Denial of Service Vulnerability in Multiple Advantech Products

The Advantech WISE-4010LAN, WISE-4050LAN, and WISE-4060LAN are all industrial automation controllers from Advantech of Taiwan, China. A denial of service vulnerability exists in multiple Advantech products, which can be exploited by attackers to cause a denial of service...

CVE-2024-43797

audiobookshelf is a self-hosted audiobook and podcast server. A non-admin user is not allowed to create libraries or access only the ones they have permission to. However, the LibraryController is missing the check for admin user and thus allows a path traversal issue. Allowing non-admin users to...

CVE-2022-41600

The phones have the heap overflow, out-of-bounds read, and null pointer vulnerabilities in the fingerprint trusted application TA.Successful exploitation of this vulnerability may affect the fingerprint service...

CVE-2012-4926

approve.php in Img Pals Photo Host 1.0 does not authenticate requests, which allows remote attackers to change the activation of administrators via the u parameter in an 1 app0 disable or 2 app1 enable action...

Linux Distros Unpatched Vulnerability : CVE-2024-50268

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: usb: typec: fix potential out of bounds in ucsiccgupdatesetnewcamcmd The cmd variable can be...

CVE-2023-43842

Incorrect access control in the account management function of web interface in Aten PE6208 2.3.228 and 2.4.232 allows remote authenticated users to alter user and administrator accounts credentials via HTTP POST request...

CVE-2023-34149

Allocation of Resources Without Limits or Throttling vulnerability in Apache Software Foundation Apache Struts.This issue affects Apache Struts: through 2.5.30, through 6.1.2. Upgrade to Struts 2.5.31 or 6.1.2.1 or greater...

CVE-2024-57952 Revert "libfs: fix infinite directory reads for offset dir"

In the Linux kernel, the following vulnerability has been resolved: Revert "libfs: fix infinite directory reads for offset dir" The current directory offset allocator based on mtreealloccyclic stores the next offset value to return in octx-nextoffset. This mechanism typically returns values that...

CVE-2024-30510

Unrestricted Upload of File with Dangerous Type vulnerability in Salon Booking System Salon booking system.This issue affects Salon booking system: from n/a through 9.5...

RHEL 7 : tuned (RHSA-2025:0881)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:0881 advisory. The tuned packages provide a service that tunes system settings according to a selected profile. Security Fixes: tuned: improper sanitization of...

The vulnerability of the uof_get_name() function in the QAT_4xxx driver (driver/crypto/intel/qat/qat_4xxx/adf_4xxx_hw_data.c) on Linux operating systems allows a malicious individual to gain unauthorized access to protected information.

The vulnerability of the uofgetname function in the QAT4xxx driver driver/crypto/intel/qat/qat4xxx/adf4xxxhwdata.c on Linux operating systems is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability could allow an attacker to gain unauthorized access t...

CVE-2024-51540

creationtimestamp| type| source ---|---|--- 2024-12-26 15:57:53+00:00| seen| https://infosec.exchange/users/cve/statuses/113719946286593124 2024-12-26 18:14:42+00:00| seen| https://t.me/cvedetector/13684...

DEBIAN-CVE-2024-53162

In the Linux kernel, the following vulnerability has been resolved: crypto: qat/qat4xxx - fix off by one in uofgetname The fwobjs array has "numobjs" elements so the needs to be = to prevent an out of bounds read...

CVE-2024-53143 fsnotify: Fix ordering of iput() and watched_objects decrement

In the Linux kernel, the following vulnerability has been resolved: fsnotify: Fix ordering of iput and watchedobjects decrement Ensure the superblock is kept alive until we're done with iput. Holding a reference to an inode is not allowed unless we ensure the superblock stays alive, which fsnotif...

DEBIAN-CVE-2024-34161

When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module and the network infrastructure supports a Maximum Transmission Unit MTU of 4096 or greater without fragmentation, undisclosed QUIC packets can cause NGINX worker processes to leak previously freed memory...

ALPINE-CVE-2024-34161

When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module and the network infrastructure supports a Maximum Transmission Unit MTU of 4096 or greater without fragmentation, undisclosed QUIC packets can cause NGINX worker processes to leak previously freed memory...

CVE-2023-31634

In TeslaMate before 1.27.2, there is unauthorized access to port 4000 for remote viewing and operation of user data. After accessing the IP address for the TeslaMate instance, an attacker can switch the port to 3000 to enter Grafana for remote operations. At that time, the default username and...

The vulnerability of the web-based service for microprogramming software controlling switches of the EDS-4000/G4000 series allows a hacker to send requests to a vulnerable device and act on its behalf for other network devices.

The vulnerability of the web-based service for microprogrammed software-controlled switches of the EDS-4000/G4000 series lies in the ability to bypass access control mechanisms. Exploiting this vulnerability allows a malicious actor to send requests to the vulnerable device and act on its behalf...

CVE-2024-0387

The EDS-4000/G4000 Series prior to version 3.2 includes IP forwarding capabilities that users cannot deactivate. An attacker may be able to send requests to the product and have it forwarded to the target. An attacker can bypass access controls or hide the source of malicious requests...

MOXA EDS-4000/G4000 Series 安全漏洞

MOXA EDS-4000/G4000 Series is a series of industrial managed Ethernet switches from MOXA, China. A security bypass vulnerability exists in MOXA EDS-4000/G4000 Series prior to version 3.2, which originates from a user-deactivatable IP forwarding feature, and can be exploited by an attacker to bypa...