PT-2024-6955 · Adobe · Commerce

Name of the Vulnerable Software and Affected Versions: Adobe Commerce versions 2.4.7-p2, 2.4.6-p7, 2.4.5-p9, 2.4.4-p10 and earlier Description: The issue is related to an Improper Authentication vulnerability that could result in a security feature bypass. A low-privileged attacker could leverage...

CVE-2024-45293

CVE-2024-45293 involves an XXE in PHPSpreadsheet’s XLSX reader where the security scanner that prevents XXE can be bypassed by whitespace in the XML encoding attribute, allowing a crafted XLSX to disclose server data. The root cause is a flawed XML encoding check in XmlScanner.php that defaults t...

ABB Cylon Aspect 3.08.01 (logYumLookup.php) Unauthenticated File Disclosure

Summary ASPECT is an award-winning scalable building energy management and control solution designed to allow users seamless access to their building data through standard building protocols including smart devices. Description The building management system suffers from an unauthenticated...

Cisco IOS XE Software Unified Threat Defense Snort Intrusion Prevention System Engine for Security Policy Bypass DoS (cisco-sa-utd-snort3-dos-bypas-b4OUEwxD)

According to its self-reported version, Cisco IOS-XE Software is affected by a vulnerability. - A vulnerability in Cisco Unified Threat Defense UTD Snort Intrusion Prevention System IPS Engine for Cisco IOS XE Software could allow an unauthenticated, remote attacker to bypass configured security...

Mozilla Thunderbird Security Update (MFSA2024-50) - Mac OS X

Mozilla Thunderbird is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:thunderbird";...

CVE-2024-47804

If an attempt is made to create an item of a type prohibited by ACLhasCreatePermission2 or TopLevelItemDescriptorisApplicableInItemGroup through the Jenkins CLI or the REST API and either of these checks fail, Jenkins 2.478 and earlier, LTS 2.462.2 and earlier creates the item in memory, only...

AZL-50268 CVE-2024-9407 affecting package podman 4.1.1-26

A vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The system does not properly validate the input passed to this option, allowing users to pass arbitrary parameters to the mount instruction. This issue can be exploited to mount sensitive directories...

KLA73805 Multiple vulnerabilities in Mozilla Firefox ESR

Multiple vulnerabilities were found in Mozilla Firefox ESR. Malicious users can exploit these vulnerabilities to bypass security restrictions, perform cross-site scripting attack, execute arbitrary code, cause denial of service. Below is a complete list of vulnerabilities: 1. Cross-site scripting...

Mozilla Firefox 安全漏洞

Mozilla Firefox is an open source web browser.Mozilla Firefox ESR is an extended support version of Firefox the web browser.Mozilla Thunderbird is a suite of email client software separate from the Mozilla Application Suite. A security bypass vulnerability exists in multiple Mozilla products, whi...

KLA73804 Multiple vulnerabilities in Mozilla Thunderbird

Multiple vulnerabilities were found in Mozilla Thunderbird. Malicious users can exploit these vulnerabilities to cause denial of service, bypass security restrictions, gain privileges, spoof user interface, perform cross-site scripting attack, execute arbitrary code. Below is a complete list of...

KLA73806 Multiple vulnerabilities in Mozilla Thunderbird

Multiple vulnerabilities were found in Mozilla Thunderbird. Malicious users can exploit these vulnerabilities to bypass security restrictions, perform cross-site scripting attack, execute arbitrary code, cause denial of service, spoof user interface, gain privileges. Below is a complete list of...

KLA73803 Multiple vulnerabilities in Mozilla Firefox ESR

Multiple vulnerabilities were found in Mozilla Firefox ESR. Malicious users can exploit these vulnerabilities to cause denial of service, bypass security restrictions, gain privileges, spoof user interface, perform cross-site scripting attack, execute arbitrary code. Below is a complete list of...

CUPS 输入验证错误漏洞

CUPS is a standards-based open source printing system. An input validation error vulnerability exists in CUPS libcupsfilters, which can be exploited by an attacker to bypass security restrictions, add a malicious printer or directly hijack an existing printer...

Security Bulletin: Vulnerability in dnsjava affects IBM watsonx.data

Summary dnsjava could allow a remote attacker to bypass security restrictions, caused by improper response validation. By sending a specially crafted request, an attacker could exploit this vulnerability to perform DNSSEC bypass. This may affect watsonx.data. Vulnerability Details...

CVE-2024-20508 Cisco UTD Snort IPS Engine Software for Cisco IOS XE Software Security Policy Bypass and Denial of Service Vulnerability

A vulnerability in Cisco Unified Threat Defense UTD Snort Intrusion Prevention System IPS Engine for Cisco IOS XE Software could allow an unauthenticated, remote attacker to bypass configured security policies or cause a denial of service DoS condition on an affected device. This vulnerability is...

CVE-2024-8941

Path traversal vulnerability in Scriptcase version 9.4.019, in /scriptcase/devel/compat/nmeditphpedit.php in the “subpage” parameter, which allows unauthenticated remote users to bypass SecurityManager's intended restrictions and list and/or read a parent directory via a “/...” or directly into a...

KLA73891 PE vulnerabilities in TeamViewer

Elevation of privilege vulnerabilities were found in TeamViewer. Malicious users can exploit these vulnerabilities to gain privileges. Original advisories Improper signature verification of driver installation in TeamViewer Remote clients Exploitation Public exploits exist for this vulnerability...

Google Chrome 安全漏洞

Google Chrome is a web browser from Google, an American company. A security bypass vulnerability exists in versions of Google Chrome prior to 129.0.6668.70, which can be exploited by remote attackers to perform memory access via specially crafted Hypertext Markup Language pages...

Google Chrome Security Bypass Vulnerability (CNVD-2024-39743)

Google Chrome is a web browser from Google, an American company. A security bypass vulnerability exists in Google Chrome versions prior to 113.0.5672.63, which can be exploited by remote attackers to perform domain spoofing by tricking users into performing specific UI gestures via a crafted HTML...

Google Chrome Security Bypass Vulnerability (CNVD-2024-39744)

Google Chrome is a web browser from Google, an American company. A security bypass vulnerability exists in versions prior to Google Chrome 126.0.6478.54, which can be exploited by remote attackers to potentially perform a sandbox escape via a crafted HTML page...