CVE-2024-21507

Versions of the package mysql2 before 3.9.3 are vulnerable to Improper Input Validation through the keyFromFields function, resulting in cache poisoning. An attacker can inject a colon : character within a value of the attacker-crafted key...

CVE-2024-21507

CVE-2024-21507 affects the mysql2 npm package: all versions before 3.9.3 are vulnerable due to improper input validation in the keyFromFields function, allowing cache poisoning via a colon (:) inside an attacker-crafted key value. Impact is described as confidentiality/integrity concerns in vario...

CVE-2024-21507

Versions of the package mysql2 before 3.9.3 are vulnerable to Improper Input Validation through the keyFromFields function, resulting in cache poisoning. An attacker can inject a colon : character within a value of the attacker-crafted key...

CVE-2024-2918

Improper input validation in PAM JIT elevation feature in Devolutions Server 2024.1.6 and earlier allows an attacker with access to the PAM JIT elevation feature to forge the displayed group in the PAM JIT elevation checkout request via a specially crafted request...

CVE-2024-2918

Improper input validation in PAM JIT elevation feature in Devolutions Server 2024.1.6 and earlier allows an attacker with access to the PAM JIT elevation feature to forge the displayed group in the PAM JIT elevation checkout request via a specially crafted request...

CVE-2024-31867

CVE-2024-31867 – Apache Zeppelin LDAP search filter injection indicates an improper input validation vulnerability in Zeppelin. The issue allows an attacker to execute malicious queries by manipulating LDAP search filter configuration properties, affecting Zeppelin versions from 0.8.2 up to, but ...

GHSA-RR59-H6RH-V84V Apache Zeppelin SAP: connecting to a malicious SAP server allowed it to perform XXE

Improper Input Validation vulnerability in Apache Zeppelin SAP. This issue affects Apache Zeppelin SAP: from 0.8.0 before 0.11.0. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance ...

CVE-2022-47894 Apache Zeppelin SAP: connecting to a malicious SAP server allowed it to perform XXE

Improper Input Validation vulnerability in Apache Zeppelin SAP.This issue affects Apache Zeppelin SAP: from 0.8.0 before 0.11.0. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance t...

CVE-2024-31860 Apache Zeppelin: Path traversal vulnerability

Improper Input Validation vulnerability in Apache Zeppelin. By adding relative path indicatorsE.g .., attackers can see the contents for any files in the filesystem that the server account can access. This issue affects Apache Zeppelin: from 0.9.0 before 0.11.0. Users are recommended to upgrade t...

Microsoft Azure Private 5G Core InitialUEMessage Improper Input Validation Denial-of-Service Vulnerability

This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Microsoft Azure Private 5G Core. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of InitialUEMessage messages. The issue resul...

CVE-2023-52343

In SecurityCommand message after as security has been actived., there is a possible improper input validation. This could lead to remote information disclosure no additional execution privileges needed...

CVE-2023-52343

CVE-2023-52343 concerns UNISOC chipsets with a vulnerability in the SecurityCommand message after security is activated. The root cause is improper input validation, which could lead to remote information disclosure without requiring additional execution privileges. Documents do not specify affec...

SUSE SLES15 Security Update : kernel RT (Live Patch 0 for SLE 15 SP5) (SUSE-SU-2024:1097-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:1097-1 advisory. This update for the Linux Kernel 5.14.21-15050011 fixes several issues. The following security issues were fixed: - CVE-2023-6531: Fixed a...

VulnCheck KEV: CVE-2020-8191

Improper input validation in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.1a, 11.0.3d and 10.2.7 allows reflected Cross Site Scripting XSS...

CVE-2024-29746

In lpmreqhandler of lpm.c, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2024-29746

In lpmreqhandler of lpm.c, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

RLSA-2024:1607 Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: vmwgfx: NULL pointer dereference in vmwcmddxdefinequery CVE-2022-38096 kernel: Out of boundary write in perfreadgroup as result of overflow a perfevent's readsize CVE-2023-6931 kernel: GS...

Google Pixel 安全漏洞

Google Pixel is a smartphone from Google, an American company. A security vulnerability exists in Google Pixel, which stems from an improper input validation in the tmugetpi module of the tmu.c file, which may result in out-of-bounds reads...

Google Pixel 安全漏洞

Google Pixel is a smartphone from Google, Inc USA. A security vulnerability exists in Google Pixel that stems from an improper input validation in the lpmreqhandler module of the lpm.c file, which may result in out-of-bounds writes...

CVE-2024-27201

An improper input validation vulnerability exists in the OAS Engine User Configuration functionality of Open Automation Software OAS Platform V19.00.0057. A specially crafted series of network requests can lead to unexpected data in the configuration. An attacker can send a sequence of requests t...