CVE-2024-53908

An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17. Direct usage of the django.db.models.fields.json.HasKey lookup, when an Oracle database is used, is subject to SQL injection if untrusted data is used as an lhs value. Applications that use the...

CISA Releases New Public Version of CDM Data Model Document

Today, the Cybersecurity and Infrastructure Security Agency CISA released an updated public version of the Continuous Diagnostics and Mitigation CDM Data Model Document. Version 5.0.1 aligns with fiscal year 2023 Federal Information Security Modernization Act FISMA metrics. The CDM Data Model...

ASUS RT-AX55 安全漏洞

The ASUS RT-AX55 is a dual-band Wi-Fi router from Asus China. ASUS RT-AX55 A security vulnerability exists in versions prior to 3.0.0.4.38652332, which stems from incorrect input validation and causes the device to crash...

The vulnerability of the microprogramming software for Rockwell Automation’s EtherNet/IP adapters model 5015-AENFTXT, related to input validation errors, allows a intruder to trigger an error (MNRF) and cause service failure.

The vulnerability of the microprogramming software for Rockwell Automation’s EtherNet/IP adapters model 5015-AENFTXT is related to input validation errors. Exploiting this vulnerability can allow an attacker to trigger the Error Message Recovery MNRF and cause service failure...

The vulnerability of the Model Manager component in the IBM Engineering Systems Design Rhapsody integrated development environment allows a attacker to execute arbitrary code.

The vulnerability of the Model Manager component in the integrated development environment designed for the design, modeling, and development of complex engineering systems, IBM Engineering Systems Design Rhapsody, is related to synchronization errors when using a shared resource “Race Situation”...

The vulnerability of the deployment and model management software for deep learning in the Intel Distribution of OpenVINO Model Server lies in insufficient validation of input data, allowing attackers to trigger service failures.

The vulnerability of the deployment and model management software for deep learning in the Intel Distribution of OpenVINO Model Server is related to insufficient testing of input data. Exploiting this vulnerability can allow attackers to cause service failures...

PT-2024-35885 · Praca.Pl Sp. Z O.O. · Praca.Pl

Name of the Vulnerable Software and Affected Versions: Praca.Pl sp. Z o.O. Znajdź Pracę z Praca.Pl versions n/a through 2.2.3 Description: The issue affects Praca.Pl sp. Z o.O. Znajdź Pracę z Praca.Pl, allowing DOM-Based XSS due to improper neutralization of input during web page generation. This...

CVE-2024-53983

The Backstage Scaffolder plugin Houses types and utilities for building scaffolder-related modules. A vulnerability is identified in Backstage Scaffolder template functionality where Server-Side Template Injection SSTI can be exploited to perform Git config injection. The vulnerability allows an...

CVE-2024-53983 Server-side request forgery in Backstage Scaffolder plugin

The Backstage Scaffolder plugin Houses types and utilities for building scaffolder-related modules. A vulnerability is identified in Backstage Scaffolder template functionality where Server-Side Template Injection SSTI can be exploited to perform Git config injection. The vulnerability allows an...

CVE-2024-52781

DCME-320 =7.4.12.90, DCME-520 =9.25.5.11, DCME-320-L =9.3.5.26, and DCME-720 =9.1.5.11 are vulnerable to Remote Code Execution via /function/system/tool/traceroute.php...

Race Condition Attacks against LLMs

These are two attacks against the system components surrounding LLMs: We propose that LLM Flowbreaking, following jailbreaking and prompt injection, joins as the third on the growing list of LLM attack types. Flowbreaking is less about whether prompt or response guardrails can be bypassed, and mo...

DEBIAN-CVE-2024-11694

Enhanced Tracking Protection's Strict mode may have inadvertently allowed a CSP frame-src bypass and DOM-based XSS through the Google SafeFrame shim in the Web Compatibility extension. This issue could have exposed users to malicious frames masquerading as legitimate content. This vulnerability...

Wiz collaborates with NVIDIA to advance ML research for data classification

Wiz Research taps Llama 3 model NVIDIA NIM microservices for sensitive data classification...

CVE-2024-33605

Improper processing of some parameters of installedemanuallist.html leads to a path traversal vulnerability. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under References...

CVE-2024-28038

The web interface of the affected devices processes a cookie value improperly, leading to a stack buffer overflow. More precisely, giving too long character string to MFPSESSIONID parameter results in a stack buffer overflow. As for the details of affected product names, model numbers, and...

CVE-2024-36251

The web interface of the affected devices process some crafted HTTP requests improperly, leading to a device crash. More precisely, a crafted parameter to billcodedefsubsel.html is not processed properly and device-crash happens. As for the details of affected product names, model numbers, and...

CVE-2024-36251

The CVE-2024-36251 entry covers Sharp MFP devices whose web interface processes crafted HTTP requests that can crash the device. Specifically, a crafted parameter to billcodedef_sub_sel.html is not processed correctly, causing a device crash. Sources from Red Hat, NVD, CVE list aggregations, and ...

CVE-2024-36249

Cross-site scripting vulnerability exists in Sharp Corporation and Toshiba Tech Corporation multiple MFPs multifunction printers. If this vulnerability is exploited, an arbitrary script may be executed on the administrative page of the affected MFPs. As for the details of affected product names,...

CVE-2024-33616

Admin authentication can be bypassed with some specific invalid credentials, which allows logging in with an administrative privilege. Sharp Corporation states the telnet feature is implemented on older models only, and is planning to provide the firmware update to remove the feature. As for the...

CVE-2024-28955

CVE-2024-28955 affects Sharp/Toshiba TEC MFPs. The issue arises from incorrect permission assignment, causing crash coredump files to be world-readable; any local user can inspect memory contents. Public details cover affected models/versions through vendor notices and related advisories. Remedia...