231554 matches found
CVE-2024-5027
CVE-2024-5027 affects Citrix Workspace app for Mac (pre-2402.10). Elevation of privilege from a local authenticated user to root is possible. Remedy: upgrade to Citrix Workspace app for Mac 2402.10 or later (per CTX675851). If details on root-cause are not provided, note that explicit root-cause ...
CVE-2024-3657
The CVE-2024-3657 entry affects 389-ds-base and is described as a denial-of-service vulnerability via a specially crafted LDAP query that can cause the directory server to fail. The connected advisories (Amazon Linux 2, MiracleLinux, TencentOS, etc.) confirm affected 389-ds-base versions and refe...
CVE-2024-5415
PhpMyBackupPro 2.3 is affected by a cross‑site scripting (XSS) vulnerability in the /phpmybackuppro/backup.php endpoint via the comments and db parameters. The issue allows crafting a URL to exfiltrate session details; CVSSv3.1 vectors indicate Network attack, low complexity, no privileges, user ...
CVE-2024-5414
CVE-2024-5414 affects PhpMyBackupPro v2.3. A cross-site scripting (XSS) flaw exists in the /phpmybackuppro/get_file.php endpoint via the view parameter, enabling an attacker to craft a URL that may exfiltrate a victim’s session details. Exploitation details are not provided in the core CVE text, ...
CVE-2024-5413
CVE-2024-5413 concerns a cross-site scripting (XSS) vulnerability in PhpMyBackupPro version 2.3. The issue is disclosed as an XSS in the endpoint "/phpmybackuppro/scheduled.php" that processes multiple parameters, enabling an attacker to craft a URL that could reveal a victim’s session details. T...
CVE-2024-2199
A denial of service vulnerability was found in 389-ds-base ldap server. This issue may allow an authenticated user to cause a server crash while modifying userPassword using malformed input...
CVE-2023-37411
CVE-2023-37411 affects IBM Aspera Faspex 5.0.0–5.0.6, where an input validation/escaping flaw enables stored cross-site scripting in the Web UI, potentially leading to credential disclosure within a trusted session. The issue stems from inadequate filtering of user-supplied data in Faspex and is ...
CVE-2024-2199
CVE-2024-2199 affects 389-ds-base (LDAP server). An authenticated user could cause a server crash while modifying the userPassword field with malformed input, resulting in a denial of service. Connected advisories confirm the issue across multiple distributions (e.g., Red Hat, Debian, Amazon Linu...
CVE-2024-28793
IBM Engineering Workflow Management (EWM) versions 7.0.2 and 7.0.3 are vulnerable to a stored cross-site scripting flaw in the Team Concert Git Jenkins plugin, caused by insufficient input cleanup and output escaping in the Web UI. This could allow injection of arbitrary JavaScript that may lead ...
CVE-2024-5411
Missing input validation and OS command integration of the input in the ORing IAP-420 web-interface allows authenticated command injection.This issue affects IAP-420 version 2.01e and below...
CVE-2024-5411
Summary: CVE-2024-5411 affects ORing IAP-420 web interface (version 2.01e and earlier). The root cause is missing input validation and OS command integration of user input, enabling authenticated command injection and potentially full device compromise. Exploitation requires authentication to the...
CVE-2024-5410
CVE-2024-5410 affects ORing IAP-420 web-interface (version 2.01e and earlier). The stored XSS vulnerability can be triggered by injecting JavaScript into the SSID input field, and the filename parameter in a configuration file upload is prone to command injection, potentially giving an attacker c...
CVE-2023-52711
Various Issues Due To Exposed SMI Handler in AmdPspP2CmboxV2. The first issue can be leveraged to bypass the protections that have been put in place by previous UEFI phases to prevent direct access to the SPI flash. The second issue can be used to both leak and corrupt SMM memory thus potentially...
CVE-2023-52712
Various Issues Due To Exposed SMI Handler in AmdPspP2CmboxV2. The first issue can be leveraged to bypass the protections that have been put in place by previous UEFI phases to prevent direct access to the SPI flash. The second issue can be used to both leak and corrupt SMM memory, thus potentiall...
CVE-2023-52548
Huawei Matebook D16Model: CREM-WXX9, BIOS: v2.26 Arbitrary Memory Corruption in SMI Handler of ThisiServicesSmm SMM module. This can be leveraged by a malicious OS attacker to corrupt arbitrary SMRAM memory and, in turn, lead to code execution in SMM...
CVE-2023-52547
Huawei Matebook D16Model: CREM-WXX9, BIOS: v2.26. Memory Corruption in SMI Handler of HddPassword SMM Module. This can be leveraged by a malicious OS attacker to corrupt data structures stored at the beginning of SMRAM and can potentially lead to code execution in SMM...
CVE-2023-52711
CVE-2023-52711 involves an exposed SMI handler in AMD’s PspP2CmboxV2 firmware (AmdPspP2CmboxV2) that can bypass protections from prior UEFI phases and grant direct access to SPI flash. Additionally, the issue can leak and corrupt SMM memory, potentially enabling code execution in SMM. Connected s...
CVE-2023-52548
CVE-2023-52548 affects Huawei Matebook D16 (Model CREM-WXX9; BIOS v2.26). A buffer/ARbitrary memory corruption in the SMI Handler of the ThisiServicesSmm SMM module can allow a local attacker to corrupt SMRAM memory and potentially achieve code execution in SMM. Documented impact is high (CVE CVS...
CVE-2023-52547
Huawei Matebook D16 (Model CREM-WXX9, BIOS v2.26) is affected by memory corruption in the SMI Handler of the HddPassword SMM Module, which can corrupt data structures at the start of SMRAM and potentially enable code execution in SMM. This vulnerability, described in CVE-2023-52547 and linked Hua...