885 matches found
Cross-site Scripting (XSS)
Overview phpmyadmin/phpmyadmin is a web interface for MySQL and MariaDB. Affected versions of this package are vulnerable to Cross-site Scripting XSS through the check tables feature due to improper user input sanitization in the getIndexesProblems function. An attacker can inject malicious scrip...
Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS : Cyrus IMAP Server vulnerabilities (USN-7224-1)
The remote Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7224-1 advisory. It was discovered that non-authentication-related HTTP requests could be interpreted in an authentication context by ...
CVE-2024-38337
IBM Sterling Secure Proxy (versions 6.0.0.0–6.2.0.0) is affected by an improper permission assignment vulnerability (CWE-732) that could allow an unauthorized attacker to retrieve or alter sensitive information due to incorrect permissions on a critical resource. The IBM Security Bulletin confirm...
EulerOS 2.0 SP9 : python-requests (EulerOS-SA-2025-1061)
According to the versions of the python-requests package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : An unclaimed Amazon S3 bucket, 'codeconf', is referenced in an audio file link within the .rst documentation file. This bucket has been...
CVE-2024-5872
On affected platforms running Arista EOS, a specially crafted packet with incorrect VLAN tag might be copied to CPU, which may cause incorrect control plane behavior related to the packet, such as route flaps, multicast routes learnt, etc...
ROS-20250109-03
Vulnerability of GLPI system of requests, incidents and inventory of computer equipment is related to Failure to take measures to protect the SQL query structure. Exploitation of the vulnerability could allow an attacker, acting remotely, to execute arbitrary code Vulnerability of the GLPI system...
ZenML < 0.55.5 Vulnerability - CVE-2024-2032
The version of ZenML installed on the remote host is prior to 0.55.5. It is, therefore, affected by a race condition vulnerability which allows for the creation of multiple users with the same username when requests are sent in parallel. The vulnerability arises due to insufficient handling of...
CVE-2024-56713 net: netdevsim: fix nsim_pp_hold_write()
In the Linux kernel, the following vulnerability has been resolved: net: netdevsim: fix nsimppholdwrite nsimppholdwrite has two problems: 1 It may return with rtnl held, as found by syzbot. 2 Its return value does not propagate an error if any...
USN-7159-4: Linux kernel (IoT) vulnerabilities
Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM32 architecture; - ARM64 architecture; - S390 architecture; - x86 architecture; - Power management core; - GPU...
CWA for Windows (2409) crashes or no sound when playing audio with Adaptive Audio disabled
When Adaptive Audio is disabled, the following errors may be encountered. CWA Windows session will suddenly crash when playing audio CWA Window session will not have any audio playback sound...
CVE-2024-56170
A validation integrity issue was discovered in Fort through 1.6.4 before 2.0.0. RPKI manifests are listings of relevant files that clients are supposed to verify. Assuming everything else is correct, the most recent version of a manifest should be prioritized over other versions, to prevent...
CVE-2024-8650
An issue was discovered in GitLab CE/EE affecting all versions from 15.0 prior to 17.4.6, 17.5 prior to 17.5.4, and 17.6 prior to 17.6.2 that allowed non-member users to view unresolved threads marked as internal notes in public projects merge requests...
CVE-2024-11759
The Bukza plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bukza' shortcode in all versions up to, and including, 2.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, wi...
CVE-2024-28146 Hardcoded credentials
The application uses several hard-coded credentials to encrypt config files during backup, to decrypt the new firmware during an update and some passwords allow a direct connection to the database server of the affected device...
CVE-2024-12292
An issue was discovered in GitLab CE/EE affecting all versions starting from 11.0 prior to 17.4.6, starting from 17.5 prior to 17.5.4, and starting from 17.6 prior to 17.6.2, where sensitive information passed in GraphQL mutations may have been retained in GraphQL logs...
EulerOS 2.0 SP11 : expat (EulerOS-SA-2024-2980)
According to the versions of the expat package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : An issue was discovered in libexpat before 2.6.3. xmlparse.c does not reject a negative length for XMLParseBuffer.CVE-2024-45490 An issue was...
SUSE-SU-2024:4148-1 Security update for MozillaThunderbird
This update for MozillaThunderbird fixes the following issues: - Mozilla Thunderbird 128.5 fixed: IMAP could crash when reading cached messages fixed: Enabling 'Show Folder Size' on Maildir profile could render Thunderbird unusable fixed: Messages corrupted by folder compaction were only fixed by...
Printer problems? Beware the bogus help
Anyone who has ever used a printer likely has had a frustrating experience at some point. There always seems to be some kind of issue with the software not responding, paper getting jammed or one of many other possible failures. When people need help, they often turn to Google and now AI to look...
CVE-2024-11669
An issue was discovered in GitLab CE/EE affecting all versions from 16.9.8 before 17.4.5, 17.5 before 17.5.3, and 17.6 before 17.6.1. Certain API endpoints could potentially allow unauthorized access to sensitive data due to overly broad application of token scopes...
