT-2024-26285 · Svnwebui · Svnwebui

Name of the Vulnerable Software and Affected Versions: svnWebUI version 1.8.3 Description: The issue allows attackers to delete arbitrary files by sending a crafted POST request. This is achieved via the dirTemps parameter under the com.cym.controller.UserControllerimportOver function...

golang: net/http/internal: Denial of Service (DoS) via Resource Consumption via HTTP requests

A flaw was found in the Golang net/http/internal package. This issue may allow a malicious user to send an HTTP request and cause the receiver to read more bytes from network than are in the body up to 1GiB, causing the receiver to fail reading the response, possibly leading to a Denial of Servic...

xorg-x11-server: Use-after-free in ProcRenderAddGlyphs

A use-after-free vulnerability was found in the ProcRenderAddGlyphs function of Xorg servers. This issue occurs when AllocateGlyph is called to store new glyphs sent by the client to the X server, potentially resulting in multiple entries pointing to the same non-refcounted glyphs. Consequently,...

CVE-2024-5072

Improper input validation in PAM JIT elevation feature in Devolutions Server 2024.1.11.0 and earlier allows an authenticated user with access to the PAM JIT elevation feature to manipulate the LDAP filter query via a specially crafted request...

CVE-2024-34191

htmly v2.9.6 was discovered to contain an arbitrary file deletion vulnerability via the deletepost function at admin.php. This vulnerability allows attackers to delete arbitrary files via a crafted request...

CVE-2024-33250

An issue in Open-Source Technology Committee SRS real-time video server RS/4.0.268Leo and SRS/4.0.195Leo allows a remote attacker to execute arbitrary code via a crafted request...

CVE-2024-34191

htmly v2.9.6 was discovered to contain an arbitrary file deletion vulnerability via the deletepost function at admin.php. This vulnerability allows attackers to delete arbitrary files via a crafted request...

CVE-2024-34191

HTMly version 2.9.6 is affected by CVE-2024-34191, a vulnerability in delete_post() (admin.php) that enables arbitrary file deletion via a crafted request. The issue is documented across multiple sources (NVD/Red Hat OSV, etc.), with a CVSS v3.1 base score of 6.5 (I: High, A: None) and an attack ...

Fortinet FortiOS 资源管理错误漏洞

Fortinet FortiOS is a set of security operating system dedicated to FortiGate network security platform from American Fita Fortinet. The system provides users with firewall, antivirus, IPSec/SSLVPN, Web content filtering and anti-spam and other security features. A resource management error...

htmly 安全漏洞

HTMLy is a PHP-based open source blogging platform. A security vulnerability exists in htmly version v2.9.6, which stems from the presence of an arbitrary file deletion vulnerability that allows an attacker to delete arbitrary files via a crafted request...

SRS 安全漏洞

SRS is a simple, efficient, real-time video server from SRS Open Source. A security vulnerability exists in Simple Realtime Server that stems from allowing a remote attacker to execute arbitrary code via a crafted request...

CVE-2024-33250

An issue in Open-Source Technology Committee SRS real-time video server RS/4.0.268Leo and SRS/4.0.195Leo allows a remote attacker to execute arbitrary code via a crafted request...

CVE-2024-33250

CVE-2024-33250 affects Open-Source Technology Committee SRS real-time video server RS/4.0.268 (Leo) and RS/4.0.195 (Leo). The issue allows a remote attacker to execute arbitrary code via a crafted request. Connected sources confirm affected version range 4.0.195–4.0.268 and indicate no explicit f...

CVE-2024-2454 Allocation of Resources Without Limits or Throttling in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.11 prior to 16.9.7, starting from 16.10 prior to 16.10.5, and starting from 16.11 prior to 16.11.2. The pins endpoint is susceptible to DoS through a crafted request...

CVE-2024-2454

Removed by vendor...

Apache InLong 代码问题漏洞

Apache InLong is the U.S. Apache Apache Foundation's one-stop massive data integration framework. Provides automated, secure and reliable data transfer capabilities. A code execution vulnerability exists in Apache InLong, which can be exploited by an attacker to execute arbitrary code on a system...

D-Link DIR-845 安全漏洞

The D-Link DIR-845L is a wireless router from China-based AUO D-Link. The D-Link DIR-845L suffers from a command execution vulnerability that can be exploited by an attacker to execute arbitrary commands on the system by sending a specially crafted request...

CVE-2023-37407 IBM Aspera Orchestrator command execution

IBM Aspera Orchestrator 4.0.1 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM X-Force ID: 260116...

PT-2024-12613 · Ibm · Ibm Aspera Orchestrator

Name of the Vulnerable Software and Affected Versions: IBM Aspera Orchestrator version 4.0.1 Description: The issue allows a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. Recommendations: For IBM Aspera Orchestrator version 4.0.1...