DataEase 数据伪造问题漏洞

DataEase is an open source data visualization and analysis tool from DataEase Open Source. It is used to help users quickly analyze data and gain insight into business trends to achieve business improvement and optimization. DataEase v2.10.2 version before the data forgery problem vulnerability ,...

PT-2024-35086

Name of the Vulnerable Software and Affected Versions changedetection.io versions prior to 0.47.06 Description The validation for the file URI scheme in changedetection.io falls short, allowing an attacker to read any file on the system. This issue only affects instances with a webdriver enabled...

CometBFT Vote Extensions: Panic when receiving a Pre-commit with an invalid data

Name: ASA-2024-011: Vote Extensions: Panic when receiving a Pre-commit with an invalid data Component: CometBFT Criticality: High Considerable Impact, and Possible Likelihood per ACMv1.2 Affected versions: = 0.38.x, unreleased v1.x and main development branches Affected users: Chain Builders +...

GHSA-P7MV-53F2-4CWJ CometBFT Vote Extensions: Panic when receiving a Pre-commit with an invalid data

Name: ASA-2024-011: Vote Extensions: Panic when receiving a Pre-commit with an invalid data Component: CometBFT Criticality: High Considerable Impact, and Possible Likelihood per ACMv1.2 Affected versions: = 0.38.x, unreleased v1.x and main development branches Affected users: Chain Builders +...

AZL-52257 CVE-2024-51744 affecting package cert-manager for versions less than 1.11.2-22

golang-jwt is a Go implementation of JSON Web Tokens. Unclear documentation of the error behavior in ParseWithClaims can lead to situation where users are potentially not checking errors in the way they should be. Especially, if a token is both expired and invalid, the errors returned by...

WS-2017-3764

Affected versions of this crate pre-allocate memory on deserializing raw buffers without checking whether there is sufficient data available. This allows an attacker to do denial-of-service attacks by sending small msgpack messages that allocate gigabytes of memory...

OESA-2024-2320 firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance and portability. Security Fixes: When a user typed a URL in the address bar or the search bar and quickly hit the enter key, a website could sometimes capture that event and then redirect the user before...

PT-2024-33679 · Oak · Oak

Name of the Vulnerable Software and Affected Versions: oak versions prior to 17.1.3 Description: The issue allows an attacker to bypass the default restriction on transferring hidden files using the Context.send API by encoding / as its URL encoded form %2F. This can potentially lead to reading...

PT-2024-28874 · Unknown · Sourcebans++

Name of the Vulnerable Software and Affected Versions: Sourcebans++ versions prior to 1.8.0 Description: The issue allows a remote attacker to obtain sensitive information via a crafted XAJAX call to the Forgot Password function. This occurs in Sourcebans++ when the attacker uses a crafted XAJAX...

PT-2024-35637

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.12-rc5 Description A vulnerability in the Linux kernel has been resolved, related to the wifi: rtlwifi driver. The issue arises when the driver attempts to read efuse in case of failures, resulting in a hung...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS due to improper sanitization in |markdown filter. An attacker to inject arbitrary JS into the page, by entering Markdown and then renders it with this filter. Note: Filters that use issafe need to make sure the...

North Korean Group Collaborates with Play Ransomware in Significant Cyber Attack

Threat actors linked to North Korea have been implicated in a recent incident that deployed a known ransomware family called Play, underscoring their financial motivations. The activity, observed between May and September 2024, has been attributed to a threat actor tracked as Jumpy Pisces , which...

IBM Flexible Service Processor Hardware Resource Management Access

The vulnerability of the software for managing and monitoring hardware resources of the IBM Flexible Service Processor FSP in IBM Power System software is related to the use of pre-installed account data. Exploiting this vulnerability can allow a malicious actor to gain access to FSP services...

CyberPanel 安全漏洞

CyberPanel is a web hosting control panel with built-in DNS and email servers by Usman Nasir, an individual developer. A security vulnerability exists in CyberPanel prior to version 2.3.5, which stems from a command injection vulnerability contained in completePath in the...

CVE-2024-48825

Tenda AC7 v.15.03.06.44 ateifconfigset has pre-authentication command injection allowing remote attackers to execute arbitrary code...

CVE-2024-48826

Tenda AC7 v.15.03.06.44 ateiwprivset has pre-authentication command injection allowing remote attackers to execute arbitrary code...

CVE-2024-48825

Tenda AC7 v.15.03.06.44 ateifconfigset has pre-authentication command injection allowing remote attackers to execute arbitrary code...

CVE-2024-48826

Tenda AC7 v.15.03.06.44 ateiwprivset has pre-authentication command injection allowing remote attackers to execute arbitrary code...

CVE-2024-48825

Tenda AC7 v.15.03.06.44 ateifconfigset has pre-authentication command injection allowing remote attackers to execute arbitrary code...

SCKU Dome Privilege Escalation

The vulnerability of the SCKU Dome software is related to the presence of pre-installed account data. Exploiting this vulnerability can allow a remote attacker to enhance their privileges within the system and gain access to protected information...