PT-2024-13008 · Kiloview · P1/P2 +2

Name of the Vulnerable Software and Affected Versions: No specific software or versions mentioned. Description: The system is exposed to potential remote code execution risks due to inadequate input validation. Attackers can exploit this by appending shell commands to the Speed-Measurement featur...

PT-2024-33304 · Unknown · Llama Cpp Python +1

Name of the Vulnerable Software and Affected Versions: parisneo/lollms-webui version affected versions not specified Description: The issue arises from an insecure dependency on llama cpp python version llama cpp python-0.2.61+cpuavx2-cp311-cp311-manylinux 2 31 x86 64. The vulnerability is linked...

ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow related to the snippet feature.

...

The permission model protects itself against path traversal attacks by calling path.resolve() on any paths given by the user. If the path is to be treated as a Buffer the implementation uses Buffer.from() to obtain a Buffer from the result of path.resolve(). By monkey-patching Buffer internals namely Buffer.prototype.utf8Write the application can modify the result of path.resolve() which leads to a path traversal vulnerability. This vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21. Please note that at the time this CVE was issued the permission model is an experimental feature of Node.js.

...

Node.js depends on multiple built-in utility functions to normalize paths provided to node:fs functions which can be overwitten with user-defined implementations leading to filesystem permission model bypass through path traversal attack. This vulnerability affects all users using the experimental permission model in Node.js 20 and Node.js 21. Please note that at the time this CVE was issued the permission model is an experimental feature of Node.js.

...

PT-2024-34363 · Zenml Io · Zenml

Name of the Vulnerable Software and Affected Versions: zenml-io/zenml version 0.57.1 Description: A reflected Cross-Site Scripting XSS issue exists due to improper neutralization of input during web page generation, specifically within the redirect parameter. This allows an attacker to redirect...

GO-2024-2483 Grafana XSS via adding a link in General feature in github.com/grafana/grafana

Grafana XSS via adding a link in General feature in github.com/grafana/grafana...

virtio-net server QEMU Information Disclosure

The vulnerability of the virtio-net server QEMU interface is related to the TX cleanup function in the virtionetFlushTx function. This vulnerability occurs when the guest functions VIRTIONETFHASHREPORT, VIRTIOFVERSION1, and VIRTIONETFMRGRXBUF are enabled. Exploiting this vulnerability can allow a...

Jamf Compliance Editor Security Vulnerability

Jamf Compliance Editor is a tool from Jamf-Concepts Individual Developers that provides macOS, iOS/iPadOS system administrators with an easy way to establish and manage compliance baselines on their Apple device queues. A security vulnerability exists in versions of Jamf Compliance Editor prior t...

NLTK Security Vulnerabilities

NLTK is a natural language toolkit. It is used to support research and development in natural language processing. A security vulnerability exists in NLTK version 3.8.1 and prior versions, which stems from a vulnerability that could lead to remote code execution if the integrated packet download...

CVE-2024-38271

There exists a vulnerability in Quick Share/Nearby, where an attacker can force a victim to stay connected to a temporary hotspot created for the sharing. As part of the sequence of packets in a Quick Share connection over Bluetooth, the attacker forces the victim to connect to the attacker’s WiF...

PT-2024-28054

Name of the Vulnerable Software and Affected Versions ZenUML versions prior to 3.23.25 Description The comment feature in ZenUML diagram syntax is susceptible to Cross-site Scripting XSS due to the lack of sanitization of markdown text before rendering. This allows an attacker to enter a maliciou...

PT-2024-29207

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.43 Description The issue is related to the userfaultfd api function in the Linux kernel, which is associated with resource management errors. If a feature is not set in the Kernel config, the function fails...

Malicious code in Blockcоre.Featurеs.Airdrор (NuGet)

--- -= Per source details. Do not edit below this line.=-...

CVE-2024-4846: Authentication Bypass by Spoofing

Authentication bypass in the 2FA feature in Devolutions Server 2024.1.14.0 and earlier allows an authenticated attacker to authenticate to another user without being asked for the 2FA via another browser tab...

[SECURITY] [DSA 5715-2] composer regression update

------------------------------------------------------------------------- Debian Security Advisory DSA-5715-2 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff June 24, 2024 https://www.debian.org/security/faq -...

Incorrect Authorization

github.com/drakkan/sftpgo is vulnerable to Incorrect Authorization. The vulnerability is due to a lack of session invalidation when a user or admin changes their password, which allows an attacker to regain access to restricted accounts by resetting the accounts password. Note that this...

CVE-2024-38606 crypto: qat - validate slices count returned by FW

In the Linux kernel, the following vulnerability has been resolved: crypto: qat - validate slices count returned by FW The function adfsendadmintlstart enables the telemetry TL feature on a QAT device by sending the ICPQATFWTLSTART message to the firmware. This triggers the FW to start writing TL...

CVE-2024-0066

Johan Fagerström, member of the AXIS OS Bug Bounty Program, has found that a O3C feature may expose sensitive traffic between the client Axis device and O3C server. If O3C is not being used this flaw does not apply. Axis has released patched AXIS OS versions for the highlighted flaw. Please refer...

Adobe Experience Manager Input Validation Error Vulnerability (CNVD-2024-36369)

Adobe Experience Manager AEM is a set of content management solutions that can be used to build websites, mobile applications and forms from the American company Odobie Adobe. The program supports mobile content management, marketing and sales campaign management and multi-site management. A...