PT-2024-31572 · Unknown +6 · App::Cpanminus +6

Name of the Vulnerable Software and Affected Versions: App::cpanminus versions 1.7047 and earlier Description: The App::cpanminus package for Perl downloads code via insecure HTTP, enabling code execution for network attackers. This issue allows attackers to intercept traffic. Recommendations: Fo...

PT-2024-5977 · Microsoft · Edge

Name of the Vulnerable Software and Affected Versions: Microsoft Edge Chromium-based versions up to 128.0.2739.41 Description: The vulnerability in Microsoft Edge Chromium-based is related to insufficient input validation. Exploitation of this issue may allow an attacker to execute arbitrary code...

The vulnerability of the “file” parameter in the netshop CMS system’s Netcat module allows a hacker to execute arbitrary JavaScript code.

The vulnerability of the “file” parameter in the netshop CMS system’s Netcat module exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to execute any arbitrary JavaScript code in the user’s browser remotely...

Adobe InDesign Out-of-Bounds Write Vulnerability (CNVD-2024-36306)

Adobe InDesign is a set of layout and editing applications from the American company Audobee Adobe. Adobe InDesign suffers from an out-of-bounds write vulnerability that can be exploited by an attacker to execute arbitrary code on the system or cause the application to crash...

mozilla: Type confusion in WebAssembly

The Mozilla Foundation Security Advisory describes this flaw as: A type confusion bug in WebAssembly could be leveraged by an attacker to potentially achieve code execution...

PT-2024-38399 · Trimble · Trimble Sketchup Pro

Name of the Vulnerable Software and Affected Versions: Trimble SketchUp Pro affected versions not specified Description: This issue allows remote attackers to disclose sensitive information on affected installations of Trimble SketchUp Pro. User interaction is required to exploit this, where the...

OESA-2024-1856 httpd security update

Apache HTTP Server is a powerful and flexible HTTP/1.1 compliant web server. Security Fixes: Substitution encoding issue in modrewrite in Apache HTTP Server 2.4.59 and earlier allows attacker to execute scripts in directories permitted by the configuration but not directly reachable by any URL or...

OESA-2024-1830 httpd security update

Apache HTTP Server is a powerful and flexible HTTP/1.1 compliant web server. Security Fixes: Improper escaping of output in modrewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to map URLs to filesystem locations that are permitted to be served by the server but are not...

Mozilla Firefox and Thunderbird Code Execution Vulnerability (CNVD-2024-36724)

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the U.S. Mozilla Thunderbird is a set of e-mail client software separate from the Mozilla Application Suite. Mozilla Firefox and Thunderbird suffer from a code execution vulnerability caused by a memory security flaw in...

CVE-2024-5681

CWE-20: Improper Input Validation vulnerability exists that could cause local denial-of-service, privilege escalation, and potentially kernel execution when a malicious actor with local user access crafts a script/program using an IOCTL call in the Foxboro.sys driver...

EUVD-2024-47434

The IMGspider plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'uploadimgfile' function in all versions up to, and including, 2.3.10. This makes it possible for authenticated attackers, with contributor-level and above permissions, to upload...

SUSE CVE-2023-24531

Command go env is documented as outputting a shell script containing the Go environment. However, go env doesn't sanitize values, so executing its output as a shell script can cause various bad bahaviors, including executing arbitrary commands or inserting new environment variables. This issue is...

PT-2024-28308 · Airvertco · Airvertco Frappejs

Name of the Vulnerable Software and Affected Versions: airvertco frappejs version 0.0.11 Description: The issue is related to a prototype pollution vulnerability via the registerView function. This allows attackers to execute arbitrary code or cause a Denial of Service DoS by injecting arbitrary...

CVE-2024-5431

The WPCafe – Online Food Ordering, Restaurant Menu, Delivery, and Reservations for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.2.25 via the reservationextrafield shortcode parameter. This makes it possible for authenticated...

CVE-2024-5431

The WPCafe – Online Food Ordering, Restaurant Menu, Delivery, and Reservations for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.2.25 via the reservationextrafield shortcode parameter. This makes it possible for authenticated...

MGASA-2024-0234 Updated python-werkzeug packages fix security vulnerability

Werkzeug is a comprehensive WSGI web application library. The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a domain and subdomain they control, an...

TOTOLINK A3700R setWiFiEasyGuestCfg Function Buffer Overflow Vulnerability

The TOTOLINK A3700R is a wireless router from China's Gion Electronics TOTOLINK. The TOTOLINK A3700R suffers from a buffer overflow vulnerability that originates from ssid5g failing to properly validate the length and size of input data in the setWiFiEasyGuestCfg function, which can be exploited ...

PT-2024-36821 · WordPress · Universal Slider

Name of the Vulnerable Software and Affected Versions: Universal Slider plugin for WordPress versions up to, and including, 1.6.5 Description: The issue allows authenticated attackers with Contributor-level access and above to inject a PHP Object via deserialization of untrusted input in the fsl...

PT-2024-27767 · Unknown · Dolibarr Erp/Crm

Name of the Vulnerable Software and Affected Versions: Dolibarr ERP CRM versions up to 19.0.1 Description: The issue concerns an arbitrary file upload vulnerability in the Upload Template function. This vulnerability allows attackers to execute arbitrary code by uploading a crafted .SQL file...

Dell BIOS Input Validation Error Vulnerability (CNVD-2024-29341)

Dell BIOS is embedded software on a small memory chip on the motherboard of a computer from Dell USA. The Dell BIOS suffers from an input validation error vulnerability that stems from improper input validation in an externally-developed component, which could be exploited by an attacker to cause...