14162 matches found
PT-2024-24769 · WordPress · Wp Ultimate Review
Name of the Vulnerable Software and Affected Versions: Wp Ultimate Review versions 2.2.5 and earlier Description: The issue is related to an Authorization Bypass Through User-Controlled Key vulnerability. This allows for potential unauthorized access. Recommendations: For versions 2.2.5 and...
PT-2024-12610 · Ibm · Ibm Aspera Faspex
Name of the Vulnerable Software and Affected Versions: IBM Aspera Faspex versions 5.0.0 through 5.0.7 Description: The issue allows a local user to obtain sensitive information due to improper encryption of certain data. Recommendations: For IBM Aspera Faspex versions 5.0.0 through 5.0.7, update ...
CVE-2024-3742 Electrolink FM/DAB/TV Transmitter Cleartext Storage of Sensitive Information
Electrolink transmitters store credentials in clear-text. Use of these credentials could allow an attacker to access the system...
CVE-2023-46060
A Buffer Overflow vulnerability in Tenda AC500 v.2.0.1.9 allows a remote attacker to cause a denial of service via the port parameter at the goform/setVlanInfo component...
CVE-2024-29035 Umbraco's Blind SSRF Leads to Port Scan by using Webhooks
Umbraco is an ASP.NET CMS. Failing webhooks logs are available when solution is not in debug mode. Those logs can contain information that is critical. This vulnerability is fixed in 13.1.1...
DEBIAN-CVE-2024-26852
In the Linux kernel, the following vulnerability has been resolved: net/ipv6: avoid possible UAF in ip6routempathnotify syzbot found another use-after-free in ip6routempathnotify 1 Commit f7225172f25a "net/ipv6: prevent use after free in ip6routempathnotify" was not able to fix the root cause. We...
Tenda AC500 安全漏洞
Tenda AC500 is the wireless controller device introduced, designed for small and medium-sized businesses, supporting cross-VLAN management of wireless networks. A buffer overflow vulnerability exists in the Tenda AC500, which originates from the port parameter of the fromSetVlanInfo method of the...
CVE-2024-21990: Use of Hard-coded Password
ONTAP Select Deploy administration utility versions 9.12.1.x, 9.13.1.x and 9.14.1.x contain hard-coded credentials that could allow an attacker to view Deploy configuration information and modify the account credentials...
PT-2024-24632 · WordPress · Wp Poll Maker
Name of the Vulnerable Software and Affected Versions: WP Poll Maker versions 3.4 and earlier Description: The issue is related to an Unrestricted Upload of File with Dangerous Type, which affects the WP Poll Maker plugin. This could potentially allow for malicious file uploads. Recommendations:...
PT-2024-3437 · Oracle · Oracle E-Business Suite
Name of the Vulnerable Software and Affected Versions: Oracle E-Business Suite versions 12.2.3 through 12.2.13 Description: The issue is related to insufficient input validation in the LOV component of Oracle Complex Maintenance, Repair, and Overhaul. This easily exploitable vulnerability allows ...
PT-2024-24200 · Unknown · Gin-Vue-Admin
Name of the Vulnerable Software and Affected Versions: sanluan flipped-aurora gin-vue-admin versions 2.4.x Description: An issue in the Session Expiration component allows an attacker to escalate privileges. Recommendations: For versions 2.4.x, consider restricting access to the Session Expiratio...
PT-2024-24732
Name of the Vulnerable Software and Affected Versions ATCMD affected versions not specified Description The issue arises from a misinterpretation of a value in ATCMD by the printf function, leading to incorrect output and potential out-of-bounds memory access. Recommendations At the moment, there...
CVE-2024-27980
A command injection flaw was found in Node.js exclusive to Windows environments. This flaw allows an attacker to perform command injection via the args parameter of childprocess.spawn without the shell option enabled on Windows. This behavior is caused by cmd.exe when executing batch files, which...
PT-2024-24075 · Unknown · The Events Calendar
Name of the Vulnerable Software and Affected Versions: The Events Calendar versions n/a through 6.3.0 Description: A Cross-Site Request Forgery CSRF issue has been identified. This type of issue allows an attacker to trick a user into performing unintended actions on a web application that the us...
PT-2024-24063 · Favicon · Favicon
Name of the Vulnerable Software and Affected Versions: Favicon versions 1.3.29 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web application that the user...
PT-2024-9795
Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to a buffer overflow in the print cpu stall info function. This can occur when there is a huge difference in jiffies difference, causing the rcuc-starvation output...
PT-2024-23076
Name of the Vulnerable Software and Affected Versions Evolution Controller versions 2.04.560.31.03.2024 and below Description The Web interface of Evolution Controller contains poorly configured access control on the DESKTOP EDIT USER GET CARD endpoint, allowing an unauthenticated attacker to...
Security Bulletin: IBM Sterling B2B Integrator vulnerable to multiple issues due to IBM MQ
Summary IBM Sterling B2B Integrator uses IBM MQ. This bulletin identifies the steps to take to address the vulnerabilities. Vulnerability Details CVEID:CVE-2023-28950 DESCRIPTION: IBM MQ 8.0, 9.0, 9.1, 9.2, and 9.3 could disclose sensitive user information from a trace file if that functionality...
SUSE CVE-2024-26805
In the Linux kernel, the following vulnerability has been resolved: netlink: Fix kernel-infoleak-after-free in skbdatagramiter syzbot reported the following uninit-value access issue 1: netlinktofullskb creates a new skb and puts the skb-data passed as a 1st arg of netlinktofullskb onto new skb...
