postgresql: non-owner 'REFRESH MATERIALIZED VIEW CONCURRENTLY' executes arbitrary SQL

A flaw was found in PostgreSQL. A late privilege drop in REFRESH MATERIALIZED VIEW CONCURRENTLY in PostgreSQL can allow an object creator to execute arbitrary SQL functions as the command issuer. The command intends to run SQL functions as the owner of the materialized view, enabling a safe refre...

Update Rollup 70 for Azure Site Recovery -KB5034599

None None...

CVE-2024-23452

Request smuggling vulnerability in HTTP server in Apache bRPC 0.9.51.7.0 on all platforms allows attacker to smuggle request. Vulnerability Cause Description： The httpparser does not comply with the RFC-7230 HTTP 1.1 specification. Attack scenario: If a message is received with both a...

Cross site request forgery (csrf)

Request smuggling vulnerability in HTTP server in Apache bRPC 0.9.51.7.0 on all platforms allows attacker to smuggle request. Vulnerability Cause Description: The httpparser does not comply with the RFC-7230 HTTP 1.1 specification. Attack scenario: If a message is received with both a...

GHSA-7M8G-FPRR-47FX phpMyFAQ vulnerable to stored XSS on attachments filename

Summary Unsafe echo of filename in phpMyFAQ\phpmyfaq\admin\attachments.php leading to allow execute JavaScript code in client side XSS Details On that snippet code of rendering the file attachments from user tables id ?" title="thema ?" id ? filename ? recordlang ? filesize ? mimetype ? The data...

SISQUAL WFM 7.1.319.103 Host Header Injection Vulnerability

Exploit Title: SISQUAL WFM 7.1.319.103 Host Header Injection Exploit Author: Omer Shaik unknownexploit Vendor Homepage: https://www.sisqualwfm.com Version: 7.1.319.103 Tested on: SISQUAL WFM 7.1.319.103 Affected Version: sisqualWFM - 7.1.319.103 Fixed Version: sisqualWFM - 7.1.319.111 CVE :...

PT-2024-19998

Name of the Vulnerable Software and Affected Versions Authentik versions prior to 2023.8.7 Authentik versions prior to 2023.10.7 Description Authentik is an open-source Identity Provider with a bug in its implementation of PKCE, allowing an attacker to circumvent the protection that PKCE offers...

PT-2024-1298 · Cisco · Cisco Business 350 Series Managed Switches +1

Name of the Vulnerable Software and Affected Versions: Cisco Business 250 Series Smart Switches affected versions not specified Cisco Business 350 Series Managed Switches affected versions not specified Description: A vulnerability with the access control list ACL management within a stacked swit...

EulerOS Virtualization 3.0.6.0 : qemu (EulerOS-SA-2023-3460)

According to the versions of the qemu package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - The ehciprocessitd function in hw/usb/hcd-ehci.c in QEMU allows local guest OS administrators to cause a denial of service infinite...

EulerOS Virtualization 2.11.0 : qemu (EulerOS-SA-2023-3389)

According to the versions of the qemu package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - A flaw was found in QEMU. The async nature of hot-unplug enables a race scenario where the net device backend is cleared before the...

CVE-2024-21611 Junos OS and Junos OS Evolved: In a jflow scenario continuous route churn will cause a memory leak and eventually an rpd crash

A Missing Release of Memory after Effective Lifetime vulnerability in the Routing Protocol Daemon rpd of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network-based attacker to cause a Denial of Service DoS. In a Juniper Flow Monitoring jflow scenario route churn that...

CVE-2024-21600 Junos OS: PTX Series: In an FTI scenario MPLS packets hitting reject next-hop will cause a host path wedge condition

An Improper Neutralization of Equivalent Special Elements vulnerability in the Packet Forwarding Engine PFE of Juniper Networks Junos OS on PTX Series allows a unauthenticated, adjacent attacker to cause a Denial of Service DoS. When MPLS packets are meant to be sent to a flexible tunnel interfac...

CVE-2024-21597 Junos OS: MX Series: In an AF scenario traffic can bypass configured lo0 firewall filters

An Exposure of Resource to Wrong Sphere vulnerability in the Packet Forwarding Engine PFE of Juniper Networks Junos OS on MX Series allows an unauthenticated, network-based attacker to bypass the intended access restrictions. In an Abstracted Fabric AF scenario if routing-instances RI are...

PT-2024-1112 · Juniper Networks · Junos Evolved +1

Name of the Vulnerable Software and Affected Versions: Junos OS versions prior to 21.4R3 Junos OS versions prior to 22.1R3 Junos OS versions prior to 22.2R3 Junos OS Evolved versions prior to 21.4R3-EVO Junos OS Evolved versions prior to 22.1R3-EVO Junos OS Evolved versions prior to 22.2R3-EVO...

Webcam redirection in double hop is not working

Webcam is not working anymore in a double hop scenario. If the first hop VDA is 1912CU3 webcam redirects fine. However if first hop VDA is CVAD 1912 CU8 VDA then webcam redirection fails. With https://webcamtests.com/ when clicking on "Test my cam" an error is seen. "Your webcam is being used or...

RAID Technology and the importance of disk encryption in data security

Introduction Recently we were engaged by a client experiencing a potential data leak incident. Amidst their expansion, they were constructing a new data centre. Due to pressing business needs, they accelerated the setup of part of their infrastructure. This urgency led to them setting up a Domain...

scenario-berlin.de Improper Access Control vulnerability OBB-3820275

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2023-5940

The WP Not Login Hide WPNLH WordPress plugin through 1.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

Huawei HarmonyOS Security Vulnerability

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. A security vulnerability exists in Huawei HarmonyOS, which stems from a privilege checking vulnerability in a distributed scenario. Successful exploitation o...

UBUNTU-CVE-2023-49298

OpenZFS through 2.1.13 and 2.2.x through 2.2.1, in certain scenarios involving applications that try to rely on efficient copying of file data, can replace file contents with zero-valued bytes and thus potentially disable security mechanisms. NOTE: this issue is not always security related, but c...