GO-2022-0936 Improperly Implemented path matching for in-toto-golang in github.com/in-toto/in-toto-golang

Improperly Implemented path matching for in-toto-golang in github.com/in-toto/in-toto-golang...

CVE-2024-7790 DevikaAI Stored Cross-Site Scripting

A stored cross site scripting vulnerabilities exists in DevikaAI from commit 6acce21fb08c3d1123ef05df6a33912bf0ee77c2 onwards via improperly decoded user input...

CVE-2024-7790

CVE-2024-7790 describes a stored cross-site scripting vulnerability in DevikaAI affecting input handling since commit 6acce21fb08c3d1123ef05df6a33912bf0ee77c2. The root cause cited is improperly decoded user input , enabling a stored XSS condition. The CVE entries and connected sources consistent...

CVE-2024-7790

A stored cross site scripting vulnerabilities exists in DevikaAI from commit 6acce21fb08c3d1123ef05df6a33912bf0ee77c2 onwards via improperly decoded user input...

CVE-2024-7790: Improper Neutralization of Input During Web Page Generation

A stored cross site scripting vulnerabilities exists in DevikaAI from commit 6acce21fb08c3d1123ef05df6a33912bf0ee77c2 onwards via improperly decoded user input...

PT-2024-38582

Name of the Vulnerable Software and Affected Versions DevikaAI versions from commit 6acce21fb08c3d1123ef05df6a33912bf0ee77c2 onwards Description A stored cross site scripting issue exists due to improperly decoded user input. This allows for the storage and subsequent execution of malicious...

CVE-2024-38106: Sensitive Data Storage in Improperly Locked Memory

Windows Kernel Elevation of Privilege Vulnerability...

CVE-2024-38137: Sensitive Data Storage in Improperly Locked Memory

Windows Resource Manager PSM Service Extension Elevation of Privilege Vulnerability...

CVE-2024-38131: Sensitive Data Storage in Improperly Locked Memory

Clipboard Virtual Channel Extension Remote Code Execution Vulnerability...

CVE-2024-38884: Incorrect Authorization

An issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions, allows a local attacker to perform an Authentication Bypass attack due to improperly implemented security checks for standard authentication mechanisms...

Improper Access Control

github.com/fabedge/fabedge is vulnerable to Improper Access Control. The vulnerability is due to improperly configured permissions allowing access to sensitive data and escalate privileges by obtaining the service account's token. Attackers can exploit this vulnerability to access sensitive...

CVE-2024-23485

Improperly Preserved Integrity of Hardware Configuration State During a Power Save/Restore Operation CWE-1304 in the Controller 6000 and 7000 can lead to secured door locks connected via Aperio Communication Hubs to momentarily allow free access. This issue affects: Gallagher Controller 6000 and...

CVE-2024-23485

CVE-2024-23485 affects Gallagher Controller 6000 and 7000. Root cause: improper preservation of hardware configuration state during a power save/restore operation, which can cause Aperio-connected door locks to momentarily allow free access. Affected versions span 8.60 and prior; 8.70 prior to vC...

CVE-2024-23485

Improperly Preserved Integrity of Hardware Configuration State During a Power Save/Restore Operation CWE-1304 in the Controller 6000 and 7000 can lead to secured door locks connected via Aperio Communication Hubs to momentarily allow free access. This issue affects: Gallagher Controller 6000 and...

CVE-2024-23485

Improperly Preserved Integrity of Hardware Configuration State During a Power Save/Restore Operation CWE-1304 in the Controller 6000 and 7000 can lead to secured door locks connected via Aperio Communication Hubs to momentarily allow free access. This issue affects: Gallagher Controller 6000 and...

CVE-2024-38354 Cross-site Scripting in Hackmd.io Notes lead by HTML Injection

CodiMD allows realtime collaborative markdown notes on all platforms. The notebook feature of Hackmd.io permits the rendering of iframe HTML tags with an improperly sanitized name attribute. This vulnerability enables attackers to perform cross-site scripting XSS attacks via DOM clobbering. This...

CVE-2024-1153: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Talya Informatics Travel APPS allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Travel APPS: before v17.0.68...

PT-2024-14436

Name of the Vulnerable Software and Affected Versions All In One WP Security & Firewall versions 5.2.4 and earlier Description The issue affects the All In One WP Security & Firewall plugin, allowing exposure of sensitive information to unauthorized actors due to improperly constrained access to...

CVE-2024-29415

The ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses such as 127.1, 01200034567, 012.1.2.3, 000:0:0000::01, and ::fFFf:127.0.0.1 are improperly categorized as globally routable via isPublic. NOTE: this issue exists because of an incomplete fix for CVE-2023-42282...

CVE-2024-27842: Improperly Implemented Security Check for Standard

The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.5. An app may be able to execute arbitrary code with kernel privileges...