3139 matches found
CVE-2024-47653
This vulnerability exists in Shilpi Client Dashboard due to lack of authorization for modification and cancellation requests through certain API endpoints. An authenticated remote attacker could exploit this vulnerability by placing or cancelling requests through API request body leading to...
U.S. Dept Of Defense: Lack of rate limiting in https://███/PKI/PassReset.aspx leads to PII disclosure and potential account takeover
The password reset functionality of AFPC Secure allowed users to provide their Social Security Account Number SSAN and Mother's Maiden Name to reset their password. The issue was that the system informed the user if the SSAN was associated with an active PKI credential, leading to potential...
CVE-2024-23938
Silicon Labs Gecko OS Debug Interface Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Silicon Labs Gecko OS. Authentication is not required to exploit this vulnerability. T...
CVE-2024-38861 Lack of TLS validation in plugin MikroTik on Checkmk Exchange
Improper Certificate Validation in Checkmk Exchange plugin MikroTik allows attackers in MitM position to intercept traffic. This issue affects MikroTik: from 2.0.0 through 2.5.5, from 0.4amk through 2.0a...
openSUSE Security Advisory (SUSE-SU-2024:3427-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
TeamViewer Missing Authentication Local Privilege Escalation Vulnerability
This vulnerability allows local attackers to escalate privileges on affected installations of TeamViewer. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the TeamViewer service,...
CGA-XVRR-QJ2M-GV7C
Bulletin has no description...
SUSE: Security Advisory (SUSE-SU-2024:3411-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2024-23933
Sony XAV-AX5500 CarPlay TLV Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Sony XAV-AX5500 devices. Authentication is not required to exploit this vulnerability. The...
OS Command Execution
github.com/chaosblade-io/chaosblade is vulnerable to OS Command Execution. The vulnerability is due to the lack of authentication when using the cmd parameter in the exec.CommandContext function in server mode. It allows an attacker to execute arbitrary OS commands on the server without...
BELL-CVE-2024-46720
Bulletin has no description...
CGA-6R6V-WCX3-CJXW
Bulletin has no description...
Server-Side Request Forgery (SSRF)
litellm is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to lack of validation or restriction on the apibase parameter in POST /chat/completions, allowing a malicious user to intercept the OpenAI API key by redirecting requests to their own domain...
Rocky Linux 8 : nodejs:18 (RLSA-2024:6148)
The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:6148 advisory. node-tar: denial of service while parsing a tar file due to lack of folders depth validation CVE-2024-28863 nodejs: Bypass network import restriction vi...
The vulnerability of the InPost plugins for WooCommerce and the InPost PL plugin for WordPress allows a hacker to execute arbitrary code.
The vulnerability of InPost plugins for WooCommerce and the InPost PL plugin for WordPress involves a lack of authentication. Exploiting this vulnerability allows a malicious actor to execute arbitrary code...
The vulnerability of the QueryVariableInfo function in the efi component of the Linux operating system’s kernel allows a hacker to trigger a service failure.
The vulnerability of the QueryVariableInfo function in the efi component of the Linux operating system’s kernel is related to the lack of initialization. Exploiting this vulnerability could allow an attacker to cause a service failure...
CGA-6RPF-GWJ3-VCWQ
Bulletin has no description...
Chef Infra Client SEoL (17.x)
According to its version, Chef Infra Client is 17.x. It is, therefore, no longer maintained by its vendor or provider. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it may contain security vulnerabilities. %NASLMINLEVEL 80900 C...