Authentication Bypass

github.com/openfga/openfga is vulnerable to Authorization Bypass. The vulnerability is due to improper validation of conditions and contextual tuples when using the Check API or ListObjects API, particularly when caching is enabled OPENFGACHECKQUERYCACHEENABLED, allows attackers to potentially...

Mattermost Mobile Apps 安全漏洞

Mattermost Mobile Apps is a messaging mobile application from Mattermost USA. Mattermost Mobile Apps suffers from a denial of service vulnerability that stems from a failure to properly validate post attributes. An attacker could exploit the vulnerability to cause the application to crash...

Denial Of Service (DoS)

github.com/mattermost/mattermost-server is vulnerable to Denial-of-service DoS vulnerability. The vulnerability is due to improper validation of post types, allowing attackers to exploit a specific post type customplnotification and its props to deny service to users with the sysconsolereadplugin...

Open Redirect

sickchill is vulnerable to an Open Redirect. The vulnerability is due to improper validation of the next parameter in the user-controlled login endpoint, allows an attacker to redirect authenticated users to arbitrary destinations, potentially facilitating phishing attacks or other malicious...

UBUNTU-CVE-2024-47796

An improper array index validation vulnerability exists in the nowindow functionality of OFFIS DCMTK 3.6.8. A specially crafted DICOM file can lead to an out-of-bounds write. An attacker can provide a malicious file to trigger this vulnerability...

CVE-2024-52333

An improper array index validation vulnerability exists in the determineMinMax functionality of OFFIS DCMTK 3.6.8. A specially crafted DICOM file can lead to an out-of-bounds write. An attacker can provide a malicious file to trigger this vulnerability...

Argument Injection

github.com/go-git/go-git is vulnerable to an Argument Injection. The vulnerability is due to improper validation of input arguments passed to the git-upload-pack flags, which allows arbitrary values to be injected when using the file transport protocol...

Path Traversal

github.com/karmada-io/karmada is vulnerable to Path Traversal. The vulnerability is due to improper validation of file paths within custom resource definition CRD archives, allowing attackers to exploit a TarSlip vulnerability and write arbitrary files to arbitrary locations in the filesystem...

Security Bulletin: Due to the use of Eclipse Jetty, IBM App Connect Professional is vulnerable to bypass security restrictions

Summary Eclipse Jetty is used within IBM App Connect Professional Vulnerability Details CVEID:CVE-2024-6763 DESCRIPTION: Eclipse Jetty could allow a remote attacker to bypass security restrictions, caused by improper validation on the authority segment of a URI in the HttpURI class. By sending a...

WeGIA 代码问题漏洞

WeGIA is a web manager for welfare organizations by the individual developer Nilson Lazarin. A code issue vulnerability exists in WeGIA versions prior to 3.2.6, which stems from a lack of proper validation of the /WeGIA/html/socio/sistema/controller/controlaxlsx.php endpoint when accepting file...

CVE-2024-45550 Improper Validation of Array Index in DSP Services

Memory corruption occurs when invoking any IOCTL-calling application that executes all MCDM driver IOCTL calls...

Arbitrary Code Execution (ACE)

filippo.io/age is vulnerable to Arbitrary Code Execution ACE. The vulnerability is due to improper validation or sanitization of plugin names, identities, or recipients, allows malicious input to be introduced and will execute arbitrary code or binaries...

Remote Command Execution

Gogs is vulnerable to Remote Command Execution. The vulnerability is due to improper validation of symlink files, allowing a malicious user to commit and edit crafted symlink files in a repository to gain SSH access to the server...

CVE-2024-25042

CVE-2024-25042 affects IBM Cognos Analytics 11.2.0–11.2.4 and 12.0.0–12.0.3, where an XSS flaw arises from improper validation of Cognos Explorations column headings. The root cause is improper input validation in the Cognos Explorations module, allowing a remote attacker to run malicious command...

Open Redirection

github.com/bunkerity/bunkerweb is vulnerable to an Open Redirection. The vulnerability is due to improper validation of the "next" parameter in the loading endpoint, which allows attackers to redirect authenticated users to arbitrary external URLs. For example, visiting...

CVE-2024-4762

CVE-2024-4762 affects Lenovo LADM and Lenovo LDCC firmware update mechanism. Root cause: improper validation in the firmware update process leading to local privilege escalation. Affected components: LADM and LDCC; impact is local confidentiality, integrity, and availability of high level (per CV...

CVE-2024-4762

An improper validation vulnerability was reported in the firmware update mechanism of LADM and LDCC that could allow a local attacker to escalate privileges...

Unauthorized File Download

thorsten/phpmyfaq is vulnerable to Unauthorized File Download. The vulnerability is due to improper validation in the FAQ Record component, allowing a privileged attacker to embed a file download in an element and exploit it without user interaction or explicit consent...

CVE-2024-12333 WoodMart <= 8.0.3 - Unauthenticated Arbitrary Shortcode Execution

The Woodmart theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 8.0.3. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode through the woodmartinstagramajaxquery AJ...

SUSE SLES12: libpython3_4m1_0 / libpython3_4m1_0-32bit / python3 / python3-base / etc (SUSE-SU-2024:4166-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by a vulnerability as referenced in the SUSE- SU-2024:4166-1 advisory. - CVE-2024-11168: Fixed improper validation of IPv6 and IPvFuture addresses bsc1233307 Other fixes: - Remove -IVendor/ from python-config bsc1231795...