CVE-2024-52283

CVE-2024-52283 is described in public sources as a stored XSS vulnerability caused by missing input sanitization. The available connected documents indicate the vulnerability can be triggered when viewing a specific project, with a CVSS 3.1 base score of 5.7 (Medium) and an influence pattern of N...

PT-2024-35151 · Suse · Hackweek

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue is related to a stored XSS attack that occurs due to missing sanitation of inputs. This allows arbitrary users to conduct the attack, which...

AZL-53546 CVE-2024-52337 affecting package tuned for versions less than 2.21.0-2

A log spoofing flaw was found in the Tuned package due to improper sanitization of some API arguments. This flaw allows an attacker to pass a controlled sequence of characters; newlines can be inserted into the log. Instead of the 'evil' the attacker could mimic a valid TuneD log line and trick t...

UBUNTU-CVE-2024-52337

A log spoofing flaw was found in the Tuned package due to improper sanitization of some API arguments. This flaw allows an attacker to pass a controlled sequence of characters; newlines can be inserted into the log. Instead of the 'evil' the attacker could mimic a valid TuneD log line and trick t...

USN-7128-1 pygments vulnerability

Sebastian Chnelik discovered that Pygments had an inefficient regex query for analyzing certain inputs. An attacker could possibly use this issue to cause a denial of service...

PT-2024-9489

Name of the Vulnerable Software and Affected Versions: Advantech EKI-6333AC-2G versions 1.6.3 and earlier Advantech EKI-6333AC-2GD versions 1.6.3 and earlier Advantech EKI-6333AC-1GPO versions 1.2.1 and earlier Description: The issue exists due to the lack of neutralization of special elements us...

SQL Injection

github.com/devtron-labs/devtron is vulnerable to SQL Injection. The vulnerability is due to insufficient sanitization of user inputs in the CreateUser API /orchestrator/user, allowing authenticated users with minimal permissions to execute malicious SQL queries...

PT-2024-17183 · Codeastro · Codeastro Hospital Management System

Name of the Vulnerable Software and Affected Versions: CodeAstro Hospital Management System version 1.0 Description: A vulnerability has been found in the CodeAstro Hospital Management System, affecting an unknown functionality of the file /backend/admin/his admin register patient.php of the...

GO-2024-3282 Potential slowdown / DoS when parsing specially crafted PEM inputs in github.com/cert-manager/cert-manager

Potential slowdown / DoS when parsing specially crafted PEM inputs in github.com/cert-manager/cert-manager...

PT-2024-39512 · WordPress · Booster For Woocommerce

Name of the Vulnerable Software and Affected Versions: The Booster for WooCommerce plugin for WordPress versions up to, and including, 7.2.3 Description: The issue arises from the use of add query arg and remove query arg without proper escaping on the URL, leading to Reflected Cross-Site...

WordPress plugin MStore API 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

IBM Concert 安全漏洞

IBM Concert is a new tool from International Business Machines IBM Inc. that uses generative AI to help manage complex cloud-native applications. IBM Concert suffers from a SQL injection vulnerability that stems from the application's lack of validation of externally entered SQL statements. A...

PT-2024-9685 · Envoy · Envoy

Name of the Vulnerable Software and Affected Versions: Envoy versions prior to 1.30.8 Envoy versions prior to 1.31.4 Envoy versions prior to 1.32.2 Description: The issue is related to the Happy Eyeballs sorting algorithm in the Envoy proxy, which crashes when additional addresses are not IP...

The vulnerability of the set_ap_map_config() function in the mainfunction.cgi script of the DrayTek Vigor 3900, Vigor 2960, and Vigor 300B router microprogramming system allows a hacker to execute arbitrary commands.

The vulnerability of the setapmapconfig function in the mainfunction.cgi script of the DrayTek Vigor 3900, Vigor 2960, and Vigor 300B routers relates to the failure to eliminate the and & elements used in the operating system’s command when processing the action parameter. Exploiting this...

libvpx: Integer overflow in vpx_img_alloc()

A flaw was found in libvpx. When creating images, libvpx trusts the width, height, and alignment of the user input. However, it does not properly validate the provided values. This flaw allows an attacker to craft user inputs or trick the user into opening crafted files, where these types of valu...

Cross-Site Scripting (XSS)

github.com/mudler/localai is vulnerable to Cross Site Scripting XSS. The vulnerability is due to improper input validation and inadequate sanitization of user inputs when passing parameters to the delete model API, allows malicious scripts to be stored and executed in the application...

Medium: python-idna

Issue Overview: python-idna: potential DoS via resource consumption via specially crafted inputs to idna.encode CVE-2024-3651 Affected Packages: python-idna Issue Correction: Run dnf update python-idna --releasever 2023.6.20241111 or dnf update --advisory ALAS2023-2024-763 --releasever...

Fedora 41 : python-django4.2 (2024-b08735561c)

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-b08735561c advisory. urlize and urlizetrunc were subject to a potential denial-of-service attack via very large inputs with a specific sequence of characters. Tenable has extract...

Fedora 41 : python-django (2024-396c94f0a3)

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-396c94f0a3 advisory. urlize and urlizetrunc were subject to a potential denial-of-service attack via very large inputs with a specific sequence of characters. Tenable has extract...

CVE-2024-46890

A vulnerability has been identified in SINEC INS All versions V1.0 SP2 Update 3. The affected application does not properly validate input sent to specific endpoints of its web API. This could allow an authenticated remote attacker with high privileges on the application to execute arbitrary code...