CVE-2024-42112

In the Linux kernel, the following vulnerability has been resolved: net: txgbe: free isb resources at the right time When using MSI/INTx interrupt, the shared interrupts are still being handled in the device remove routine, before free IRQs. So isb memory is still read after it is freed. Thus mov...

fuels-ts 输入验证错误漏洞

fuels-ts is an open source library from Fuel Labs that interacts with Fuel v2. An input validation error vulnerability exists in fuels-ts, which is caused by the "fund" function in "fuels-ts/packages/account/src/account.ts" that uses the function The "getResourcesToSpend" function in...

External Broken Resources Detected

Web applications heavily rely on external resources such as JavaScript files, Cascading Style Sheets CSS or images. When an application uses links which targets external resources which do not exist, an attacker could try gaining control over this resource to inject code in the target web...

Exploit for Path Traversal in Microsoft

Exploiting Follina CVE and CVE-2021-40444 Vulnerabilities...

CVE-2024-41812

txtdot is an HTTP proxy that parses only text, links, and pictures from pages, removing ads and heavy scripts. Prior to version 1.7.0, a Server-Side Request Forgery SSRF vulnerability in the /get route of txtdot allows remote attackers to use the server as a proxy to send HTTP GET requests to...

How Can Deliberately Flawed APIs Help In Mastering API Security?

In our recent webinar recent webinar title 'A CISO’s Checklist for Securing APIs and Applications', we delved into the concept of creating an API security playground tailored for both developer and security teams. The core idea revolves around utilizing intentionally vulnerable APIs as training...

Denial Of Service (DoS)

libbind9.so is vulnerable to Denial of Service. The vulnerability is due to the handling of "KEY" Resource Records in DNSSEC-signed domains, allowing attackers to exhaust resolver CPU resources by sending a stream of SIG0 signed requests...

ISC BIND DoS Vulnerability (CVE-2024-1975) - Windows

ISC BIND is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:isc:bind"; if...

The vulnerability of Zoom’s video conferencing software, related to synchronization errors when using shared resources (“Race Situation”), allows a violator to trigger a service failure.

The vulnerability of Zoom’s video conferencing software is related to synchronization errors when using a shared resource “Race Situation”. Exploiting this vulnerability can allow an attacker to cause service failures...

Denial Of Service (DoS)

sixlabors.imagesharp is vulnerable to Denial Of Service DoS. The vulnerability is due to the improper processing of specific gif files, that can leads to excessive memory usage during decoding. Attackers can use a specially crafted file to crash the application or exhaust system resources...

Siemens SIMATIC and SCALANCE Products Inadequate Encryption Strength (CVE-2023-0464)

A security vulnerability has been identified in all supported versions of OpenSSL related to the verification of X.509 certificate chains that include policy constraints. Attackers may be able to exploit this vulnerability by creating a malicious certificate chain that triggers exponential use of...

CVE-2024-6806

The NI VeriStand Gateway is missing authorization checks when an actor attempts to access Project resources. These missing checks may result in remote code execution. This affects NI VeriStand 2024 Q2 and prior versions...

CVE-2024-6805 Missing Authorization Checks in NI VeriStand Gateway for File Transfer Resources

The NI VeriStand Gateway is missing authorization checks when an actor attempts to access File Transfer resources. These missing checks may result in information disclosure or remote code execution. This affects NI VeriStand 2024 Q2 and prior versions...

PT-2024-37876 · National Instruments · Ni Veristand

Name of the Vulnerable Software and Affected Versions: NI VeriStand versions 2024 Q2 and prior Description: The issue is related to missing authorization checks when accessing File Transfer resources, potentially leading to information disclosure or remote code execution. Recommendations: For NI...

PT-2024-28169 · Unknown · Bernhard Kux Json Content Importer

Name of the Vulnerable Software and Affected Versions: Bernhard Kux JSON Content Importer versions 1.5.6 and earlier Description: A Server-Side Request Forgery SSRF issue has been identified. This allows an attacker to forge requests from the server, potentially leading to unauthorized access to...

PT-2024-37877 · National Instruments · Ni Veristand

Name of the Vulnerable Software and Affected Versions: NI VeriStand versions 2024 Q2 and prior Description: The issue is related to missing authorization checks in the NI VeriStand Gateway when accessing Project resources, potentially leading to remote code execution. Recommendations: For NI...

The vulnerability of the QlikView analytical platform, related to synchronization errors when using a common resource, allows a perpetrator to execute arbitrary code.

The vulnerability of the QlikView analytical platform is related to synchronization errors when using a common resource. Exploiting this vulnerability can allow an attacker to execute arbitrary code within the context of the Windows administrator...

CVE-2024-41107

The CloudStack SAML authentication disabled by default does not enforce signature check. In CloudStack environments where SAML authentication is enabled, an attacker that initiates CloudStack SAML single sign-on authentication can bypass SAML authentication by submitting a spoofed SAML response...

CVE-2024-41107 Apache CloudStack: SAML Signature Exclusion

The CloudStack SAML authentication disabled by default does not enforce signature check. In CloudStack environments where SAML authentication is enabled, an attacker that initiates CloudStack SAML single sign-on authentication can bypass SAML authentication by submitting a spoofed SAML response...

CVE-2023-50304

IBM Engineering Requirements Management DOORS Web Access 9.7.2.8 is vulnerable to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 273335...