webcrack 安全漏洞

webcrack is a tool for reverse engineering javascript by the individual developer j4k0xb. A security vulnerability exists in webcrack that originates from an arbitrary file write vulnerability in the webcrack module when processing specially crafted malicious code on Windows systems...

webcrack has an Arbitrary File Write Vulnerability on Windows when Parsing and Saving a Malicious Bundle

Summary An arbitrary file write vulnerability exists in the webcrack module when processing specifically crafted malicious code on Windows systems. This vulnerability is triggered when using the unpack bundles feature in conjunction with the saving feature. If a module name includes a path...

CVE-2024-7754

SourceCodester Clinics Patient Management System 1.0 contains a SQL injection vulnerability in /ajax/check_medicine_name.php via the user_name parameter. The issue is remote-exploitable and has been publicly disclosed. Several sources (including PT Security and other CVE aggregations) corroborate...

The vulnerability of the software for detecting vulnerabilities and errors in PT Application Inspector, related to link processing errors, allows attackers to enhance their privileges and gain unauthorized access to protected information.

The vulnerability of the PT Application Inspector’s software for detecting vulnerabilities and errors is related to errors in link processing. Exploiting this vulnerability allows a malicious actor to enhance their privileges and gain unauthorized access to protected information...

CVE-2024-7113

If exploited, this vulnerability could cause a SuiteLink server to consume excessive system resources and slow down processing of Data I/O for the duration of the attack...

CVE-2024-7113

CVE-2024-7113 affects AVEVA SuiteLink Server and related AVEVA products (SuiteLink, Historian, InTouch, Application Server, Communication Drivers Pack, Batch Management). The root issue is Allocation of Resources Without Limits or Throttling, causing the SuiteLink server to consume excessive syst...

AMD Uninitialized GPU Register Access Advisory - Lenovo Support US

No description provided...

Server-Side Request Forgery (SSRF)

Axios is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to unexpected behavior where requests for path-relative URLs are processed as protocol-relative URLs...

PT-2024-5549 · Aveva · Aveva Suitelink Server +5

Name of the Vulnerable Software and Affected Versions: AVEVA SuiteLink Server affected versions not specified Description: The issue is related to unlimited resource allocation in the SuiteLink server of AVEVA software products, including Historian, InTouch, Application Server, Communication...

SAP Shared Service Framework 安全漏洞

SAP Shared Service Framework is an integration platform from SAP, Germany, designed to support the operation and management of shared services within an organization. A security vulnerability exists in SAP Shared Service Framework that stems from not performing the required authorization checks o...

The vulnerability of the mp3_dmx_process() function on the GPAC multimedia platform allows a hacker to cause a service failure.

The vulnerability of the mp3dmxprocess function on the GPAC multimedia platform is related to buffer overflow attacks. Exploiting this vulnerability could allow a malicious actor to cause service interruptions...

CVE-2024-39338

axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs...

The vulnerability of Elasticsearch’ search engine, a software platform based on Git for collaborative code development on GitLab, allows a hacker to trigger a service failure.

The vulnerability of Elasticsearch, a software platform based on Git for collaborative code development on GitLab, is related to an uncontrolled resource consumption during the processing of search results. Exploiting this vulnerability can allow a malicious actor to cause service interruptions...

The vulnerability of the Git-based software platform for collaborative code development on GitLab relates to an error in token processing by LFS. This error allows attackers to gain unauthorized access to protected information and write arbitrary files.

The vulnerability of the Git-based software platform for collaborative code development on GitLab is related to an error in token processing for LFS operations. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected information and...

firmware: cs_dsp: Validate payload length before processing block

...

SUSE-SU-2024:2868-1 Security update for bind

This update for bind fixes the following issues: Security issues fixed: - It is possible to craft excessively large numbers of resource record types for a given owner name, which has the effect of slowing down database processing. This has been addressed by only allowing a maximum of 100 records ...

Access Control Bypass

Shopware is vulnerable to Access Control Bypass. The vulnerability is due to improper handling of ManyToManyAssociationField in the Criteria processing via SalesChannelRepository.php, which allows attackers to bypass protections and potentially access or manipulate data through extensions...

SUSE-SU-2024:2863-1 Security update for bind

This update for bind fixes the following issues: Update to 9.16.50: - Bug Fixes: A regression in cache-cleaning code enabled memory use to grow significantly more quickly than before, until the configured max-cache-size limit was reached. This has been fixed. Using rndc flush inadvertently caused...

Fedora 39 : xrdp (2024-41c1bf8de6)

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-41c1bf8de6 advisory. Release notes for xrdp v0.10.1 2024/07/31 General announcements A clipboard bugfix included in this release is sponsored by Krmer Pferdesport GmbH & Co KG. W...

CVE-2024-42354 Shopware vulnerable to Improper Access Control with ManyToMany associations in store-api

Shopware is an open commerce platform. The store-API works with regular entities and not expose all fields for the public API; fields need to be marked as ApiAware in the EntityDefinition. So only ApiAware fields of the EntityDefinition will be encoded to the final JSON. Prior to versions 6.6.5.1...