The vulnerability of the download_model_with_test_data() function in the software library for building deep learning neural networks, Open Neural Network Exchange (ONNX), allows a hacker to execute arbitrary code.

The vulnerability of the downloadmodelwithtestdata function in the software library for building deep learning neural networks, Open Neural Network Exchange ONNX, is related to an incorrect path name limitation for accessing restricted directories. Exploiting this vulnerability could allow a...

CVE-2024-36795

CVE-2024-36795 concerns insecure permissions in the Netgear WNR614 router firmware (version JNR1010V2/N300-V1.1.0.54_1.0.1). The issue allows attackers to access URLs and directories embedded within the firmware via unspecified vectors. The base CVSSv3.1 score is 4.0 (Medium) with local attack ve...

IBM System Storage DS8900F Security Vulnerability

The IBM System Storage DS8900F is one of the fastest, most reliable and secure storage systems from International Business Machines IBM. A security vulnerability exists in the IBM System Storage DS8900F that stems from a vulnerability that could allow a remote user to create an LDAP connection...

Path Traversal

twig/twig is vulnerable to Path Traversal. The vulnerability is caused by insufficient validation of user-supplied template names within the TwigLoaderFilesystem, allowing attackers to manipulate paths to access a file one level above the intended directory...

CVE-2024-4330 Path Traversal in parisneo/lollms-webui

A path traversal vulnerability was identified in the parisneo/lollms-webui repository, specifically within version 9.6. The vulnerability arises due to improper handling of user-supplied input in the 'listpersonalities' endpoint. By crafting a malicious HTTP request, an attacker can traverse the...

CVE-2024-5040 LCDS LAquis SCADA Path Traversal

There are multiple ways in LCDS LAquis SCADA for an attacker to access locations outside of their own directory...

CVE-2024-5040

CVE-2024-5040 maps to multiple path-traversal flaws in LCDS LAquis SCADA/LGX reporting components that validate user-supplied paths inadequately, allowing access to locations outside the target directory and, in several ZDI advisories, enabling remote code execution when a user opens malicious co...

Devolutions Server 安全漏洞

Devolutions Server is an application from Devolutions Canada Inc. It provides a full-featured shared account and password management solution. A security vulnerability exists in Devolutions Server version 2024.1.11.0 and earlier, which stems from the presence of incorrect input validation that...

CVE-2024-31226

Sunshine is a self-hosted game stream host for Moonlight. Users who ran Sunshine versions 0.17.0 through 0.22.2 as a service on Windows may be impacted when terminating the service if an attacked placed a file named C:\Program.exe, C:\Program.bat, or C:\Program.cmd on the user's computer. This...

CVE-2024-31226 Sunshine's unquoted executable path could lead to hijacked execution flow

Sunshine is a self-hosted game stream host for Moonlight. Users who ran Sunshine versions 0.17.0 through 0.22.2 as a service on Windows may be impacted when terminating the service if an attacked placed a file named C:\Program.exe, C:\Program.bat, or C:\Program.cmd on the user's computer. This...

CVE-2024-31226 Sunshine's unquoted executable path could lead to hijacked execution flow

Sunshine is a self-hosted game stream host for Moonlight. Users who ran Sunshine versions 0.17.0 through 0.22.2 as a service on Windows may be impacted when terminating the service if an attacked placed a file named C:\Program.exe, C:\Program.bat, or C:\Program.cmd on the user's computer. This...

CVE-2024-31226

Sunshine (Moonlight’s self-hosted game stream host) for Windows is affected in versions 0.17.0–0.22.2 when running as a service. An attacker could place a file named C:\Program.exe, C:\Program.bat, or C:\Program.cmd on the target machine and trigger hijacked execution flow during service terminat...

CVE-2024-3746 Measuresoft ScadaPro Improper Access Control

The entire parent directory - C:\ScadaPro and its sub-directories and files are configured by default to allow user, including unprivileged users, to write or overwrite files...

ALSA-2024:2571 Moderate: sssd security and bug fix update

The System Security Services Daemon SSSD service provides a set of daemons to manage access to remote directories and authentication mechanisms. It also provides the Name Service Switch NSS and the Pluggable Authentication Modules PAM interfaces toward the system, and a pluggable back-end system ...

The vulnerability of the LDAP protocol implementation in F5OS-A operating systems, hardware devices of the F5 rSeries, and F5OS-C application delivery controllers of F5 VELOS allows a hacker to circumvent security restrictions.

The vulnerability of the LDAP protocol implementation in F5OS-A operating systems, F5 rSeries hardware devices, and F5OS-C application delivery controllers for F5 VELOS operating systems is related to deficiencies in the authentication mechanism. Exploiting this vulnerability could allow attacker...

CVE-2024-29905 DIRAC: Unauthorized users can read proxy contents during generation

DIRAC is an interware, meaning a software framework for distributed computing. Prior to version 8.0.41, during the proxy generation process e.g., when using dirac-proxy-init, it is possible for unauthorized users on the same machine to gain read access to the proxy. This allows the user to then...

DIRAC: Unauthorized users can read proxy contents during generation

Impact During the proxy generation process e.g., when using dirac-proxy-init it is possible for unauthorized users on the same machine to gain read access to the proxy. This allows the user to then perform any action that is possible with the original proxy. This vulnerability only exists for a...

April 9, 2024—KB5036909 (OS Build 20348.2402)

None None...

Apache Zeppelin 输入验证错误漏洞

Apache Zeppelin is a Web-based open source laptop application from the Apache USA Foundation. The program supports interactive data analysis and collaborative documentation. Apache Zeppelin suffers from an input validation error vulnerability that can be exploited by an attacker to execute a...

PT-2024-23090 · Logpoint · Logpoint

Name of the Vulnerable Software and Affected Versions: Logpoint versions prior to 7.1.0 Description: The issue allows Self-XSS on the LDAP authentication page via the username to the LDAP login form. Recommendations: For versions prior to 7.1.0, update to version 7.1.0 or later to resolve the...