7582 matches found
CVE-2020-1720
creationtimestamp| type| source ---|---|--- 2024-05-25 03:01:26+00:00| seen| https://t.me/CyberSecurityTechnologies/633...
OESA-2024-1626 kubernetes security update
Container cluster management. Security Fixes: A security issue was discovered in Kubernetes where users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using containers, init containers, and ephemeral containers with t...
PT-2024-40438 · Unknown · Htmleditorfield Toolbar
Name of the Vulnerable Software and Affected Versions: HtmlEditorField Toolbar affected versions not specified Description: The issue concerns the "Add from URL" functionality, which does not properly sanitize URLs on the server side. Specifically, the HtmlEditorField Toolbar action viewfile is...
Refs and paths with reserved Windows device names access the devices
Summary On Windows, fetching refs that clash with legacy device names reads from the devices, and checking out paths that clash with such names writes arbitrary data to the devices. This allows a repository, when cloned, to cause indefinite blocking or the production of arbitrary message that...
PT-2024-26345
Name of the Vulnerable Software and Affected Versions Download Plugins and Themes from Dashboard versions prior to 1.8.6 Description A path traversal issue exists, allowing a remote authenticated attacker with switch themes privilege to obtain arbitrary files on the server if exploited...
CVE-2024-35162: Improper Limitation of a Pathname to a Restricted Directory
Path traversal vulnerability exists in Download Plugins and Themes from Dashboard versions prior to 1.8.6. If this vulnerability is exploited, a remote authenticated attacker with "switchthemes" privilege may obtain arbitrary files on the server...
PT-2024-4191 · Gitoxide · Gitoxide
Name of the Vulnerable Software and Affected Versions: gitoxide affected versions not specified Description: The issue is related to how gitoxide handles legacy device names on Windows. When fetching refs or checking out paths that clash with these names, it can read from or write to devices,...
CVE-2024-36052
RARLAB WinRAR before 7.00, on Windows, allows attackers to spoof the screen output via ANSI escape sequences, a different issue than CVE-2024-33899...
SUSE CVE-2024-35873
In the Linux kernel, the following vulnerability has been resolved: riscv: Fix vector state restore in rtsigreturn The RISC-V Vector specification states in "Appendix D: Calling Convention for Vector State" 1 that "Executing a system call causes all caller-saved vector registers v0-v31, vl, vtype...
SUSE CVE-2024-35962
In the Linux kernel, the following vulnerability has been resolved: netfilter: complete validation of user input In my recent commit, I missed that doreplace handlers use copyfromsockptr which I fixed, followed by unsafe copyfromsockptroffset calls. In all functions, we can perform the @optlen...
UBUNTU-CVE-2024-35962
In the Linux kernel, the following vulnerability has been resolved: netfilter: complete validation of user input In my recent commit, I missed that doreplace handlers use copyfromsockptr which I fixed, followed by unsafe copyfromsockptroffset calls. In all functions, we can perform the @optlen...
DEBIAN-CVE-2024-35873
In the Linux kernel, the following vulnerability has been resolved: riscv: Fix vector state restore in rtsigreturn The RISC-V Vector specification states in "Appendix D: Calling Convention for Vector State" 1 that "Executing a system call causes all caller-saved vector registers v0-v31, vl, vtype...
Simple Inventory System SQL注入漏洞
Simple Inventory System is a simple inventory system by argie individual developer. SourceCodester Simple Inventory System version 1.0 suffers from a SQL injection vulnerability that stems from the from/to parameter in the file tableedit.php that can lead to SQL injection...
CVE-2024-5100: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in SourceCodester Simple Inventory System 1.0. It has been classified as critical. This affects an unknown part of the file tableedit.php. The manipulation of the argument from/to leads to sql injection. It is possible to initiate the attack remotely. The exploit has bee...
OESA-2024-1580 kubernetes security update
Container cluster management. Security Fixes: A security issue was discovered in Kubernetes where users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using containers, init containers, and ephemeral containers with t...
CVE-2024-35302
In JetBrains TeamCity before 2023.11 stored XSS during restore from backup was possible...
CVE-2024-35302
CVE-2024-35302 describes a stored cross-site scripting (XSS) vulnerability in JetBrains TeamCity where, prior to version 2023.11, an XSS payload could be stored during the backup restore process. The root cause is an insufficient sanitization/handling of input during restoration, allowing injecte...
CVE-2024-35302
In JetBrains TeamCity before 2023.11 stored XSS during restore from backup was possible...
