CVE-2024-31151

A security flaw involving hard-coded credentials in LevelOne WBR-6012's web services allows attackers to gain unauthorized access during the first 30 seconds post-boot. Other vulnerabilities can force a reboot, circumventing the initial time restriction for exploitation.The password string can be...

PT-2024-16367 · Sourcecodester · Sourcecodester Airport Booking Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Airport Booking Management System version 1.0 Description: A critical issue was found in the function details of the component Passport Number Handler, leading to buffer overflow. The attack needs to be approached locally. The...

PT-2024-33193

Name of the Vulnerable Software and Affected Versions SAS Studio version 9.4 Description A SQL injection issue exists in the /SASStudio/sasexec/sessions/sessionID/sql endpoint of SAS Studio, allowing a remote attacker to execute arbitrary SQL commands via the POST body request. This issue is...

PT-2024-8622 · Hashicorp +4 · Hashicorp Consul +5

Name of the Vulnerable Software and Affected Versions: Consul affected versions not specified Consul Enterprise affected versions not specified Description: A vulnerability exists in Consul due to the lack of protection of the web page structure, allowing a remote attacker to conduct a cross-site...

Apple MacOSX Security Update (HT121570)

Apple Mac OS X is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2024-34591 · Draytek · Draytek Vigor3900

Name of the Vulnerable Software and Affected Versions: Draytek Vigor3900 version 1.5.1.3 Description: The issue allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the get rrd function. Recommendations: For Draytek Vigor3900 version 1.5.1....

PT-2024-33023 · Icecms · Icecms

Name of the Vulnerable Software and Affected Versions: icecms versions 3.4.7 and earlier Description: The issue is related to a File Upload vulnerability. It affects the uploadFile function in FileUtils.java. Recommendations: For versions 3.4.7 and earlier, update to a version later than 3.4.7 to...

PT-2024-39256

Name of the Vulnerable Software and Affected Versions: Subscribe to Comments plugin for WordPress versions up to, and including, 2.3 Description: The issue is related to Reflected Cross-Site Scripting due to the use of add query arg without appropriate escaping on the URL. This allows...

The vulnerability of the Splunk Enterprise operating analysis platform lies in the incorrect limitation of the path name to the restricted access directory, allowing a malicious user to write any file into the root directory of the Windows system.

The vulnerability of the Splunk Enterprise operating platform relates to an incorrect restriction on the path name to the restricted access directory. Exploiting this vulnerability could allow a malicious actor to write any file into the root directory of the Windows system...

CVE-2024-50080

In the Linux kernel, the following vulnerability has been resolved: ublk: don't allow user copy for unprivileged device UBLKFUSERCOPY requires userspace to call write on ublk char device for filling request buffer, and unprivileged device can't be trusted. So don't allow user copy for unprivilege...

DEBIAN-CVE-2024-50080

In the Linux kernel, the following vulnerability has been resolved: ublk: don't allow user copy for unprivileged device UBLKFUSERCOPY requires userspace to call write on ublk char device for filling request buffer, and unprivileged device can't be trusted. So don't allow user copy for unprivilege...

UBUNTU-CVE-2024-50080

In the Linux kernel, the following vulnerability has been resolved: ublk: don't allow user copy for unprivileged device UBLKFUSERCOPY requires userspace to call write on ublk char device for filling request buffer, and unprivileged device can't be trusted. So don't allow user copy for unprivilege...

CVE-2024-50080 ublk: don't allow user copy for unprivileged device

In the Linux kernel, the following vulnerability has been resolved: ublk: don't allow user copy for unprivileged device UBLKFUSERCOPY requires userspace to call write on ublk char device for filling request buffer, and unprivileged device can't be trusted. So don't allow user copy for unprivilege...

PT-2024-33271 · Kyverno +1 · Kyverno +1

Name of the Vulnerable Software and Affected Versions: Kyverno versions prior to 1.13.0 Description: A kyverno ClusterPolicy can be overridden by the creation of a PolicyException in a random namespace. By design, PolicyExceptions are consumed from any namespace, which may allow users with...

The vulnerability of the process.binding() function in the Node.js software platform allows attackers to circumvent security restrictions and gain unauthorized access to protected information.

The vulnerability of the process.binding function in the Node.js platform is related to incorrect restrictions on the path to the restricted directory. Exploiting this vulnerability allows an attacker to bypass security restrictions and gain unauthorized access to protected information...

The vulnerability of the Ivanti Cloud Services Appliance’s network interface, related to incorrect path name restrictions for the restricted access catalog, allows attackers to escalate their privileges.

The vulnerability of the Ivanti Cloud Services Appliance relates to an incorrect restriction on the path name to the restricted catalog. Exploiting this vulnerability can allow a malicious actor to increase their privileges remotely...

The vulnerability of Starlette’s tools for creating asynchronous web services in Python lies in the improper restriction of the path name for a limited directory. This allows attackers to gain access to confidential information.

The vulnerability of Starlette’s tools for creating asynchronous web services in Python is related to an improper restriction on the path name of a limited directory. Exploiting this vulnerability could allow a malicious actor to gain access to confidential information...

CVE-2024-44261

This issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 17.7.1 and iPadOS 17.7.1, iOS 18.1 and iPadOS 18.1. An attacker may be able to view restricted content from the lock screen...

CVE-2024-40853

This issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 18 and iPadOS 18. An attacker may be able to use Siri to enable Auto-Answer Calls...

CVE-2024-40853

CVE-2024-40853 affects Apple iOS 18 and iPadOS 18. Verified details show the issue arises from Siri allowing Auto-Answer Calls on a locked device; Apple fixed it by restricting options on a locked device. Root cause described as a protection bypass tied to Siri on locked screens. Exploitation des...