CVE-2024-38920

Open Robotics Robotic Operating System 2 ROS2 and Nav2 humble versions were discovered to contain a use-after-free via the nav2amcl process. This vulnerability is triggerd via remotely sending a request for change the value of dynamic-parameter/amcl maxbeams...

The vulnerability of the HMI interface configuration software Monitouch V-SFT lies in buffer overflows in dynamic memory, allowing an attacker to execute arbitrary code.

The vulnerability of the HMI interface configuration software Monitouch V-SFT is related to buffer overflow in dynamic memory. Exploiting this vulnerability allows an attacker to execute arbitrary code using specially created X1 files...

CVE-2024-45207

DLL injection in Veeam Agent for Windows can occur if the system's PATH variable includes insecure locations. When the agent runs, it searches these directories for necessary DLLs. If an attacker places a malicious DLL in one of these directories, the Veeam Agent might load it inadvertently,...

kernel: drm/amdgpu: change vm->task_info handling

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: change vm-taskinfo handling This patch changes the handling and lifecycle of vm-taskinfo object. The major changes are: - vm-taskinfo is a dynamically allocated ptr now, and its uasge is reference counted. - introduci...

Arbitrary File Upload

Overview matrix-synapse is an ecosystem for open federated Instant Messaging and VoIP. Affected versions of this package are vulnerable to Arbitrary File Upload due to the dynamicthumbnails option or processing a specially crafted request. An attacker can exploit this to execute arbitrary code or...

CVE-2024-53863

Synapse is an open-source Matrix homeserver. In Synapse versions before 1.120.1, enabling the dynamicthumbnails option or processing a specially crafted request could trigger the decoding and thumbnail generation of uncommon image formats, potentially invoking external tools like Ghostscript for...

DEBIAN-CVE-2024-53863

Synapse is an open-source Matrix homeserver. In Synapse versions before 1.120.1, enabling the dynamicthumbnails option or processing a specially crafted request could trigger the decoding and thumbnail generation of uncommon image formats, potentially invoking external tools like Ghostscript for...

UBUNTU-CVE-2024-53863

Synapse is an open-source Matrix homeserver. In Synapse versions before 1.120.1, enabling the dynamicthumbnails option or processing a specially crafted request could trigger the decoding and thumbnail generation of uncommon image formats, potentially invoking external tools like Ghostscript for...

CVE-2024-53863 Synapse can be forced to thumbnail unexpected file formats, invoking external, potentially untrustworthy decoders

Synapse is an open-source Matrix homeserver. In Synapse versions before 1.120.1, enabling the dynamicthumbnails option or processing a specially crafted request could trigger the decoding and thumbnail generation of uncommon image formats, potentially invoking external tools like Ghostscript for...

CVE-2024-53999 Mobile Security Framework (MobSF) Stored Cross-Site Scripting Vulnerability in "Diff or Compare" Functionality

Mobile Security Framework MobSF is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. The application allows users to upload files with scripts in the filename parameter. As a result, a malicious user can upload a script file to th...

Element Synapse 安全漏洞

Element Synapse is an open source Matrix Home Server implementation from Element Open Source. A security vulnerability exists in Element Synapse, which stems from the fact that enabling the dynamicthumbnails option or processing ad-hoc requests may trigger decoding and thumbnail generation for...

ROS-20241203-06

Vulnerability of coretable/dynamic module of Moodle virtual learning environment is related to access control flaws in access control. Exploitation of the vulnerability could allow an attacker acting remotely, gain unauthorized access to protected information...

CVE-2024-52494

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Matt Varone, Tim Berneman Dynamic "To Top" allows Stored XSS.This issue affects Dynamic "To Top": from 3.5.2 through n/a...

CVE-2024-52494 WordPress Dynamic To Top plugin <= 3.5.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Matt Varone, Tim Berneman Dynamic "To Top" allows Stored XSS.This issue affects Dynamic "To Top": from 3.5.2 through n/a...

PT-2024-9678 · Sap · Sap Netweaver Application Server Abap

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver Application Server ABAP affected versions not specified Description: The issue allows an authenticated attacker to craft a Remote Function Call RFC request to restricted destinations, potentially exposing credentials for a remot...

The vulnerability of the GENESIS64 SCADA system lies in the software packages for monitoring and data collection by MC Works64. This vulnerability allows a intruder to execute arbitrary code.

The vulnerability of the GENESIS64 SCADA system’s software packages for monitoring and data collection, provided by MC Works64, is related to an uncontrolled element in the search process. Exploiting this vulnerability could allow a perpetrator to execute arbitrary code by introducing a specially...

WordPress plugin Dynamic To Top 跨站脚本漏洞

WordPress and the WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blogs on PHP and MySQL servers, and the WordPress plugin is ...

PT-2024-35963

Name of the Vulnerable Software and Affected Versions: zhmcclient versions prior to 1.18.1 Description: The Python package "zhmcclient" writes password-like properties in clear text into its HMC and API logs in several cases, including when creating or updating a partition in DPM mode, updating a...

The vulnerability of the core_table/dynamic module in the virtual learning environment Moodle allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the coretable/dynamic module in the virtual learning environment Moodle is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

PT-2024-8959

Name of the Vulnerable Software and Affected Versions Mitsubishi Electric FA Connector SCADA-system GENESIS64 versions 10.97.2 through 10.97.3 ICONICS GENESIS64 versions 10.97.2 through 10.97.3 Description The issue is related to the presence of dead code in the GENESIS64 system, which can be...