CVE-2024-39027

SeaCMS v12.9 has an unauthorized SQL injection vulnerability. The vulnerability is caused by the SQL injection through the cid parameter at /js/player/dmplayer/dmku/index.php?ac=edit, which can cause sensitive database information to be leaked...

CVE-2024-4836

Web services managed by Edito CMS Content Management System in versions from 3.5 through 3.25 leak sensitive data as they allow downloading configuration files by an unauthenticated user. The issue in versions 3.5 - 3.25 was removed in releases which dates from 10th of January 2014. Higher versio...

CVE-2024-32852

CVE-2024-32852 (Dell PowerScale OneFS) affects PowerScale OneFS versions 8.2.2.x through 9.7.0.0, where a broken or risky cryptographic algorithm is used. An unprivileged network attacker could potentially exploit this to cause data leaks. Connected documents (DSA-2024-255, Nessus plugin 277546) ...

Use After Free

@fastly/js-compute is vulnerable to Use After Free. The vulnerability is due to re-use of previously freed memory in the FetchEvent.client and certain CacheEntry.prototype and Device.lookup functions. This issue could allow for an unintended data leak and often results in a Compute service crash...

GHSA-MP3G-VPM9-9VQV @fastly/js-compute has a use-after-free in some host call implementations

Impact The implementation of the following functions were determined to include a use-after-free bug: FetchEvent.client.tlsCipherOpensslName FetchEvent.client.tlsProtocol FetchEvent.client.tlsClientCertificate FetchEvent.client.tlsJA3MD5 FetchEvent.client.tlsClientHello...

@fastly/js-compute has a use-after-free in some host call implementations

Impact The implementation of the following functions were determined to include a use-after-free bug: FetchEvent.client.tlsCipherOpensslName FetchEvent.client.tlsProtocol FetchEvent.client.tlsClientCertificate FetchEvent.client.tlsJA3MD5 FetchEvent.client.tlsClientHello...

CVE-2024-23153

CVE-2024-23153 affects Autodesk AutoCAD; the vulnerability arises when parsing a malicious MODEL file in libodx.dll, causing an Out-of-Bounds Read that can crash the process, read data, or allow arbitrary code execution. Connected sources confirm the issue relates to libodx.dll parsing of MODEL f...

CVE-2024-23149

CVE-2024-23149 affects Autodesk AutoCAD and involves parsing malicious SLDDRW files in the ODXSW_DLL.dll library. The vulnerability causes an Out-of-Bounds Read, leading to a crash, potential data exposure, or arbitrary code execution in the current process. Public details indicate the issue stem...

PT-2024-27711 · Shenzhen Weitillage Industrial Co. · Access Management Specialist

Name of the Vulnerable Software and Affected Versions: Shenzhen Weitillage Industrial Co., Ltd access management specialist version V6.62.51215 Description: An issue in the access management specialist allows a remote attacker to obtain sensitive information. Recommendations: For version...

UK Health Club Chain ‘Total Fitness’ Data Leak Exposes KYC and Card Data

UK-based health and fitness chain Total Fitness suffered a significant data breach leaving member photos, names, and even bank details vulnerable online. Learn how to protect yourself and what went wrong at Total Fitness...

Mozilla: Cross-Origin Image leak via Offscreen Canvas

The Mozilla Foundation Security Advisory describes this flaw as: Offscreen Canvas did not properly track cross-origin tainting, which could be used to access image data from another site in violation of same-origin policy...

Monbela Tourist Inn Online Reservation System SQL注入漏洞

Monbela Tourist Inn Online Reservation System is itsourcecode open source an online reservation system for tourists and hotels developed using PHP for storing and retrieving data or any transactions carried out. itsourcecode Monbela Tourist Inn Online Reservation System login.php SQL injection...

BlackSuit Ransomware Leaks Kansas City Police Data in Failed Ransom Plot

BlackSuit Ransomware, known as the rebrand of the Conti ransomware gang, has leaked a trove of Kansas City Police data, including evidence records, investigation files, crime scene phones, and much more, after the department refused to pay the ransom...

openSUSE Security Advisory (SUSE-SU-2024:2029-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE SLES15 / openSUSE 15 Security Update : python-scikit-learn (SUSE-SU-2024:2029-1)

The remote SUSE Linux SLES15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2024:2029-1 advisory. -CVE-2024-5206: Fixed a possible sensitive data leak in TfidfVectorizer. bsc1226185 Tenable has extracted the preceding description block...

CVE-2024-37307

Summary: CVE-2024-37307 affects Cilium’s cilium-bugtool when run with --envoy-dump against deployments with Envoy enabled. Affected versions: prior to 1.13.7, 1.14.12, and 1.15.6 (i.e., versions 1.13.0–1.13.6, 1.14.0–1.14.11, 1.15.0–1.15.5). Root cause/impact: the tool’s output could contain sens...

CVE-2024-29181 @strapi/plugin-content-manager leaks data via relations via the Admin Panel

Strapi is an open-source content management system. Prior to version 4.19.1, a super admin can create a collection where an item in the collection has an association to another collection. When this happens, another user with Author Role can see the list of associated items they did not create...

CVE-2024-29181 @strapi/plugin-content-manager leaks data via relations via the Admin Panel

Strapi is an open-source content management system. Prior to version 4.19.1, a super admin can create a collection where an item in the collection has an association to another collection. When this happens, another user with Author Role can see the list of associated items they did not create...

PT-2024-14531 · Advantech · Advantech Iview

Name of the Vulnerable Software and Affected Versions: Advantech iView affected versions not specified Description: This issue allows remote attackers to disclose sensitive information on affected installations of Advantech iView. Authentication is not required to exploit this issue. The specific...

Amazon Linux 2 : opensc (ALAS-2024-2566)

The version of opensc installed on the remote host is prior to 0.19.0-6. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2024-2566 advisory. A vulnerability was found in OpenSC where PKCS1 encryption padding removal is not implemented as side- channel resistant. This issu...