RHEL 8 : resource-agents (RHSA-2024:8172)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:8172 advisory. The resource-agents packages provide the Pacemaker and RGManager service managers with a set of scripts. These scripts interface with several service...

PyO3 has a risk of use-after-free in `borrowed` reads from Python weak references

The family of functions to read "borrowed" values from Python weak references were fundamentally unsound, because the weak reference does itself not have ownership of the value. At any point the last strong reference could be cleared and the borrowed value would become dangling. In PyO3 0.22.4...

PT-2024-7082 · Microsoft · Azure Functions +1

Name of the Vulnerable Software and Affected Versions: Imagine Cup affected versions not specified Description: The issue is related to improper access control in Imagine Cup, allowing an authorized attacker to elevate privileges over a network. This can potentially lead to unauthorized access to...

KLA74056 OSI vulnerability in Microsoft Azure

Information disclosure vulnerability was found in Microsoft Azure. Malicious users can exploit this vulnerability to obtain sensitive information. Original advisories CVE-2024-38204 Exploitation Related products Microsoft-Azure CVE list CVE-2024-38204 high KB list Solution Install necessary updat...

PT-2024-39977 · Pypi · Pyo3

Name of the Vulnerable Software and Affected Versions: PyO3 versions prior to 0.22.4 PyO3 version 0.22.4 with mitigated functions, to be fully removed in 0.23 Description: A flaw was found in PyO3, causing a use-after-free issue. This can lead to memory corruption or crashes through unsound...

CLSA-2024-1728934930 emacs: Fix of CVE-2024-39331

CVE-2024-39331: do not expand link abbrevs that contain unsafe function...

PT-2024-38074 · Netease Youdao · Qanything

Name of the Vulnerable Software and Affected Versions: netease-youdao/qanything version 1.4.1 Description: The issue concerns a SQL injection vulnerability where unsafe data obtained from user input is concatenated in SQL queries. This affects functions including get knowledge base name, from...

Tenda AC1206 Command Injection Vulnerability (CNVD-2024-41056)

The Tenda AC1206 is a wireless Gigabit router from Tenda China. The Tenda AC1206 suffers from a command injection vulnerability that stems from manipulation of the ateiwprivset/ateifconfigset functions in the file /goform/ate, which can lead to command injection. No detailed vulnerability details...

PT-2024-38010

Name of the Vulnerable Software and Affected Versions lollms-webui affected versions not specified lollms affected versions not specified Description A path traversal issue exists in the lollms file system.py file, specifically affecting the functions add rag database, toggle mount rag database,...

Ghidra data type archive for Windows driver functions

While reverse-engineering Windows drivers with Ghidra, it is common to encounter a function or data type that is not recognized during disassembly. This is because Ghidra does not natively include the majority of the definitions for data types and functions used by Windows drivers. Thankfully,...

SUSE CVE-2024-47672

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

PT-2024-40214 · Surrealdb · Surrealdb

Name of the Vulnerable Software and Affected Versions: SurrealDB versions prior to 2.0.4 Description: The issue arises from the order in which permissions are processed, leading to potential leaks of field values or record contents to users without the required permissions. This can occur in...

CVE-2024-47610 Stored Cross-site Scripting Vulnerability in Markdown Editor

InvenTree is an Open Source Inventory Management System. In affected versions of InvenTree it is possible for a registered user to store javascript in markdown notes fields, which are then displayed to other logged in users who visit the same page and executed. The vulnerability has been addresse...

WordPress WP Cleanup and Basic Functions Plugin <= 2.2.1 is vulnerable to Cross Site Scripting (XSS)

Software WP Cleanup and Basic Functions Type Plugin Vulnerable versions = 2.2.1 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-9455 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 039af66fda0d Credits Francesco...

WordPress plugin WP Cleanup and Basic Functions 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...

CVE-2024-9455: Improper Neutralization of Input During Web Page Generation

The WP Cleanup and Basic Functions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 2.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level...

PLANET Technology Loading Downloading Bypass Auth Code Execution

The vulnerability of the loading and downloading functions of microprogramming software from PLANET Technology is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to bypass the authentication process and execute arbitrary code...

CVE-2024-20442

A vulnerability in the REST API endpoints of Cisco Nexus Dashboard could allow an authenticated, low-privileged, remote attacker to perform limited Administrator actions on an affected device. This vulnerability is due to insufficient authorization controls on some REST API endpoints. An attacker...

CVE-2024-20442

Cisco Nexus Dashboard exposes a REST API vulnerability due to insufficient authorization controls on certain endpoints. An authenticated, low-privileged, remote attacker could perform limited Administrator actions such as viewing portions of the web UI, generating config backups, or deleting tech...

CVE-2024-20438: Protection Mechanism Failure

A vulnerability in the REST API endpoints of Cisco NDFC could allow an authenticated, low-privileged, remote attacker to read or write files on an affected device. This vulnerability exists because of missing authorization controls on some REST API endpoints. An attacker could exploit this...