PT-2024-30275 · Qualcomm · Qualcomm Windows Wlan Host

Name of the Vulnerable Software and Affected Versions: Qualcomm Windows WLAN Host affected versions not specified Description: The issue involves memory corruption that occurs when invoking IOCTL calls from user space to read diagnostic information of the target WLAN. This corruption happens due ...

OESA-2024-2485 openjdk-latest security update

The OpenJDK runtime environment. Security Fixes: Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE component: Libraries. Supported versions that are affected are Java SE: 8u251, 11.0.7 and 14.0.1; Java SE Embedded: 8u251. Difficult to exploit vulnerability allows...

The vulnerability of Adobe InDesign’s computer layout automation tool, related to the execution of operations beyond buffer boundaries in memory, allows attackers to bypass the ASLR protection mechanism and gain unauthorized access to protected information.

The vulnerability of Adobe InDesign’s computer layout automation tool is related to the issue where operations go beyond the buffer in memory when processing JP2 files. Exploiting this vulnerability can allow an attacker to bypass the ASLR protection and gain unauthorized access to protected...

SFTPGo 加密问题漏洞

SFTPGo is a full-featured and highly configurable SFTP server from the individual developer Nicola Murino in Italy. An encryption issue vulnerability exists in SFTPGo versions 2.3.0 through prior to 2.6.4, which stems from a vulnerability that allows an authenticated user to brute-force break a...

Vulnerability fixed in Zabbix

A vulnerability has been fixed in Zabbix. The vulnerability is in how the CUser class handles the addRelatedObjects function. This could allow non-administrators with API access to perform an SQL injection, which could lead to unauthorized access to sensitive data. The vulnerability could enable...

PT-2024-9087

Name of the Vulnerable Software and Affected Versions ICONICS GENESIS64 all versions Mitsubishi Electric GENESIS64 all versions Mitsubishi Electric MC Works64 all versions Description The issue is related to an uncontrolled search path element, which can be exploited by a local authenticated...

PT-2024-35314 · Unknown · Express Payments Module

Name of the Vulnerable Software and Affected Versions: Express Payments Module versions n/a through 1.1.8 Description: The issue is related to an SQL Injection vulnerability, specifically a Blind SQL Injection, due to the improper neutralization of special elements used in an SQL command. This...

CVE-2024-11669

CVE-2024-11669 affects GitLab CE/EE: versions 16.9.8 before 17.4.5, 17.5 before 17.5.3, and 17.6 before 17.6.1. The issue arises from overly broad token scopes applied to API endpoints, potentially allowing unauthorized access to sensitive data. Multiple trusted sources (NVD, OSV, and Nessus entr...

The vulnerability of the virtual learning environment Moodle, related to the disclosure of information through caching, allows a perpetrator to gain access to confidential information.

The vulnerability in the virtual learning environment Moodle is related to the disclosure of information through caching. Exploiting this vulnerability can allow an attacker to gain access to confidential information...

The vulnerability of the virtual learning environment Moodle, related to the insecure storage of confidential information, allows a perpetrator to gain access to confidential data.

The vulnerability in the virtual learning environment Moodle is related to the insecure storage of confidential information. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain access to confidential information...

RHEL 9 : RHOSP 17.1.4 (openstack-ironic) (RHSA-2024:9982)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:9982 advisory. Ironic Security Fixes: Specially crafted image may allow authenticated users to gain access to potentially sensitive data CVE-2024-44082 For more...

CVE-2024-10537

CVE-2024-10537: The WP User Manager – User Profile Builder & Membership plugin for WordPress is vulnerable to unauthorized data access due to a missing capability check in validate_user_meta_key() across versions up to and including 2.9.11. This allows authenticated attackers with Subscriber-leve...

WordPress plugin WP User Manager 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

WordPress plugin WPDash Notes 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CVE-2024-50397

A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained user access to obtain secret data or modify memory. We have already fixed the vulnerability i...

CVE-2024-50396 QTS, QuTS hero

A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers to obtain secret data or modify memory. We have already fixed the vulnerability in the following versions: QT...

CVE-2017-9711 Permissions, Privileges, and Access Controls in Data

Certain unprivileged processes are able to perform IOCTL calls...

CVE-2017-9711 Permissions, Privileges, and Access Controls in Data

Certain unprivileged processes are able to perform IOCTL calls...

CVE-2024-11355

The Ultimate YouTube Video & Shorts Player With Vimeo plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the getsetting function in all versions up to, and including, 3.3. This makes it possible for authenticated attackers, with Subscriber-level...

CVE-2024-11355 Ultimate YouTube Video & Shorts Player With Vimeo <= 3.3 - Missing Authorization to Authenticated (Subscriber+) Setting Exposure

The Ultimate YouTube Video & Shorts Player With Vimeo plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the getsetting function in all versions up to, and including, 3.3. This makes it possible for authenticated attackers, with Subscriber-level...