CVE-2024-24693

CVE-2024-24693 affects Zoom Rooms Client for Windows prior to 5.17.5. The issue is improper access control in the installer, which may allow an authenticated user to trigger a denial of service via local access. Affected component is the Windows installer, with the root cause described as install...

Denial of service

A denial of service vulnerability exists in Arcserve Unified Data Protection 9.2 and 8.1 in ASNative.dll...

Path traversal

A path traversal vulnerability exists in Arcserve Unified Data Protection 9.2 and 8.1 in edge-app-base-webui.jar!com.ca.arcserve.edge.app.base.ui.server.servlet.ImportNodeServlet...

CVE-2024-0800

CVE-2024-0800 affects Arcserve Unified Data Protection versions 8.1–9.2. The issue is a path traversal in edge-app-base-webui.jar, specifically ImportNodeServlet, allowing traversal of filesystem paths. Impact details are consistent across sources (high severity per CVSS metrics). PT-Security not...

CVE-2024-0799

Arcserve UDP (Arcserve Unified Data Protection) 8.1–9.2 is affected by an authentication bypass in edge-app-base-webui.jar, specifically EdgeLoginServiceImpl.doLogin() within wizardLogin. The vulnerability enables bypassing authentication and unauthorized access. Documented impacted versions: 8.1...

CVE-2024-2432

CVE-2024-2432 affects the Palo Alto Networks GlobalProtect app for Windows. A local privilege escalation exists where a low-privilege user can gain elevated privileges by exploiting a race condition in the Windows client process (PanGpHip.exe). Public details describe how an unprivileged user cou...

CVE-2024-2431

CVE-2024-2431 concerns Palo Alto Networks GlobalProtect app. Multiple connected sources confirm a vulnerability where a non-privileged user can disable the GlobalProtect client in configurations that allow disabling with a passcode. The issue affects the GlobalProtect app and has an impact on ava...

De-risking Your Organization in Spite of NVD Delays

In the face of recent struggles with the National Vulnerability Database NVD, causing delays in analyzing Common Vulnerabilities and Exposures CVEs since February 12, 2024, a significant number of CVEs lacked essential metadata including severity scores and affected product details. Qualys remain...

CVE-2024-28195

The CVE-2024-28195 CSRF vulnerability affects the YourSpotify self-hosted dashboard (API and login flow). Affected versions are prior to 1.9.0, where CSRF protections were insufficient, enabling attackers to execute CSRF attacks that can retrieve, modify, or delete data on the victim instance. Re...

Race condition

Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain a TOCTOU race condition vulnerability. A local low privileged attacker could potentially exploit this vulnerability to gain access to otherwise unauthorized resources...

Authorization

Missing Authorization vulnerability in Cool Plugins Cryptocurrency Widgets – Price Ticker & Coins List.This issue affects Cryptocurrency Widgets – Price Ticker & Coins List: from n/a through 2.6.8...

CVE-2024-28196

CVE-2024-28196 affects YourSpotify (self-hosted Spotify tracking dashboard). The issue arises in versions

CVE-2024-0173

CVE-2024-0173 concerns Dell PowerEdge Server BIOS and Dell Precision Rack BIOS, where an improper parameter initialization vulnerability could allow a local, low-privilege attacker to read contents of non-SMM stack memory. Affected firmware is BIOS-level, with exploitation requiring local access ...

CVE-2024-20319

Cisco IOS XR Software contains a UDP forwarding code vulnerability that can allow an unauthenticated, adjacent attacker to bypass management plane protection and reach the SNMP server when SNMP is used with management plane protection. The issue arises from incorrect UDP forwarding when handling ...

CVE-2024-20315

Cisco IOS XR Software ACL bypass (CVE-2024-20315) affects MPLS/PW ingress ACL processing due to improper assignment of lookup keys to internal interface contexts, allowing unauthenticated remote traffic to access protected resources. Root cause: incorrect key-context mapping. Impact: bypass of co...

CVE-2024-20322

Cisco IOS XR Software vulnerability CVE-2024-20322 affects MPLS and Pseudowire ingress ACL processing. Root cause: improper assignment of lookup keys to internal interface contexts, enabling an unauthenticated remote attacker to bypass a configured ACL and access resources behind the device. Expl...

CVE-2024-20320

CVE-2024-20320 affects Cisco IOS XR Software on Cisco 8000 Series Routers and NCS 540/5700 Series; the issue is due to insufficient validation of arguments in the SSH client CLI command, allowing an authenticated, low-privileged attacker to escalate to root on the device. Cisco states software up...

CVE-2024-0154

Dell PowerEdge Server BIOS and Dell Precision Rack BIOS are affected by an improper parameter initialization vulnerability that could allow a local low-privilege attacker to read non-SMM stack memory. Affected components are BIOS-level code for Dell PowerEdge Server BIOS and Dell Precision Rack B...

CVE-2024-20327

Cisco IOS XR Software for ASR 9000 Series (PPPoE termination) is affected by CVE-2024-20327. The issue arises from improper handling of malformed PPPoE packets on a router running BNG PPPoE termination on Lightspeed-based line cards, allowing an unauthenticated adjacent attacker to crash the ppp_...

CVE-2024-27953

CVE-2024-27953 is a Missing Authorization vulnerability in Cryptocurrency Widgets – Price Ticker & Coins List (WordPress plugin). Affected: Cryptocurrency Widgets – Price Ticker & Coins List