PT-2025-3119

Name of the Vulnerable Software and Affected Versions Umbraco CMS version 14.3.1 Description A stored cross-site scripting XSS vulnerability in Umbraco CMS allows attackers to execute arbitrary web scripts or HTML via a crafted payload. This issue is only possible via authenticated users who have...

CVE-2018-9435

In gattprocesserrorrsp of gattcl.cc, there is a possible out of bound read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

The vulnerability of the Git-based software platform for collaborative code development on GitLab EE/CE lies in the lack of authentication procedures, which allows attackers to increase their privileges.

The vulnerability of the Git-based software platform for collaborative code development in GitLab EE/CE relates to the absence of authentication procedures. Exploiting this vulnerability allows a malicious actor to gain increased privileges remotely...

CVE-2024-11481

A vulnerability in ESM 11.6.10 allows unauthenticated access to the internal Snowservice API. This leads to improper handling of path traversal, insecure forwarding to an AJP backend without adequate validation, and lack of authentication for accessing internal API endpoints...

CVE-2024-11481

CVE-2024-11481 concerns Trellix Enterprise Security Manager (ESM) 11.6.10. The issue enables unauthenticated access to the internal Snowservice API, with improper path traversal handling and insecure forwarding to an AJP backend, lacking authentication for internal API endpoints. Documents indica...

CVE-2024-11481

A vulnerability in ESM 11.6.10 allows unauthenticated access to the internal Snowservice API. This leads to improper handling of path traversal, insecure forwarding to an AJP backend without adequate validation, and lack of authentication for accessing internal API endpoints...

CVE-2024-11481

A vulnerability in ESM 11.6.10 allows unauthenticated access to the internal Snowservice API. This leads to improper handling of path traversal, insecure forwarding to an AJP backend without adequate validation, and lack of authentication for accessing internal API endpoints...

CVE-2024-51569 Apache NimBLE: Lack of input sanitization leading to out-of-bound reads in Number of Completed Packets HCI event handler

Out-of-bounds Read vulnerability in Apache NimBLE. Missing proper validation of HCI Number Of Completed Packets could lead to out-of-bound access when parsing HCI event and invalid read from HCI transport memory. This issue requires broken or bogus Bluetooth controller and thus severity is...

The vulnerability of the virtual learning environment Moodle, related to the absence of an authentication process that prevents unauthorized access to system elements.

The vulnerability of the virtual learning environment Moodle is related to the absence of an authentication process. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to system components...

The vulnerability of the Socket Intercept Command File Interface component in the Juniper Networks Junos OS Evolved operating system allows a hacker to enhance their privileges.

The vulnerability of the Socket Intercept Command File Interface component in Juniper Networks’ Junos OS Evolved operating system is related to the absence of authentication procedures. Exploiting this vulnerability can allow attackers to enhance their privileges...

Dell Wyse Management Suite 安全漏洞

Wyse Management Suite is Dell's hybrid cloud security management solution for Wyse thin client devices, designed to simplify IT management processes and enhance device security. A lack of authorization vulnerability exists in Wyse Management Suite, which can be exploited by an attacker to cause a...

The vulnerability of the CMDaemon component of the NVIDIA Base Command Manager software, which is used for managing workloads and monitoring infrastructure. This vulnerability allows a malicious actor to execute arbitrary code.

The vulnerability of the CMDaemon component of the NVIDIA Base Command Manager software for managing workload and monitoring infrastructure involves the absence of authentication procedures. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

GHSA-QXRP-VHVM-J765 Deserialization of Untrusted Data in Hugging Face Transformers

Hugging Face Transformers MobileViTV2 Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in...

NVIDIA Base Command Manager 安全漏洞

NVIDIA Base Command Manager is a base command manager from NVIDIA Corporation. A security vulnerability exists in NVIDIA Base Command Manager that stems from a lack of authentication, successful exploitation of which could lead to code execution, denial of service, privilege escalation, informati...

CVE-2024-9252

Foxit PDF Reader AcroForm Use-After-Free Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a...

CVE-2024-9247

Foxit PDF Reader Annotation Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader. User interaction is required to exploit this vulnerability in that the target must visit a...

CVE-2024-11394 Hugging Face Transformers Trax Model Deserialization of Untrusted Data Remote Code Execution Vulnerability

Hugging Face Transformers Trax Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability in th...

CVE-2024-11393 Hugging Face Transformers MaskFormer Model Deserialization of Untrusted Data Remote Code Execution Vulnerability

Hugging Face Transformers MaskFormer Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability...

CVE-2024-9737

Tungsten Automation Power PDF PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Tungsten Automation Power PDF. User interaction is required to exploit this vulnerability in th...

CVE-2024-8848

PDF-XChange Editor AcroForm Out-Of-Bounds Read Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must vis...