Boa 路径遍历漏洞

Boa is a Boa open source open source code for embedded applications. A path traversal vulnerability exists in Boa that stems from a pathname being incorrectly restricted to a restricted directory...

PT-2024-39476 · Funnelkit · Recover Woocommerce Cart Abandonment

Name of the Vulnerable Software and Affected Versions: Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit WordPress plugin versions prior to 3.3.0 Description: The issue allows unauthenticated users to perform SQL injection attacks due to the lack...

PT-2024-38581 · Unknown · Vsrm Supplier Relationship Management System

Name of the Vulnerable Software and Affected Versions: vSRM Supplier Relationship Management System versions prior to 28.08.2024 Description: The issue affects the vSRM Supplier Relationship Management System, allowing Reflected XSS, or Cross-Site Scripting XSS, due to improper neutralization of...

OpenAFS 输入验证错误漏洞

OpenAFS is an OpenAFS open source set of distributed file systems. It allows files and resources to be shared between systems over LANs and WANs. OpenAFS suffers from an input validation error vulnerability that stems from the fact that a local user can bypass the process authentication group...

PT-2024-31980 · Hathway · Hathway Skyworth Router Cm5100-511

Name of the Vulnerable Software and Affected Versions: Hathway Skyworth Router CM5100-511 version 4.1.1.24 Description: The issue concerns the storage of sensitive information about connected devices in plaintext. This affects devices connected via USB and Wifi. Recommendations: For version...

PT-2024-16629 · WordPress · Tutor Lms Elementor Addons

Name of the Vulnerable Software and Affected Versions: Tutor LMS Elementor Addons plugin for WordPress versions up to, and including, 2.1.5 Description: The issue is related to a missing capability check on the install etlms dependency plugin function, allowing authenticated attackers with...

PT-2024-35210 · Unknown · Devexhub Gallery

Name of the Vulnerable Software and Affected Versions: Devexhub Gallery versions n/a through 2.0.1 Description: The issue allows for the unrestricted upload of files with dangerous types, enabling an attacker to upload a web shell to a web server. This can lead to potential exploitation and...

The vulnerability of the SaveRestoreConnector function in NVIDIA NeMo’s comprehensive platform for training and applying neural networks in speech processing and natural language processing allows a hacker to execute arbitrary code.

The vulnerability of the SaveRestoreConnector function in NVIDIA NeMo’s comprehensive platform for training and applying neural networks in speech processing and natural language processing is related to an incorrect restriction on the path name to the restricted-access catalog. Exploiting this...

CVE-2024-34170

CVE-2024-34170 affects Intel® Graphics Drivers. The issue is described as an improper buffer restriction (buffer/array bounds issue) in several Intel graphics components, leading to denial of service via local access by an authenticated user. The vulnerability impacts multiple driver families and...

CVE-2024-43081

In installExistingPackageAsUser of InstallPackageHelper.java, there is a possible carrier restriction bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2024-43081

In installExistingPackageAsUser of InstallPackageHelper.java, there is a possible carrier restriction bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

PAN-OS: Server-Side Request Forgery in WildFire

A server-side request forgery in PAN-OS software enables an authenticated attacker to use the administrative web interface as a proxy, which enables the attacker to view internal network resources not otherwise accessible. Work around: Recommended mitigation—The vast majority of firewalls already...

CVE-2024-43081

In installExistingPackageAsUser of InstallPackageHelper.java, there is a possible carrier restriction bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2024-43081

The CVE-2024-43081 issue affects Google Android and is tied to the function installExistingPackageAsUser in InstallPackageHelper.java. The root cause is a logic error that allows a carrier restriction bypass, enabling local elevation of privilege with no extra execution privileges and no user int...

CVE-2024-8938

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause a potential arbitrary code execution after a successful Man-In-The-Middle attack followed by sending a crafted Modbus function call to tamper with memory area involved in memory...

CVE-2024-8938

CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause a potential arbitrary code execution after a successful Man-In-The-Middle attack followed by sending a crafted Modbus function call to tamper with memory area involved in memory...

Intel VPL 安全漏洞

Intel VPL is a video processing library from Intel Corporation USA . A security vulnerability exists in Intel VPL versions prior to 24.1.4, which stems from improper buffer restriction. An attacker can exploit the vulnerability to elevate privileges...

PT-2024-16537 · WordPress · Buddypress Builder For Elementor – Buddybuilder

Name of the Vulnerable Software and Affected Versions: The BuddyPress Builder for Elementor – BuddyBuilder plugin for WordPress versions up to, and including, 1.7.4 Description: The issue allows authenticated attackers with Contributor-level access and above to extract data from private or draft...

PT-2024-15972 · Progress · Telerik Ui For Wpf

Name of the Vulnerable Software and Affected Versions: In Progress Telerik UI for WPF versions prior to 2024 Q4 2024.4.1111 Description: A code execution attack is possible through an insecure deserialization vulnerability. This issue allows for potential code execution, posing a significant risk...

PT-2024-30281 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android affected versions not specified Description: A logic error in the code of the installExistingPackageAsUser method could lead to a carrier restriction bypass, resulting in local escalation of privilege with no additional execution...