CVE-2024-53947

CVE-2024-53947 : Apache Superset is affected by an SQL Injection vulnerability due to improper neutralization of certain engine-specific functions, allowing bypass of SQL authorization. The issue affects versions

CVE-2024-53947 Apache Superset: Improper SQL authorisation, parse not checking for specific postgres functions

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache Superset. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. This issue is a follow-up to CVE-2024-39887...

curl: Buffer Overflow Risk in Curl_inet_ntop and inet_ntop4

Curl is a software that I love and is an important tool for the world. If my report doesn't align, I apologize for that. The Curlinetntop function is designed to convert IP addresses from binary format to human-readable string format, supporting both IPv4 and IPv6. It internally delegates to...

CVE-2024-10774

Unauthenticated CROWN APIs allow access to critical functions. This leads to the accessibility of large parts of the web application without authentication...

CVE-2024-10774 SICK InspectorP61x and SICK InspectorP62x have unauthenticated CROWN APIs

Unauthenticated CROWN APIs allow access to critical functions. This leads to the accessibility of large parts of the web application without authentication...

CVE-2024-10774

Affected products: SICK InspectorP61x and InspectorP62x (industrial 2D vision sensors). Root cause: unauthenticated CROWN APIs that expose critical functionality. Impact: enables access to large parts of the web application without authentication (potential confidentiality, integrity, and availab...

PT-2024-16884 · WordPress · Soledad

Name of the Vulnerable Software and Affected Versions: Soledad theme for WordPress versions up to, and including, 8.5.9 Description: The Soledad theme for WordPress is vulnerable to Local File Inclusion via several functions like penci archive more post ajax func, penci more post ajax func, and...

WordPress plugin The Pojo Forms 代码注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A code injection vulnerability exists ...

The vulnerability of the backup function of the Cisco Secure Firewall Management Center (formerly Cisco Firepower Management Center) allows a perpetrator to execute arbitrary commands on the basic operating system.

The vulnerability of the cluster backup function of the Cisco Secure Firewall Management Center formerly known as Cisco Firepower Management Center exists due to the lack of measures to neutralize specific elements. Exploiting this vulnerability allows a malicious actor, operating remotely, to...

postgresql: PostgreSQL row security below e.g. subqueries disregards user ID changes

A flaw was found in PostgreSQL. This vulnerability allows incorrect row-level security policies to be applied via subqueries, WITH queries, security invoker views, or SQL-language functions that reference tables with row-level security policies. This issue arises when a query is planned under one...

postgresql: PostgreSQL row security below e.g. subqueries disregards user ID changes

A flaw was found in PostgreSQL. This vulnerability allows incorrect row-level security policies to be applied via subqueries, WITH queries, security invoker views, or SQL-language functions that reference tables with row-level security policies. This issue arises when a query is planned under one...

The vulnerability of the elisp-completion-at-point() and elisp-flymake-byte-compile() functions in the EMACS text editor’s Lisp mode allows a hacker to execute arbitrary code.

The vulnerability of the elisp-completion-at-point and elisp-flymake-byte-compile functions in the EMACS text editor’s Lisp mode is related to improper code generation management. Exploiting this vulnerability may allow a remote attacker to execute arbitrary code...

CVE-2024-12138 horilla create_skills deserialization

A vulnerability classified as critical was found in horilla up to 1.2.1. This vulnerability affects the function requestnew/getemployeeshift/createreimbursement/keyresultcurrentvalueupdate/createmeetings/createskills. The manipulation leads to deserialization. The attack can be initiated remotely...

CVE-2024-54156

In JetBrains YouTrack before 2024.3.52635 multiple merge functions were vulnerable to prototype pollution attack...

CVE-2024-54156

In JetBrains YouTrack before 2024.3.52635 multiple merge functions were vulnerable to prototype pollution attack...

CVE-2024-54156

In JetBrains YouTrack before 2024.3.52635 multiple merge functions were vulnerable to prototype pollution attack...

CVE-2024-54156

CVE-2024-54156 is linked to JetBrains YouTrack prior to 2024.3.52635, where multiple merge functions are vulnerable to a prototype pollution attack. The issue stems from uncontrolled modification of object prototype properties within the merge functions, enabling an attacker to alter object proto...

postgresql: PostgreSQL row security below e.g. subqueries disregards user ID changes

A flaw was found in PostgreSQL. This vulnerability allows incorrect row-level security policies to be applied via subqueries, WITH queries, security invoker views, or SQL-language functions that reference tables with row-level security policies. This issue arises when a query is planned under one...

postgresql: PostgreSQL row security below e.g. subqueries disregards user ID changes

A flaw was found in PostgreSQL. This vulnerability allows incorrect row-level security policies to be applied via subqueries, WITH queries, security invoker views, or SQL-language functions that reference tables with row-level security policies. This issue arises when a query is planned under one...

postgresql: PostgreSQL row security below e.g. subqueries disregards user ID changes

A flaw was found in PostgreSQL. This vulnerability allows incorrect row-level security policies to be applied via subqueries, WITH queries, security invoker views, or SQL-language functions that reference tables with row-level security policies. This issue arises when a query is planned under one...