The vulnerability of NVIDIA BlueField data processing processor microprogramming software, related to access control deficiencies, allows a intruder to gain unauthorized access to read and modify data, or to cause service failures.

The vulnerability of NVIDIA BlueField data processing processor microprogramming software is related to deficiencies in access control. Exploiting this vulnerability could allow an intruder to gain unauthorized access to read and modify data, or cause service failures...

The vulnerability of the Downloads component of Microsoft Edge and Google Chrome browsers allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the Downloads component in Microsoft Edge and Google Chrome is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to compromise the confidentiality, integrity, and accessibility of protected information through a specially...

SAMSUNG Mobile devices 安全漏洞

SAMSUNG Mobile devices are a range of Samsung mobile devices, including cell phones, tablets, etc., from the South Korean company Samsung SAMSUNG. A security vulnerability previously existed in SAMSUNG Mobile devices version 4.9.15.7, which stemmed from Samsung Flow containing an improper access...

SQL Injection Vulnerability in UFIDA U8Cloud of UFIDA Network Technology Co. Ltd (CNVD-2024-47756)

UFIDA U8cloud is a new-generation cloud ERP launched by UFIDA, which mainly focuses on growing and innovative enterprises and provides enterprise-level cloud ERP total solutions. A SQL injection vulnerability exists in UFIDA U8Cloud, which can be exploited by attackers to gain access to sensitive...

CVE-2024-49770

Summary: CVE-2024-49770 affects the Oak middleware framework used with Deno’s native HTTP server (and compatible runtimes). Before 17.1.3, an attacker could bypass the hidden-file restriction in Context.send by encoding a path separator as %2F, enabling potential read of sensitive files or server...

CVE-2024-43310

Missing Authorization vulnerability in UkrSolution Print Barcode Labels for your WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Print Barcode Labels for your WooCommerce products/orders: from n/a through 3.4.9...

WordPress plugin Multiple Page Generator Plugin – MPG 访问控制错误漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An access control error...

The vulnerability of the Platypus.js tooling platform, related to incorrect path name restrictions for restricted access catalogs, allows attackers to gain access to confidential data.

The vulnerability of the Platypus.js tooling platform is related to an incorrect restriction on the path name to the restricted-access catalog. Allowing this to be exploited could enable a malicious actor to gain access to confidential data...

PT-2024-38338 · WordPress · Mpg Plugin

Name of the Vulnerable Software and Affected Versions: The Multiple Page Generator Plugin – MPG plugin for WordPress versions up to, and including, 4.0.1 Description: The issue allows authenticated attackers with Subscriber-level access and above to invoke functions intended for admin use,...

The vulnerability of the InnoDB component in the Oracle MySQL Server database management system allows a hacker to gain unauthorized access for reading, creating, modifying, and deleting data, or to cause service failures.

The vulnerability of the InnoDB component in the Oracle MySQL Server database management system is related to deficiencies in the authentication process. Exploiting this vulnerability can allow an attacker to gain unauthorized access for reading, creating, modifying, and deleting data, or to caus...

Medium: java-11-amazon-corretto

Issue Overview: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Networking. Supported versions that are affected are Oracle Java SE: 8u421, 8u421-perf, 11.0.24, 17.0.12, 21.0.4, 23; Oracle GraalVM for JDK: 17.0.12...

Autodesk AutoCAD Heap Buffer Overflow Vulnerability

Autodesk AutoCAD is a set of professional 3D drawing software from the American Autodesk Corporation. Autodesk AutoCAD suffers from a heap buffer overflow vulnerability that can be exploited by an attacker to cause a crash, read sensitive data, or execute arbitrary code in the context of the...

The vulnerability of the bootloader component in Android operating systems of Samsung mobile devices allows attackers to influence the confidentiality and accessibility of the protected information.

The vulnerability of the bootloader component in Android operating systems of Samsung mobile devices relates to the execution of operations beyond the buffer in memory. Exploiting this vulnerability could allow an attacker to influence the confidentiality and accessibility of the protected...

Security update for java-11-openjdk

This update for java-11-openjdk fixes the following issues: Updated to version 11.0.25+9 October 2024 CPU: CVE-2024-21208: Fixed partial DoS in component Networking bsc1231702 CVE-2024-21210: Fixed unauthorized read/write access to data in component Hotspot bsc1231711 CVE-2024-21217: Fixed partia...

Vulnerabilities fixed in Apple iOS and iPadOS

Apple has fixed vulnerabilities in iOS and iPadOS. A malicious party can exploit the vulnerabilities to carry out attacks that can lead to the following categories of damage: Denial-of-Service DoS. Access to sensitive data Access to system data Manipulation of data Circumvention of security measu...

Vulnerabilities fixed in Apple macOS

Apple has fixed vulnerabilities in macOS. A malicious party can exploit the vulnerabilities to carry out attacks that can lead to the following categories of damage: Denial-of-Service DoS. Access to sensitive data Access to system data Manipulation of data Circumvention of security measure Apple...

Vulnerabilities fixed in Mozilla Firefox and Thunderbird

Mozilla has fixed vulnerabilities in Firefox and Thunderbird. A malicious party can exploit the vulnerabilities to carry out attacks that can lead to the following categories of damage: Cross-Site-Scripting XSS. Denial-of-Service DoS. Access to sensitive data Mozilla has released updates to fix t...

CVE-2024-50334 Semicolon Path Injection on API /api;/config

Scoold is a Q&A and a knowledge sharing platform for teams. A semicolon path injection vulnerability was found on the /api;/config endpoint. By appending a semicolon in the URL, attackers can bypass authentication and gain unauthorised access to sensitive configuration data. Furthermore, PUT...

Researchers Uncover Vulnerabilities in Open-Source AI and ML Models

A little over three dozen security vulnerabilities have been disclosed in various open-source artificial intelligence AI and machine learning ML models, some of which could lead to remote code execution and information theft. The flaws, identified in tools like ChuanhuChatGPT, Lunary, and LocalAI...

PT-2024-9679 · Lunary · Lunary

Name of the Vulnerable Software and Affected Versions: lunary-ai/lunary version 1.3.2 Description: The issue is related to an Insecure Direct Object Reference IDOR vulnerability, which allows unauthorized access to external user data by manipulating the id parameter in the request URL. This can...