Security update for libarchive

This update for libarchive fixes the following issues: CVE-2024-48957: Fixed out-of-bounds access in executefilteraudio in archivereadsupportformatrar.c bsc1231544. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper...

CVE-2024-20459

The CVE-2024-20459 entry applies to Cisco ATA 190 Multiplatform Series analog telephone adapters. The issue stems from a lack of input sanitization in the web-based management interface, enabling an authenticated, high-privilege attacker to execute arbitrary commands on the underlying OS as root ...

CVE-2024-22033 obs-service-download_url is vulnerable to argument injection

The OBS service obs-service-downloadurl was vulnerable to a command injection vulnerability. The attacker could provide a configuration to the service that allowed to execute command in later steps...

CVE-2024-22033

CVE-2024-22033 affects the OBS service obs-service-download_url. The flaw is a command injection vulnerability where a configuration passed to the service can lead to command execution in subsequent steps. Public references confirm this impact and the vulnerable component is the obs-service-downl...

CVE-2024-22033 obs-service-download_url is vulnerable to argument injection

The OBS service obs-service-downloadurl was vulnerable to a command injection vulnerability. The attacker could provide a configuration to the service that allowed to execute command in later steps...

CVE-2023-32193 Norman API Cross-site Scripting Vulnerability

A vulnerability has been identified in which unauthenticated cross-site scripting XSS in Norman's public API endpoint can be exploited. This can lead to an attacker exploiting the vulnerability to trigger JavaScript code and execute commands remotely...

openSUSE Leap 操作系统命令注入漏洞

openSUSE Leap is a new openSUSE build and a new hybrid Linux distribution from SUSE Germany. An operating system command injection vulnerability exists in openSUSE Leap that stems from the presence of command injection, where an attacker can provide configuration to a service to allow execution o...

CVE-2024-45274

An unauthenticated remote attacker can execute OS commands via UDP on the device due to missing authentication...

CVE-2024-9985 Ragic Enterprise Cloud Database - Arbitrary File Upload

Enterprise Cloud Database from Ragic does not properly validate the file type for uploads. Attackers with regular privileges can upload a webshell and use it to execute arbitrary code on the remote server...

Exploit for Code Injection in Vmware Spring_Cloud_Data_Flow

Detect vulnerabilities First, Use dnslog to detect whether CV...

VulnCheck KEV: CVE-2021-4443

The WordPress Mega Menu plugin for WordPress is vulnerable to Arbitrary File Creation in versions up to, and including, 2.0.6 via the compilersave AJAX action. This makes it possible for unauthenticated attackers to create arbitrary PHP files that can be used to execute malicious code...

CVE-2024-48781

The CVE-2024-48781 entry concerns Wanxing Technology Yitu Project Management Kirin Edition 2.3.6. A remote attacker can trigger arbitrary code execution by supplying a specially crafted file to /opt/EdrawProj-2/plugins/imageformat. The issue is described consistently across multiple sources (NVD/...

Malicious code in splunk-docs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis f3b4cb45a7c61ff4ef92918dc5438c1ae4845121a1c99903638fb56ffdbe8014 The OpenSSF Package Analysis project identified 'splunk-docs' @ 1.0.1 npm as malicious. It is considered malicious because: - The package...

Adobe Animate Memory Misreference Vulnerability (CNVD-2024-41261)

Adobe Animate is a set of Flash animation software from the American company Audobee Adobe. Adobe Animate suffers from a memory misreference vulnerability that can be exploited by an attacker to execute arbitrary code in the context of the current user...

CVE-2024-4131

A DLL hijack vulnerability was reported in Lenovo Emulator that could allow a local attacker to execute code with elevated privileges...

CVE-2024-4130

A DLL hijack vulnerability was reported in Lenovo App Store that could allow a local attacker to execute code with elevated privileges...

CVE-2024-4089

A DLL hijack vulnerability was reported in Lenovo Super File that could allow a local attacker to execute code with elevated privileges...

CVE-2024-33578

A DLL hijack vulnerability was reported in Lenovo Leyun that could allow a local attacker to execute code with elevated privileges...

CVE-2024-33581

A DLL hijack vulnerability was reported in Lenovo PC Manager AI intelligent scenario that could allow a local attacker to execute code with elevated privileges...

CVE-2024-33582

CVE-2024-33582 describes a DLL hijack vulnerability in Lenovo Service Framework that could allow a local attacker to execute code with elevated privileges. The available connected documents reiterate a local, privilege-escalation scenario but do not provide concrete exploitation details, affected...