18630 matches found
PT-2024-22095 · Apple · Macos Sonoma +3
Name of the Vulnerable Software and Affected Versions: macOS Sonoma versions prior to 14.6 iOS versions prior to 17.6 iPadOS versions prior to 17.6 Description: A path handling issue was addressed with improved validation, which may allow an app to access protected user data. Recommendations: For...
Apple macOS 安全漏洞
Apple macOS is a suite of specialized operating systems developed by Apple Inc. for Mac computers. A security vulnerability exists in Apple macOS Monterey prior to version 12.7.6, which stems from a shortcut that may be able to use sensitive data without prompting the user through certain actions...
Apple iOS和Apple iPadOS 安全漏洞
Apple iOS and Apple iPadOS are products of Apple Inc. Apple iOS is an operating system developed for mobile devices, and Apple iPadOS is an operating system for iPad tablets. A security vulnerability exists in Apple iOS before version 16.7.9 and iPadOS before version 16.7.9, which stems from a...
CVE-2024-1798
The Tutor LMS – Migration Tool plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the tutorlpexportxml function in all versions up to, and including, 2.2.0. This makes it possible for unauthenticated attackers to export courses, including privat...
golang: archive/zip: Incorrect handling of certain ZIP files
A flaw was found in Golang. The ZIP implementation of the Go language archive/zip library behaves differently than the rest of the ZIP file format implementations. When handling ZIP files with a corrupted central directory record, the library skips over the invalid record and processes the next...
Apache StreamPark Insufficient Session Expiration Vulnerability
Apache StreamPark is the United States Apache Apache Foundation of a streaming media application development framework. Apache StreamPark versions prior to 2.1.4 suffer from a session expiration insufficiency vulnerability, which stems from the fact that the session is not expired after logging...
CVE-2024-36542
Kuma CVE-2024-36542 affects Kuma v2.7.0 (and prior per sources) with insecure permissions causing exposure of the service account token, enabling attackers to access sensitive data and escalate privileges. Root cause: improper access control granting token access. CVSSv3.1 base score 8.8 (HIGH), ...
Kuma 安全漏洞
Kuma is a modern Envoy-based service grid open-sourced by Kuma. It can be run on Kubernetes and VMs with single or multiple zones capacity on each cloud. A security vulnerability exists in Kuma v2.7.0 and prior versions that stems from the presence of insecure privileges that allow an attacker to...
CVE-2024-36542
Insecure permissions in kuma v2.7.0 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token...
CVE-2024-36542
Insecure permissions in kuma v2.7.0 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token...
The vulnerability of the templateadd.php file in the Tailoring Management System allows a malicious individual to execute arbitrary SQL code, gain unauthorized access to read, modify, or delete data, or cause service interruptions.
The vulnerability of the templateadd.php file in the Tailoring Management System relates to the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows an attacker who operates remotely to execute arbitrary SQL code, gain unauthorized access to read, modify, ...
Volcano has insecure permissions
Insecure permissions in volcano v1.8.2 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token...
CVE-2024-36535
Insecure permissions in meshery v0.7.51 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token...
CVE-2024-36536
Insecure permissions in fabedge v0.8.1 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token...
CVE-2024-36539
Insecure permissions in contour v1.28.3 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token...
CVE-2024-36540
Insecure permissions in external-secrets v0.9.16 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token...
Vulnerability found in Ivanti Endpoint Manager
Ivanti has fixed vulnerabilities in Ivanti Endpoint Manager. Vulnerabilities have been fixed in Ivanti Endpoint Manager. A malicious party can exploit the vulnerabilities to launch attacks that can lead to the following categories of damage: Remote code execution User rights Remote code execution...
Improper Authentication
org.apache.streampark, streampark is vulnerable to Improper Authentication. The vulnerability is due to improper session management allowing the "Authorization" credential to remain valid even after logout, enabling attackers to use this credential to initiate requests and potentially access data...
PT-2024-27056 · Fabedge · Fabedge
Name of the Vulnerable Software and Affected Versions: fabedge version 0.8.1 Description: The issue concerns insecure permissions in fabedge, allowing attackers to access sensitive data and escalate privileges by obtaining the service account's token. Recommendations: For fabedge version 0.8.1,...