PT-2024-2318 · Tenda · Tenda Ac18

Name of the Vulnerable Software and Affected Versions: Tenda AC18 version 15.03.05.05 Description: A critical issue affects the formexeCommand function of the file /goform/execCommand. The manipulation of the cmdinput argument leads to a stack-based buffer overflow. This issue can be exploited...

The vulnerability of the Microsoft .NET software platform, related to pointer swapping errors, allows a perpetrator to cause a service failure.

The vulnerability of the Microsoft .NET software platform is related to pointer dereferencing errors. Exploiting this vulnerability could allow a remote attacker to cause service interruptions...

AZL-35431 CVE-2024-20328 affecting package clamav for versions less than 1.0.6-1

A vulnerability in the VirusEvent feature of ClamAV could allow a local attacker to inject arbitrary commands with the privileges of the application service account.The vulnerability is due to unsafe handling of file names. A local attacker could exploit this vulnerability by supplying a file nam...

CVE-2023-38366

IBM Filenet Content Manager Component 5.5.8.0, 5.5.10.0, and 5.5.11.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system. IBM X-Force ID: 261115...

CVE-2023-38366: Improper Limitation of a Pathname to a Restricted Directory

IBM Filenet Content Manager Component 5.5.8.0, 5.5.10.0, and 5.5.11.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system. IBM X-Force ID: 261115...

CVE-2024-1970

A vulnerability, which was classified as problematic, was found in SourceCodester Online Learning System V2 1.0. Affected is an unknown function of the file /index.php. The manipulation of the argument page leads to cross site scripting. It is possible to launch the attack remotely. The exploit h...

PT-2024-21394 · Unknown · Socialmediawebsite

Name of the Vulnerable Software and Affected Versions: SocialMediaWebsite version 1.0.1 Description: A reflected cross-site scripting XSS issue allows attackers to inject malicious JavaScript into a victim's web browser via the poll parameter in "poll.php". Recommendations: For SocialMediaWebsite...

SUSE CVE-2023-52444

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid dirent corruption As Al reported in link1: f2fsrename ... if olddir != newdir && !whiteout f2fssetlinkoldinode, olddirentry, olddirpage, newdir; else f2fsputpageolddirpage, 0; You want correct inumber in the "....

DEBIAN-CVE-2023-52444

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid dirent corruption As Al reported in link1: f2fsrename ... if olddir != newdir && !whiteout f2fssetlinkoldinode, olddirentry, olddirpage, newdir; else f2fsputpageolddirpage, 0; You want correct inumber in the "....

UBUNTU-CVE-2023-52444

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid dirent corruption As Al reported in link1: f2fsrename ... if olddir != newdir && !whiteout f2fssetlinkoldinode, olddirentry, olddirpage, newdir; else f2fsputpageolddirpage, 0; You want correct inumber in the "....

dotnet: Denial of Service in SignalR server

A denial of service vulnerability is present in the .NET applications utilizing SignalR, which a malicious client can exploit. The issue arises from inadequate validation of user-supplied input in .NET. This flaw allows a remote attacker to trigger a denial of service DoS attack by providing...

The vulnerability of the dot-diver library lies in the uncontrolled modification of object prototype attributes, allowing attackers to execute arbitrary code.

The vulnerability of the dot-diver library is related to uncontrolled changes to the attributes of the object’s prototype. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

February 13, 2024-KB5034682 Cumulative Update for .NET Framework 3.5, 4.8 and 4.8.1 for Windows Server 2022

None None...

CVE-2023-6557

The The Events Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.2.8.2 via the route function hooked into wpajaxnoprivtribedropdown. This makes it possible for unauthenticated attackers to extract potentially sensitive data...

IBM QRadar SOAR Plug-in 路径遍历漏洞

The IBM SOAR QRadar Plugin is a tool from International Business Machines IBM used to provide bi-directional messaging between IBM Security QRadar SIEM and QRadar SOAR. The IBM SOAR QRadar Plugin App suffers from a directory traversal vulnerability that could be exploited by an attacker to send a...

ASB-A-300741186

In removePersistentDot of SystemStatusAnimationSchedulerImpl.kt, there is a possible race condition due to a logic error in the code. This could lead to local escalation of privilege that fails to remove the persistent dot with no additional execution privileges needed. User interaction is not...

The vulnerability of the Microsoft Identity library on the Microsoft .NET software platform allows a perpetrator to cause a service failure.

The vulnerability of the Microsoft Identity library in the .net software platform is related to improper cleaning or release of resources. Exploiting this vulnerability can allow a malicious actor to cause service failures...

PT-2024-1499

Name of the Vulnerable Software and Affected Versions Apache Superset versions prior to 3.0.3 Description A stored cross-site scripting XSS vulnerability exists in Apache Superset. An authenticated attacker with create/update permissions on charts or dashboards could store a script or add a...

GitPython: Blind local file inclusion

A path traversal vulnerability was found in GitPython due to an input validation error when reading from the ".git" directory. This issue may allow a remote attacker to prepare a specially crafted ".git" file with directory traversal characters in file names and force the application to read thes...

node-server path traversal vulnerability

node-server is an adapter that allows users to run Hono applications on Node.js. A path traversal vulnerability exists in node-server version 1.3.0 through versions prior to 1.4.1, which stems from an inability to resolve double dots in a URL...