The vulnerability in the CORS mechanism of Mozilla Firefox, Firefox ESR, and the Thunderbird email client allows a hacker to bypass security restrictions, gain unauthorized access to protected information, and execute arbitrary code.

The vulnerability of the CORS mechanism in Mozilla Firefox, Firefox ESR, and the Thunderbird email client is related to the lack of measures taken to protect the structure of web pages during the processing of the resource://devtools path. Exploiting this vulnerability allows an attacker to bypas...

CVE-2024-46956

An issue was discovered in psi/zfile.c in Artifex Ghostscript before 10.04.0. Out-of-bounds data access in filenameforall can lead to arbitrary code execution...

CVE-2024-46956

CVE-2024-46956 affects Artifex Ghostscript (psi/zfile.c) with an out-of-bounds data access in filenameforall that can lead to arbitrary code execution on Ghostscript versions up to 10.04.0. Connected advisories confirm this vulnerability and provide patch guidance; mitigation is to update Ghostsc...

CVE-2024-46956

An issue was discovered in psi/zfile.c in Artifex Ghostscript before 10.04.0. Out-of-bounds data access in filenameforall can lead to arbitrary code execution...

CVE-2024-46956

An issue was discovered in psi/zfile.c in Artifex Ghostscript before 10.04.0. Out-of-bounds data access in filenameforall can lead to arbitrary code execution...

CVE-2024-46956

An issue was discovered in psi/zfile.c in Artifex Ghostscript before 10.04.0. Out-of-bounds data access in filenameforall can lead to arbitrary code execution...

CVE-2024-46956

An issue was discovered in psi/zfile.c in Artifex Ghostscript before 10.04.0. Out-of-bounds data access in filenameforall can lead to arbitrary code execution...

CVE-2024-52312

Due to inconsistent authorization permissions, data.all may allow an external actor with an authenticated account to perform restricted operations against DataSets and Environments...

WordPress plugin Attesa Extra 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

data.all 安全漏洞

data.all is an open source development framework from data-dot-all open source. A security vulnerability exists in data.all that stems from the fact that a member of the data.all management team with access to an AWS account owned by a customer deploying data.all may be able to extract user data...

CVE-2024-51030

A SQL injection vulnerability in manageclient.php and viewcab.php of Sourcecodester Cab Management System 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter, leading to unauthorized access and potential compromise of sensitive data within the database...

Mars: Users Data Exposure via Insecure Endpoint

An insecure endpoint on the Mars Royal Canin website exposed sensitive customer information without proper authentication. Personal data, including full names, phone numbers, email addresses, physical addresses, and postal codes, was accessible through a simple API endpoint that could be accessed...

The vulnerability of the Party Search UI component of the software for working with customers in Oracle Trading Community, a business automation system from Oracle E-Business Suite, allows a malicious individual to gain unauthorized access to read, create, modify, or delete data.

The vulnerability of the Party Search UI component of the software for working with Oracle Trading Community clients, a business automation system within the Oracle E-Business Suite, is related to deficiencies in the authentication process. Exploiting this vulnerability could allow an attacker,...

PT-2024-16661 · Amazon · Amazon Web Services

Name of the Vulnerable Software and Affected Versions: Amazon Web Services AWS affected versions not specified Description: The issue allows an authenticated data.all user to perform mutating UPDATE operations on persisted Notification records in data.all for group notifications that their user i...

SQL Injection

Funadmin is vulnerable to SQL injection. The vulnerability is due to improper input validation in curd/table/savefield, allowing malicious SQL code to be executed. Attackers can exploit this vulnerability to manipulate database queries, potentially gaining unauthorized access to or tampering with...

openstack-ironic: Specially crafted image may allow authenticated users to gain access to potentially sensitive data

A vulnerability was found in OpenStack Ironic. This flaw allows an authenticated user to use a specially crafted image to exploit undesired behaviors in qemu-img, including possible unauthorized access to potentially sensitive data...

The vulnerability of the Nested iFrame Handler component in the Firefox web browser arises from an incorrect SameSite attribute in the cookie file. This allows attackers to access sensitive data, compromise its integrity, and cause service failures.

The vulnerability of the Nested iFrame Handler component in the Firefox web browser is related to an incorrect SameSite attribute in the cookie file. Exploiting this vulnerability can allow a remote attacker to access sensitive data, compromise its integrity, and cause service interruptions...

The vulnerability of the `filter_sobel` function in the `libavfilter/vf_convolution.c` file of the FFmpeg multimedia library, related to integer overflow, allows an attacker to access confidential data, compromise its integrity, and cause service interruptions.

The vulnerability of the filtersobel function in the libavfilter/vfconvolution.c file of the FFmpeg multimedia library is related to integer overflow. Exploiting this vulnerability could allow an attacker to gain access to confidential data, compromise its integrity, and even cause service failur...

OPENSUSE-SU-2024:0352-1 Security update for python-jupyterlab

This update for python-jupyterlab fixes the following issues: - Build the full pacakge with the javascript dependencies as a new source in vendor.tar.gz. - CVE-2024-43805: Fixed data access via malicious Markdown due to HTML injection leading to DOM clobbering boo1229914...

CVE-2024-20511

A vulnerability in the web-based management interface of Cisco Unified Communications Manager Unified CM and Cisco Unified Communications Manager Session Management Edition Unified CM SME could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against a user o...