CVE-2023-37822

The Eufy Homebase 2 before firmware version 3.3.4.1h creates a dedicated wireless network for its ecosystem, which serves as a proxy to the end user's primary network. The WPA2-PSK generation of this dedicated network is flawed and solely based on the serial number. Due to the flawed generation...

AZL-49976 CVE-2024-8508 affecting package unbound for versions less than 1.19.1-3

NLnet Labs Unbound up to and including version 1.21.0 contains a vulnerability when handling replies with very large RRsets that it needs to perform name compression for. Malicious upstreams responses with very large RRsets can cause Unbound to spend a considerable time applying name compression ...

Exploit for CVE-2024-9441

Nortek Linear eMerge E3 Pre-Auth RCE PoC CVE-2024-9441...

Portainer 安全漏洞

Portainer is a lightweight user management interface for managing Docker environments and Docker hosts from Portainer Open Source. A security vulnerability exists in Portainer versions prior to 2.20.2 that stems from incorrect use of a cryptographic algorithm in the AesEncrypt function...

Jenkins 安全漏洞

Jenkins is a Jenkins open source application. An open source automation server Jenkins provides hundreds of plugins to support building, deploying and automating any project. A security vulnerability exists in Jenkins 2.478 and earlier and LTS 2.462.2 and earlier, which stems from not editing...

TOTOLink T10 Router Telnet Access

The vulnerability of the file /squashfs-root/webcste/cgi-bin/product.ini of the TOTOLink T10 microprogramming router software is related to the use of pre-installed credentials. Exploiting this vulnerability could allow an attacker to gain unauthorized access to the Telnet service...

PT-2024-32384 · Alist +1 · Alist +1

Name of the Vulnerable Software and Affected Versions: AList versions prior to 3.29.0 Description: AList, a file list program supporting multiple storages, contains a reflected cross-site scripting issue in the helper.go file. The endpoint "/i/:link name" takes a user-provided value and reflects ...

RestrictedPython 信息泄露漏洞

RestrictedPython is a Zope open source tool that helps define a subset of the Python language that allows program input to be provided to a trusted environment. An information disclosure vulnerability exists in RestrictedPython versions prior to 7.3. An attacker exploiting this vulnerability coul...

PT-2024-38885 · WordPress · Starbox

Name of the Vulnerable Software and Affected Versions: Starbox WordPress plugin versions prior to 3.5.3 Description: The issue concerns the improper rendering of social media profiles URLs in certain contexts, such as a malicious user's profile or pages where the starbox shortcode is used. This c...

PT-2024-39078 · WordPress · Ultimate Blocks

Name of the Vulnerable Software and Affected Versions: The Ultimate Blocks WordPress plugin versions prior to 3.2.2 Description: The issue is related to the Ultimate Blocks WordPress plugin, which does not validate and escape some of its block attributes before outputting them back in a page or...

Updated java-1.8.0-openjdk, java-11-openjdk, java-17-openjdk, & java-latest-openjdk packages fix security vulnerabilities

Potential UTF8 size overflow. CVE-2024-21131 Excessive symbol length can lead to infinite loop. CVE-2024-21138 Range Check Elimination RCE pre-loop limit overflow. CVE-2024-21140 Pack200 increase loading time due to improper header validation. CVE-2024-21144 Out-of-bounds access in 2D image...

CVE-2024-8607

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Oceanic Software ValeApp allows SQL Injection.This issue affects ValeApp: before v2.0.0...

OESA-2024-2196 assimp security update

Assimp is a library to load and process geometric scenes from various data formats. Assimp aims to provide a full asset conversion pipeline for use in game engines and real-time rendering systems of any kind, but is not limited to this purpose. Security Fixes: Heap-based buffer overflow...

PT-2024-32275 · Ipswitch · Whatsup Gold

Name of the Vulnerable Software and Affected Versions: WhatsUp Gold versions prior to 2024.0.1 Description: A SQL Injection issue allows an authenticated lower-privileged user, with at least Network Manager permissions, to achieve privilege escalation to the admin account. This is related to the...

CVE-2024-47170 Agnai File Disclosure Vulnerability: JSON via Path Traversal

Agnai is an artificial-intelligence-agnostic multi-user, mult-bot roleplaying chat system. A vulnerability in versions prior to 1.0.330 permits attackers to read arbitrary JSON files at attacker-chosen locations on the server. This issue can lead to unauthorized access to sensitive information an...

AZL-50184 CVE-2024-0133 affecting package nvidia-container-toolkit for versions less than 1.16.2-1

NVIDIA Container Toolkit 1.16.1 or earlier contains a vulnerability in the default mode of operation allowing a specially crafted container image to create empty files on the host file system. This does not impact use cases where CDI is used. A successful exploit of this vulnerability may lead to...

PT-2024-32279

Name of the Vulnerable Software and Affected Versions Progress Software WhatsUp Gold versions prior to 2024.0.1 Description This issue involves a directory traversal that can lead to remote code execution. An unauthenticated remote attacker can exploit this to execute code within the context of t...

Shields 注入漏洞

Shields is a project of Shields open source. An injection vulnerability exists in versions prior to Shields server-2024-09-25, which stems from the JSONPath library used via dynamic JSON/Toml/Yaml badges that can be used against Shields.io instances...

Ory Kratos 授权问题漏洞

Ory Kratos is a developer-friendly, secure, and proven cloud identity, user management, and authentication system from Ory Open Source. An authorization issue vulnerability exists in Ory Kratos versions prior to 1.3.0 that stems from the highestavailable setting incorrectly assuming that the...

PT-2024-31393 · Ory · Ory Kratos

Name of the Vulnerable Software and Affected Versions: Ory Kratos versions prior to 1.3.0 Description: Ory Kratos is an identity, user management, and authentication system for cloud services. The highest available setting incorrectly assumes the identity's highest available Authenticator Assuran...