Code injection

The Artica-Proxy administrative web application will deserialize arbitrary PHP objects supplied by unauthenticated users and subsequently enable code execution as the "www-data" user...

CVE-2024-1654

RESERVED This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided...

CVE-2024-1221

RESERVED This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided...

CVE-2024-1223

RESERVED This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided...

Authentication flaw

UNSUPPPORTED WHEN ASSIGNED Authentication Bypass by Primary Weakness vulnerability in XPodas Octopod allows Authentication Bypass.This issue affects Octopod: before v1. NOTE: The vendor was contacted and it was learned that the product is not supported...

CVE-2024-1176

RESERVED This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided...

CVE-2024-1853

CVE-2024-1853 affects Zemana AntiLogger v2.74.204.664. It exposes an Arbitrary Process Termination vulnerability by triggering IOCTL code 0x80002048 in the vulnerable drivers zam64.sys and zamguard64.sys , enabling an attacker to terminate processes. Public materials describe BYOVD-style driver a...

CVE-2024-26246

CVE-2024-26246 affects Microsoft Edge (Chromium-based). The vulnerability is described as a Security Feature Bypass in Edge, with the affected component being Edge’s Chromium-based browser. The available data indicate a Low base severity (CVSS 3.1: 3.9), with confidentiality impact High and no in...

CVE-2024-26163

CVE-2024-26163 affects Microsoft Edge (Chromium-based). A security feature bypass vulnerability with CVSSv3.1 base metrics: AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N (base score 4.7, MEDIUM). The issue is network-exploitable with user interaction required; impact is limited to bypassing security featur...

CVE-2024-0860

CVE-2024-0860 affects Softing edgeConnector (v3.60) and Softing edgeAggregator (v3.60). The vulnerability is cleartext transmission of sensitive information, allowing an attacker to capture packets and craft requests. Public sources (CISA ICS advisory ICSA-24-074-13 and ZDI) confirm the issue and...

CVE-2024-24562

CVE-2024-24562 affects vantage6-UI (the interface for the vantage6 server). The vulnerability is due to security headers not being set in affected versions. A fix has been committed (68dfa6614) and is expected in future releases; upgrade to a new release when available. If upgrading is not possib...

CVE-2024-23823

CVE-2024-23823 affects the vantage6 server, where CORS restrictions are not enforced, allowing configured origins to be unrestricted. The vulnerability stems from overly permissive CORS settings in the open-source vantage6 framework for Federated Learning and MPC deployments. The limited impact i...

CVE-2024-24770

Vantage6 exposes two API endpoints, /recover/lost and /2fa/lost, which allow an attacker to enumerate existing usernames via recovery-email behavior or timing differences. Root cause: inadequate access controls on recovery utilities leading to user enumeration. Impact: potential targeted credenti...

CVE-2024-22346

CVE-2024-22346 affects IBM i environments running Db2 for IBM i (versions 7.2–7.5). The underlying issue is an unqualified library call in Db2 for IBM i infrastructure that could allow a local user to gain elevated privileges, enabling user-controlled code to run with administrator privileges. Th...

CVE-2024-27265

IBM Integration Bus for z/OS (versions 10.1–10.1.0.3) is affected by CVE-2024-27265, a cross-site request forgery in the Admin WebUI that could allow an attacker to perform malicious, unauthorized actions trusted by a user. Publications from multiple sources (IBM Security Bulletin, NVD, Red Hat, ...

CVE-2024-27266

CVE-2024-27266 affects IBM Maximo Application Suite in the Maximo Asset Management/Manage component (example: MAS 7.6.1.3). The vulnerability is XML External Entity (XXE) processing, enabling a remote attacker to disclose sensitive data or consume memory resources. IBM and Red Hat/IBM bulletin re...

CVE-2024-28181

CVE-2024-28181 affects the TurboBoost Commands library. The issue is an insufficiently robust permission check that can allow an attacker to invoke more public methods on Command classes than intended, risking arbitrary code execution within affected applications. Concrete details in connected so...

CVE-2024-28849

Summary: CVE-2024-28849 affects the follow-redirects library (Node.js) used as a drop-in replacement for Node's http/https. The issue is that on cross-domain redirects, the authorization header is cleared but the proxy-authentication header, which may contain credentials, is not cleared, risking ...

CVE-2023-27502

Intel Local Manageability Service prior to v2316.5.1.2 is affected by CVE-2023-27502, which enables potential information disclosure via local access through log message disclosure. The issue is limited to authenticated Local Manageability Service users and involves sensitive data being written i...

CVE-2023-32633

CVE-2023-32633 concerns Intel® Converged Security Management Engine (CSME) installer: improper input validation before version 2328.5.5.0 may allow an authenticated user to escalate privileges via local access. The issue is documented with affected component as the CSME installer and is tied to l...