CVE-2024-35179

CVE-2024-35179 affects Stalwart Mail Server prior to 0.8.0, where using RUN_AS_USER allows the specified user (including web-admins) to read arbitrary files as root. The underlying issue is tied to RUN_AS_USER usage, enabling privilege escalation to root-level file access. A patch is available in...

CVE-2024-35179 Unprivileged Stalwart Mail Server user can read files as root

Stalwart Mail Server is an open-source mail server. Prior to version 0.8.0, when using RUNASUSER, the specified user and therefore, web interface admins can read arbitrary files as root. This issue affects admins who have set up to run stalwart with RUNASUSER who handed out admin credentials to t...

BIT-CILIUM-2022-29178 Incorrect Default Permissions in Cilium

Cilium is open source software for providing and securing network connectivity and loadbalancing between application workloads. Cilium prior to versions 1.9.16, 1.10.11, and 1.11.15 contains an incorrect default permissions vulnerability. Operating Systems with users belonging to the group ID 100...

BIT-CILIUM-2022-29179 Improper Privilege Management in Cilium

Cilium is open source software for providing and securing network connectivity and loadbalancing between application workloads. Prior to versions 1.9.16, 1.10.11, and 1.11.15, if an attacker is able to perform a container escape of a container running as root on a host where Cilium is installed,...

Mozilla Firefox Security Bypass Vulnerability (CNVD-2024-23345)

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the U.S. Mozilla Firefox ESR is an extended support version of Firefox the web browser.Mozilla Thunderbird is a suite of e-mail client software that is separate from the Mozilla Application Suite. Mozilla Thunderbird is ...

PT-2024-40098 · Adobe · Magento Open Source +1

Name of the Vulnerable Software and Affected Versions: Magento Commerce and Open Source versions prior to 2.2.5 Magento Commerce and Open Source versions prior to 2.1.14 Description: The issue concerns remote code execution RCE, Cross-Site Scripting XSS, and other security problems...

Unspecified Vulnerability in Mozilla Firefox (CNVD-2024-23333)

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. Mozilla Firefox has a security vulnerability that can be exploited by attackers to obtain predictable values...

PT-2024-40137 · Adobe · Magento Open Source +1

Name of the Vulnerable Software and Affected Versions: Magento Commerce versions prior to 1.14.4.0 Magento Open Source versions prior to 1.9.4.0 Description: The issue concerns remote code execution RCE, cross-site scripting XSS, and cross-site request forgery CSRF among other vulnerabilities...

Mozilla Firefox Information Disclosure Vulnerability (CNVD-2024-23336)

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the U.S. Mozilla Firefox ESR is an extended support version of Firefox the web browser.Mozilla Thunderbird is a suite of e-mail client software that is separate from the Mozilla Application Suite. Mozilla Thunderbird is ...

Mozilla Firefox Code Execution Vulnerability (CNVD-2024-23338)

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A code execution vulnerability exists in Mozilla Firefox, which can be exploited by attackers to execute arbitrary code or cause a denial of service on a vulnerable system...

PT-2024-40249 · Jquery Foundation +1 · Jquery +2

Name of the Vulnerable Software and Affected Versions: Magento Commerce versions 1.9.0.0 through 1.14.4.0 Magento Open Source versions 1.5.0.0 through 1.9.4.0 Description: The issue concerns multiple vulnerabilities in Magento, including remote code execution RCE, cross-site scripting XSS, and...

Mozilla Firefox Security Bypass Vulnerability (CNVD-2024-23348)

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A security bypass vulnerability exists in Mozilla Firefox, which can be exploited by attackers to bypass security restrictions due to a window being disabled even after the file dialog box is displayed...

Bonitasoft 安全漏洞

Bonitasoft is an open source BPM software from Bonitasoft. Bonitasoft has a security vulnerability that stems from a lack of dynamic permissions, which leads to an IDOR vulnerability...

Mozilla Firefox Security Bypass Vulnerability (CNVD-2024-23346)

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A security bypass vulnerability exists in Mozilla Firefox, which can be exploited by an attacker to bypass security restrictions by bypassing the move semantics of one of the data members...

CVE-2024-34352

1Panel is an open source Linux server operation and maintenance management panel. Prior to v1.10.3-lts, there are many command injections in the project, and some of them are not well filtered, leading to arbitrary file writes, and ultimately leading to RCEs. The mirror configuration write symbol...

CVE-2024-34070

Froxlor is open source server administration software. Prior to 2.1.9, a Stored Blind Cross-Site Scripting XSS vulnerability was identified in the Failed Login Attempts Logging Feature of the Froxlor Application. An unauthenticated User can inject malicious scripts in the loginname parameter on t...

CVE-2024-33250

An issue in Open-Source Technology Committee SRS real-time video server RS/4.0.268Leo and SRS/4.0.195Leo allows a remote attacker to execute arbitrary code via a crafted request...

CVE-2024-32669

Improper Input Validation vulnerability in Samsung Open Source escargot JavaScript engine allows Overflow Buffers. However, it occurs in the test code and does not include in the release. This issue affects escargot: 4.0.0...

CVE-2024-3579

The CVE-2024-3579 entry concerns the Online Shopping System Advanced and its Reflected Cross-Site Scripting (XSS) vulnerability. The flaw is triggered when a user is convinced to visit a crafted URL, causing a script to run in the victim’s browser. The affected component is the web application’s ...

micromatch 安全漏洞

micromatch is a highly optimized wildcard and global matching library from the micromatch open source. A security vulnerability exists in micromatch that stems from an inability to limit the number of characters that can be processed, which could lead to memory exhaustion...