CVE-2024-21127: Uncontrolled Resource Consumption

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: DDL. Supported versions that are affected are 8.0.37 and prior and 8.4.0 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server...

CVE-2024-21138: Undefined Security Weakness

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Hotspot. Supported versions that are affected are Oracle Java SE: 8u411, 8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM for JDK: 17.0.11, 21.0.3, 22.0....

CVE-2024-21131: Undefined Security Weakness

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Hotspot. Supported versions that are affected are Oracle Java SE: 8u411, 8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM for JDK: 17.0.11, 21.0.3, 22.0....

CVE-2024-21140: Exposure of Sensitive Information to an Unauthorized Actor

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Hotspot. Supported versions that are affected are Oracle Java SE: 8u411, 8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM for JDK: 17.0.11, 21.0.3, 22.0....

CVE-2024-3799 Shell command injection in Phoniebox

Insecure handling of POST header parameter body included in requests being sent to an instance of the open-source project Phoniebox allows an attacker to create a website, which – when visited by a user – will send malicious requests to multiple hosts on the local network. If such a request reach...

Juniper SSR Security Bypass (JSA83126)

An Authentication Bypass Using an Alternate Path or Channel vulnerability in Juniper Networks Session Smart Router or conductor running with a redundant peer allows a network based attacker to bypass authentication and take full control of the device. Only routers or conductors that are running i...

PT-2024-20710

Name of the Vulnerable Software and Affected Versions IBM Storage Defender - Resiliency Service versions 2.0.0 through 2.0.4 Description The issue is related to an inadequate account lockout setting, which could allow an attacker on the network to brute force account credentials. Recommendations...

CVE-2024-25031: Improper Restriction of Excessive Authentication Attempts

IBM Storage Defender - Resiliency Service 2.0.0 through 2.0.4 uses an inadequate account lockout setting that could allow an attacker on the network to brute force account credentials. IBM X-Force ID: 281678...

CVE-2024-2973 Session Smart Router(SSR): On redundant router deployments API authentication can be bypassed

An Authentication Bypass Using an Alternate Path or Channel vulnerability in Juniper Networks Session Smart Router or conductor running with a redundant peer allows a network based attacker to bypass authentication and take full control of the device. Only routers or conductors that are running i...

CVE-2024-35260: Untrusted Search Path

An authenticated attacker can exploit an untrusted search path vulnerability in Microsoft Dataverse to execute code over a network...

CVE-2024-37825

An issue in EnvisionWare Computer Access & Reservation Control SelfCheck v1.0 fixed in OneStop 3.2.0.27184 Hotfix May 2024 allows unauthenticated attackers on the same network to perform a directory traversal...

Server Side Request Forgery

@strapi/strapi is vulnerable to Server Side Request Forgery. The vulnerability is due to improper url parameter validation within the /strapi.io/next/image endpoint, which allows an attacker to send request to internal resources on the network...

PT-2024-20522

Name of the Vulnerable Software and Affected Versions Silicon Labs Gecko OS affected versions not specified Description This issue allows network-adjacent attackers to execute arbitrary code on affected installations. Authentication is not required to exploit this issue. The specific flaw exists...

PT-2024-37480 · Wyze · Wyze Cam V3

Name of the Vulnerable Software and Affected Versions: Wyze Cam v3 affected versions not specified Description: This issue allows network-adjacent attackers to execute arbitrary code on affected installations of Wyze Cam v3 IP cameras. The specific flaw exists within the "run action batch" endpoi...

PT-2024-20205 · Alpine · Alpine Halo9

Name of the Vulnerable Software and Affected Versions: Alpine Halo9 affected versions not specified Description: This issue allows network-adjacent attackers to execute arbitrary code on affected installations of Alpine Halo9 devices. An attacker must first obtain the ability to pair a malicious...

The vulnerability of the PT Network Attack Discovery (PT NAD) traffic analysis system arises from the failure to take measures to neutralize special elements used in the operating system’s command set. This allows attackers to execute arbitrary commands on behalf of the superuser.

The vulnerability of the PT Network Attack Discovery PT NAD traffic analysis system exists due to the lack of measures taken to neutralize specific elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands on behalf of the superuser...

PT-2024-31325

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.50 Description The issue is related to a deadlock that occurs when irqfd wakeup gets EPOLLHUP and is called by eventfd release through wake up poll&ctx-wqh, EPOLLHUP, which is called under spin lock irqsave...

CVE-2024-37662

TP-LINK TL-7DR5130 v1.0.23 is vulnerable to TCP DoS or hijacking attacks. An attacker in the same WLAN as the victim can disconnect or hijack the traffic between the victim and any remote server by sending out forged TCP RST messages to evict NAT mappings in the router...

PT-2024-01: OS Command Injection in PT Network Attack Discovery (PT NAD)

The vulnerability was identified in PT NAD affecting versions 12.0.x to 12.0.577. The vulnerability can be exploited by an attacker with network access to PT NAD to remotely execute OS commands as a superuser. Ability of exploitation depends on the configuration. Authorization is not required for...

PT-2024-4155

Name of the Vulnerable Software and Affected Versions PT Network Attack Discovery PT NAD affected versions not specified Description The issue exists due to the lack of measures to neutralize special elements in the PT Network Attack Discovery PT NAD system, allowing a remote attacker to execute...