CVE-2024-39206

CVE-2024-39206 affects MSP360 Backup Agent versions 7.8.5.15 and 7.9.4.84. The issue arises because enginesettings.list is encrypted with a hard-coded key, enabling an attacker to obtain network share credentials used in backups. Red Hat and CVE listings corroborate the vulnerable versions and im...

PT-2024-28386 · Msp360 · Msp360 Backup Agent

Name of the Vulnerable Software and Affected Versions: MSP360 Backup Agent versions 7.8.5.15 through 7.9.4.84 Description: An issue in the software allows attackers to obtain network share credentials used in a backup. This is due to the enginesettings.list being encrypted with a hard-coded key...

CVE-2024-39206

An issue discovered in MSP360 Backup Agent v7.8.5.15 and v7.9.4.84 allows attackers to obtain network share credentials used in a backup due to enginesettings.list being encrypted with a hard coded key...

Remote Code Execution (RCE)

Overview Affected versions of this package are vulnerable to Remote Code Execution RCE via the ValidateVersion function. An attacker with administrative access can set up a network share and supply a UNC path to the /System/MediaEncoder/Path endpoint, which points to an executable on the network...

CVE-2023-48702

Jellyfin is a system for managing and streaming media. Prior to version 10.8.13, the /System/MediaEncoder/Path endpoint executes an arbitrary file using ProcessStartInfo via the ValidateVersion function. A malicious administrator can setup a network share and supply a UNC path to...

CVE-2023-48702 Jellyfin Possible Remote Code Execution via custom FFmpeg binary

Jellyfin is a system for managing and streaming media. Prior to version 10.8.13, the /System/MediaEncoder/Path endpoint executes an arbitrary file using ProcessStartInfo via the ValidateVersion function. A malicious administrator can setup a network share and supply a UNC path to...

CVE-2023-48702 Jellyfin Possible Remote Code Execution via custom FFmpeg binary

Jellyfin is a system for managing and streaming media. Prior to version 10.8.13, the /System/MediaEncoder/Path endpoint executes an arbitrary file using ProcessStartInfo via the ValidateVersion function. A malicious administrator can setup a network share and supply a UNC path to...

PT-2023-30911 · Jellyfin · Jellyfin

Name of the Vulnerable Software and Affected Versions: Jellyfin versions prior to 10.8.13 Description: Jellyfin is a system for managing and streaming media. The /System/MediaEncoder/Path endpoint executes an arbitrary file using ProcessStartInfo via the ValidateVersion function. A malicious...

Jellyfin Command Injection Vulnerability

Jellyfin is a freeware media system. It allows you to control the management and streaming of media. It is an alternative to the proprietary Emby and Plex and can serve media from a dedicated server to end-user devices through multiple applications. A command injection vulnerability exists in...

CVE-2023-23539

A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.2. Mounting a maliciously crafted Samba network share may lead to arbitrary code execution...

Buffer overflow

A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.2. Mounting a maliciously crafted Samba network share may lead to arbitrary code execution...

CVE-2023-23539

A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.2. Mounting a maliciously crafted Samba network share may lead to arbitrary code execution...

CVE-2023-23539

CVE-2023-23539 affects macOS Ventura (13.2) and is tied to a buffer overflow in the Samba/network share handling (dcerpc path) that could allow arbitrary code execution when mounting a malicious Samba share. Apple confirms the fix in Ventura 13.2. Public references in the connected records corrob...

CVE-2023-23539

A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13.2. Mounting a maliciously crafted Samba network share may lead to arbitrary code execution...

CVE-2023-23513

A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Big Sur 11.7.3, macOS Ventura 13.2, macOS Monterey 12.6.3. Mounting a maliciously crafted Samba network share may lead to arbitrary code execution...

CVE-2023-23513

A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Big Sur 11.7.3, macOS Ventura 13.2, macOS Monterey 12.6.3. Mounting a maliciously crafted Samba network share may lead to arbitrary code execution...

SUSE CVE-2012-1945

Mozilla Firefox 4.x through 12.0, Firefox ESR 10.x before 10.0.5, Thunderbird 5.0 through 12.0, Thunderbird ESR 10.x before 10.0.5, and SeaMonkey before 2.10 allow local users to obtain sensitive information via an HTML document that loads a shortcut aka .lnk file for display within an IFRAME...

SUSE CVE-2019-17401

libyal liblnk 20191006 has a heap-based buffer over-read in the networksharenameoffset20 code block of liblnklocationinformationreaddata in liblnklocationinformation.c, a different issue than CVE-2019-17264. NOTE: the vendor has disputed this as described in the GitHub issue...

Kardex Control Center 代码注入漏洞

Kardex Control Center is a logistics control and warehouse management system from Kardex Corporation. A security vulnerability exists in Kardex Control Center version 5.7.12+0-a203c2a213-master, which stems from user-controllable paths being passed to the path-concatenation method without proper...

macOS 12.x < 12.6.3 Multiple Vulnerabilities (HT213604)

The remote host is running a version of macOS / Mac OS X that is 12.x prior to 12.6.3. It is, therefore, affected by multiple vulnerabilities: - This issue was addressed by enabling hardened runtime. This issue is fixed in macOS Monterey 12.6.3, macOS Ventura 13.2, watchOS 9.3, macOS Big Sur...