Design/Logic Flaw

A use-after-free issue was addressed with improved memory management. This issue is fixed in GarageBand 10.4.11. Processing a maliciously crafted file may lead to unexpected app termination or arbitrary code execution...

Cross site scripting

Cross Site Scripting XSS vulnerability in Code-projects Scholars Tracking System 1.0 allows attackers to run arbitrary code via the News Feed...

CVE-2024-23300

CVE-2024-23300 affects Apple GarageBand and is due to a use-after-free vulnerability in processing a crafted file. The issue was mitigated by improved memory management and is fixed in GarageBand 10.4.11. Potential impact includes unexpected app termination or arbitrary code execution locally. Af...

CVE-2024-27305

CVE-2024-27305 concerns the Python SMTP server reimplementation aiosmtpd and its vulnerability to inbound SMTP smuggling. The issue allows an attacker to craft spoofed sender addresses and conduct targeted phishing under certain SMTP server conditions. Technical details describe the vulnerability...

Design/Logic Flaw

A potential security vulnerability has been reported in the system BIOS of certain HP PC products, which might allow memory tampering. HP is releasing mitigation for the potential vulnerability...

CVE-2023-5410

CVE-2023-5410 concerns HP PC products’ system BIOS where a vulnerability could allow memory tampering. Public descriptions are consistent across NVD/Red Hat and HP sources, noting HP is releasing mitigations and has identified affected platforms with minimum mitigating SoftPaq versions. The Red H...

CVE-2024-28114

CVE-2024-28114 affects Peering Manager (BGP session management) with a Server‑Site Template Injection that enables Remote Code Execution in versions

CVE-2024-28112

CVE-2024-28112 affects Peering Manager (a BGP session management tool). The vulnerability is a stored XSS in the name attribute of AS or Platform, triggered on a router details page, allowing an attacker to execute arbitrary JavaScript in a victim’s context. Impact is primarily credential/log-in ...

CVE-2024-28121

CVE-2024-28121 affects StimulusReflex. A websocket payload targeting a reflex can trigger arbitrary method calls on the reflex instance, because the server locates the method and uses it (via public_send) without strict validation, risking unsafe methods (e.g., instance_variable_set, system). Thi...

CVE-2023-30968

CVE-2023-30968 corresponds to a stored cross-site scripting (XSS) issue in Gotham Gaia services (Palantir Gotham Gaia). The vulnerability allows an attacker to bypass Content Security Policy (CSP) and inject a persistent XSS payload on the stack. Documents consistently describe it as a stored XSS...

CVE-2024-28186

CVE-2024-28186 affects FreeScout (PHP). The root cause is that the application stores complete stack traces in its database, which are exposed to users via the endpoint /conversation/ajax-html/send_log?folder_id=&thread_id={id}. The stack traces reveal sensitive data, including the username and p...

CVE-2024-2031

CVE-2024-2031 affects the Video Conferencing with Zoom plugin for WordPress. The vulnerability is a Stored Cross-Site Scripting (XSS) in the shortcode used by the plugin, specifically the zoom_recordings_by_meeting shortcode, and impacts all versions up to and including 4.4.4. Root cause per the ...

CVE-2024-26048

Technical details for CVE-2024-26048 are not publicly available in the provided documents. No impacted products, versions, or root cause are specified. Monitor for updates.

Input validation

Improper input validation in the Pulsar Function Worker allows a malicious authenticated user to execute arbitrary Java code on the Pulsar Function worker, outside of the sandboxes designated for running user-provided functions. This vulnerability also applies to the Pulsar Broker when it is...

Design/Logic Flaw

The vulnerability allows authenticated users with only produce or consume permissions to modify topic-level policies, such as retention, TTL, and offloading settings. These management operations should be restricted to users with the tenant admin role or super user role. This issue affects Apache...

CVE-2024-27894

The CVE describes a vulnerability in Apache Pulsar where the Functions Worker can create functions whose implementation is fetched from a URL (file, http, https). An authenticated attacker could read any file the worker process can access (including environment secrets) and use the worker as a pr...

CVE-2024-27317

Root cause: a directory traversal in archive extraction when uploaded ZIPs (jar/nar) are processed by Pulsar Functions Worker, allowing creation/modification of files outside the extraction dir. Attack surface includes Pulsar Broker when functionsWorkerEnabled=true. Affected versions span 2.4.0–2...

CVE-2024-27135

CVE-2024-27135 — Apache Pulsar : The issue is caused by improper input validation in the Pulsar Function Worker , allowing an authenticated user to execute arbitrary Java code outside the designated sandboxes. The vulnerability also affects the Pulsar Broker when configured with functionsWorkerEn...

CVE-2022-34321

CVE-2022-34321 (Apache Pulsar Proxy) is an Improper Authentication vulnerability affecting Pulsar Proxy statistics at /proxy-stats. Connected docs specify impact: unauthorized access to live-connection stats and the ability to modify logging levels, potentially leaking client IPs and enabling DoS...

CVE-2024-28098

CVE-2024-28098 affects Apache Pulsar; authenticated users with produce or consume permissions can modify topic-level policies (retention, TTL, offloading). Affected versions include 2.7.1–2.10.5, 2.11.0–2.11.3, 3.0.0–3.0.2, 3.1.0–3.1.2, and 3.2.0. Patched upgrades are required: 2.10.6 or newer fo...