Apache Roller input validation vulnerability

Apache Roller is the United States Apache Apache Foundation of a Java-based multi-user open source blogging system. Apache Roller suffers from a cross-site scripting vulnerability that can be exploited by an attacker to obtain cookie-based authentication credentials...

kernel: net: amd-xgbe: Fix skb data length underflow

In the Linux kernel, the following vulnerability has been resolved: net: amd-xgbe: Fix skb data length underflow There will be BUGON triggered in include/linux/skbuff.h leading to intermittent kernel panic, when the skb length underflow is detected. Fix this by dropping the packet if such length...

CVE-2024-6553

The WP Meteor Website Speed Optimization Addon plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.4.3.This is due to the plugin utilizing wpdesk and leaving test files with displayerrors on. This makes it possible for unauthenticated attackers to...

ROS-20240723-05

A vulnerability in the Core component of the Oracle VM VirtualBox virtualization software tool is related to an insecure privilege management vulnerability. insecure privilege management. Exploitation of the vulnerability could allow an attacker to escalate their privileges A vulnerability in the...

Zoom Video Conferencing Race Situation DoS

The vulnerability of Zoom’s video conferencing software is related to synchronization errors when using a shared resource “Race Situation”. Exploiting this vulnerability can allow an attacker to cause service failures...

Zoom Video Conferencing Privilege Escalation

The vulnerability of Zoom’s video conferencing software is related to synchronization errors when using a shared resource “Race Situation”. Exploiting this vulnerability can allow attackers to gain increased privileges...

Team Chat Component Disclosure

The vulnerability of the Team Chat component in Zoom’s video conferencing software is related to synchronization errors when using a shared resource. Exploiting this vulnerability can allow an attacker who operates remotely to disclose sensitive information...

IBM QRadar Suite Security Analytics Platform Information Disclosure

The vulnerabilities of event monitoring platforms, threat detection systems, security analytics in the IBM QRadar Suite, and IBM Cloud Pak for Security related to security configuration errors can be exploited by attackers operating remotely. This allows them to gain access to confidential...

CWA 2405: Application launch fails after upgrading to CWA 2405

After upgrading CWA to 2405 app launch may fail with "Internal error" or "Connection Timeout". The issue is seen more frequently while trying to launch multiple applications at the same time. The ICA file gets downloaded but after sometime, "Connection timeout" error is seen. Sometimes, the first...

Juniper Networks Junos OS DoS

The vulnerability of the Packet Forwarding Engine PFE mechanism in Juniper Networks’ Junos OS on ACX5448 and ACX710 series devices is related to synchronization errors. Exploiting this vulnerability can allow a malicious actor to cause service failures...

GPU driver Code Execution

The vulnerability of the GPU driver for Mali-based processors based on Arm, Bifrost, and Valhall is related to synchronization errors when using shared resources. Exploiting this vulnerability allows an attacker to execute arbitrary code...

GraphWorX64 Module Code Execution

The vulnerability of the GraphWorX64 module in the GENESIS64 SCADA system is related to errors in the code. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

MasterSCADA 4D DoS

The vulnerability of the SCADA system MasterSCADA 4D is related to errors in processing input data. Exploiting this vulnerability can allow a malicious actor to cause service interruptions...

SINEMA Remote Connect Client Remote Access

The vulnerability of the SINEMA Remote Connect client web interface is related to security mechanism errors. Exploiting this vulnerability allows a malicious actor to view and edit protected configuration information about device settings without proper access rights...

SUSE-SU-2024:2574-1 Security update for nodejs20

This update for nodejs20 fixes the following issues: Update to 20.15.1: - CVE-2024-36138: Fixed CVE-2024-27980 fix bypass bsc1227560 - CVE-2024-22020: Fixed a bypass of network import restriction via data URL bsc1227554 - CVE-2024-22018: Fixed fs.lstat bypasses permission model bsc1227562 -...

Oracle MySQL Server DoS

Vulnerability of the Server component: The DDL system for managing databases, Oracle MySQL Server, is vulnerable to authentication errors. Exploiting this vulnerability can allow a malicious actor to cause service interruptions...

PowerScale OneFS Privilege Escalation

The vulnerability of the PowerScale OneFS operating system is related to access control errors. Exploiting this vulnerability can allow an attacker to increase their privileges...

QlikView Code Execution

The vulnerability of the QlikView analytical platform is related to synchronization errors when using a common resource. Exploiting this vulnerability can allow an attacker to execute arbitrary code within the context of the Windows administrator...

OWA not accessible on Secure Web iOS when Extended Protection is Enabled

After enabling Extended Protection on Exchange Server 2019 CU14, accessing OWA via Secure Web iOS is no longer possible. Users accessing Outlook Web Access OWA through Secure Web on iOS are continuously getting http 401 login prompt. The issue is not seen when using other browsers like Chrome or...

Screenshots Component Disclosure

The vulnerability of the Screenshots component in iPadOS and iOS operating systems is related to security configuration errors. Exploiting this vulnerability can allow attackers to disclose sensitive information that should be protected...