CVE-2024-7592

A flaw was found in the http.cookies module in the Python package. When parsing cookies that contain backslashes, under certain circumstances, the module uses an algorithm with quadratic complexity, leading to excessive CPU consumption...

aplicacoes.mds.gov.br Cross Site Scripting vulnerability OBB-3958799

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2024-42265

In the Linux kernel, the following vulnerability has been resolved: protect the fetch of -fdfd in dodup2 from mispredictions both callers have verified that fd is not greater than -maxfds; however, misprediction might end up with tofree = fdt-fdfd; being speculatively executed. That's wrong for t...

CVE-2024-7885

A vulnerability was found in Undertow where the ProxyProtocolReadListener reuses the same StringBuilder instance across multiple requests. This issue occurs when the parseProxyProtocolV1 method processes multiple requests on the same HTTP connection. As a result, different requests may share the...

Delta Electronics DIAScreen Stack Buffer Vulnerability

Delta Electronics DIAScreen is an intelligent desktop builder from Delta Electronics in China. A stack buffer vulnerability exists in Delta Electronics DIAScreen, which can be exploited by an attacker to execute arbitrary code...

CVE-2024-6384 Backup files may be downloaded by underprivileged users in MongoDB Enterprise Server

"Hot" backup files may be downloaded by underprivileged users, if they are capable of acquiring a unique backup identifier. This issue affects MongoDB Enterprise Server v6.0 versions prior to 6.0.16, MongoDB Enterprise Server v7.0 versions prior to 7.0.11 and MongoDB Enterprise Server v7.3 versio...

CVE-2024-5717

creationtimestamp| type| source ---|---|--- 2024-08-13 07:17:46+00:00| published-proof-of-concept| https://t.me/proxybar/2225 2024-08-13 07:31:39+00:00| published-proof-of-concept| https://t.me/Kelvinseccommunity/730 2024-08-13 07:31:57+00:00| published-proof-of-concept|...

CVE-2023-7249

creationtimestamp| type| source ---|---|--- 2024-08-12 19:17:47+00:00| seen| https://t.me/cvedetector/2868...

Researchers Uncover Vulnerabilities in Solarman and Deye Solar Systems

Cybersecurity researchers have identified a number of security shortcomings in photovoltaic system management platforms operated by Chinese companies Solarman and Deye that could enable malicious actors to cause disruption and power blackouts. "If exploited, these vulnerabilities could allow an...

Courier Management System 2020-1.0 SQL Injection

Titles: courier-management-system-2020-1.0 Multiple-SQLi Author: nu11secur1ty Date: 08/12/2024 Vendor: https://github.com/oretnom23 Software: https://www.sourcecodester.com/php/14611/courier-management-system-using-phpmysqli-source-code.htmlcomment-105424 Reference:...

CVE-2024-42252

In the Linux kernel, the following vulnerability has been resolved: closures: Change BUGON to WARNON If a BUGON can be hit in the wild, it shouldn't be a BUGON For reference, this has popped up once in the CI, and we'll need more info to debug it: 03240 ------------ cut here ------------ 03240...

CVE-2024-0102

NVIDIA CUDA Toolkit for all platforms contains a vulnerability in nvdisasm, where an attacker can cause an out-of-bounds read issue by deceiving a user into reading a malformed ELF file. A successful exploit of this vulnerability might lead to denial of service...

CVE-2024-7267

Exposure of Sensitive Information vulnerability in Naukowa i Akademicka Sieć Komputerowa - Państwowy Instytut Badawczy EZD RP allows logged-in user to retrieve information about IP infrastructure and credentials. This issue affects EZD RP all versions before 19.6...

CVE-2024-7557

A vulnerability was found in OpenShift AI that allows for authentication bypass and privilege escalation across models within the same namespace. When deploying AI models, the UI provides the option to protect models with authentication. However, credentials from one model can be used to access...

CVE-2024-39817

Insertion of sensitive information into sent data issue exists in Cybozu Office 10.0.0 to 10.8.6, which may allow a user who can login to the product to view data that the user does not have access by conducting 'search' under certain conditions in Custom App...

CVE-2024-7006

A null pointer dereference flaw was found in Libtiff via tifdirinfo.c. This issue may allow an attacker to trigger memory allocation failures through certain means, such as restricting the heap space size or injecting faults, causing a segmentation fault. This can cause an application crash,...

CISO: funciones y responsabilidades laborales 🛡️

Significado de CISO En el ámbito corporativo, CISO es un acrónimo ampliamente reconocido que denota a "Chief Information Security Officer", que se puede interpretar en español como el Encargado Principal de Salvaguardar la Información. Este encargo representa una posición esencial en el organigra...

CGA-33CR-QWP7-5VH8

Bulletin has no description...

PT-2024-18813 · WordPress · Remote Content Shortcode

Name of the Vulnerable Software and Affected Versions: Remote Content Shortcode plugin for WordPress versions up to, and including, 1.5 Description: The issue allows authenticated attackers with contributor-level access and above to make web requests to arbitrary locations originating from the we...

CVE-2024-7319

An incomplete fix for CVE-2023-1625 was found in openstack-heat. Sensitive information may possibly be disclosed through the OpenStack stack abandon command with the hidden feature set to True and the CVE-2023-1625 fix applied...