Apple macOS 安全漏洞

Apple macOS is a set of specialized operating systems developed for Mac computers by the American company Apple Apple. A security vulnerability exists in Apple macOS Sequoia versions prior to 15.2. An attacker can bypass kASLR by exploiting this vulnerability...

CVE-2024-54810: Improper Neutralization of Special Elements used in an SQL Command

A SQL Injection vulnerability was found in /preschool/admin/password-recovery.php in PHPGurukul Pre-School Enrollment System Project v1.0, which allows remote attackers to execute arbitrary code via the mobileno parameter...

PT-2024-36572 · Siyuan · Siyuan

Name of the Vulnerable Software and Affected Versions: SiYuan versions prior to 3.1.16 Description: SiYuan is a personal knowledge management system. The /api/export/exportResources endpoint is vulnerable to arbitrary file read via path traversal. It is possible to manipulate the paths parameter ...

Luigi 安全漏洞

Luigi is a Python package open-sourced by Spotify that helps build complex pipelines of batch jobs. A security vulnerability exists in Luigi versions prior to 3.6.0, which stems from incorrect validation of the destination file path in the extractpackagesarchive function, leaving it vulnerable to...

Digi ConnectPort 安全漏洞

Digi ConnectPort is a server from Digital Networks Malaysia Digi Inc. It provides wireless communication. A security vulnerability exists in Digi ConnectPort versions prior to 1.4.12 that stems from allowing file path manipulation via POST requests, which can result in the upload of arbitrary fil...

CVE-2024-11436 Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more! <= 1.4.19 - Reflected Cross-Site Scripting

The Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more! plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 1.4.19 due to insufficient input sanitization an...

CVE-2024-11436: Improper Neutralization of Input During Web Page Generation

The Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more! plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 1.4.19 due to insufficient input sanitization an...

CVE-2024-6219

Mark Laing discovered in LXD's PKI mode, until version 5.21.1, that a restricted certificate could be added to the trust store with its restrictions not honoured...

PT-2024-35916 · Unknown · Futurio Extra

Name of the Vulnerable Software and Affected Versions: Futurio Extra versions prior to 2.0.14 Description: The issue is related to improper neutralization of input during web page generation, which allows for stored Cross-site Scripting XSS. This enables attackers to inject malicious scripts into...

PT-2024-34179

Name of the Vulnerable Software and Affected Versions: Qsync Central versions prior to 4.4.0.16 Description: A link following vulnerability has been reported to affect Qsync Central, allowing remote attackers who have gained user access to traverse the file system to unintended locations...

PT-2025-3130 · Acronis · Acronis Cyber Protect 16

Name of the Vulnerable Software and Affected Versions: Acronis Cyber Protect 16 Windows versions before build 39169 Description: The issue is related to a local privilege escalation due to a DLL hijacking vulnerability. This vulnerability allows for local privilege escalation in affected products...

PT-2024-9403 · Siemens · Syngo.Plaza

Name of the Vulnerable Software and Affected Versions: syngo.plaza VB30E versions prior to VB30E HF05 Description: The issue is related to the lack of protection of the SQL query structure, allowing an attacker to execute arbitrary SQL code and compromise the database. The affected application do...

WordPress plugin WP Mailster SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection...

PT-2024-35954 · Rpgp · Rpgp

Name of the Vulnerable Software and Affected Versions: rPGP versions prior to 0.14.1 Description: The issue allows attackers to trigger resource exhaustion vulnerabilities in rPGP by providing crafted messages, affecting general message parsing and decryption with symmetric keys. This can cause...

TP-Link Archer C50 安全漏洞

TP-LINK Archer C50 is a wireless router from China P&L TP-LINK. A security vulnerability exists in TP-Link Archer C50 versions prior to V4 240917, which stems from an incorrect signature verification mechanism during the firmware upgrade process in the web interface, resulting in a fully...

CVE-2024-40717

A vulnerability in Veeam Backup & Replication allows a low-privileged user with certain roles to perform remote code execution RCE by updating existing jobs. These jobs can be configured to run pre- and post-scripts, which can be located on a network share and are executed with elevated privilege...

CVE-2024-40717

CVE-2024-40717 affects Veeam Backup & Replication (12.x prior to 12.3.0.310). A low-privileged user with certain roles can update an existing job and configure pre/post scripts (potentially on a network share) that run with elevated privileges, enabling remote code execution by scheduling near-im...

CVE-2024-40717: Missing Authentication for Critical Function

A vulnerability in Veeam Backup & Replication allows a low-privileged user with certain roles to perform remote code execution RCE by updating existing jobs. These jobs can be configured to run pre- and post-scripts, which can be located on a network share and are executed with elevated privilege...

Hewlett Packard Enterprise ClearPass Policy Manager 安全漏洞

Hewlett Packard Enterprise ClearPass Policy Manager is a wireless network security access management system from Hewlett Packard Enterprise. A security vulnerability in Hewlett Packard Enterprise ClearPass Policy Manager version 6.11.x prior to 6.11.9 and version 6.12.x prior to 6.12.2 stems from...

AZL-54224 CVE-2024-53124 affecting package kernel for versions less than 6.6.76.1-1

In the Linux kernel, the following vulnerability has been resolved: net: fix data-races around sk-skforwardalloc Syzkaller reported this warning: ------------ cut here ------------ WARNING: CPU: 0 PID: 16 at net/ipv4/afinet.c:156 inetsockdestruct+0x1c5/0x1e0 Modules linked in: CPU: 0 UID: 0 PID: ...