Automattic: Race condition on add 1 free domain

A race condition vulnerability was discovered on the Gravatar platform, which allowed users to bypass the limitation of claiming only one free custom domain. The vulnerability was triggered by creating multiple parallel requests to the public-api.wordpress.com endpoint, where the "meta" parameter...

USN-6903-1 thunderbird vulnerabilities

Multiple security issues were discovered in Thunderbird. If a user were tricked into opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, obtain sensitive information, bypass security restrictions, cross-site tracing,...

The vulnerability of the Palo Alto Networks Cortex XDR Agent, a tool for network traffic analysis, network detection, and response, arises from improper verification of the cryptographic signature. This allows attackers to circumvent existing security restrictions and execute arbitrary code.

The vulnerability of the Palo Alto Networks Cortex XDR Agent, which is used for network traffic analysis, network detection, and response, stems from incorrect verification of the cryptographic signature. Exploiting this vulnerability allows attackers to bypass existing security restrictions and...

CVE-2024-38434

Unitronics Vision PLC – CWE-676: Use of Potentially Dangerous Function may allow security feature bypass...

CVE-2024-38434 Unitronics Vision PLC - CWE-676: Use of Potentially Dangerous Function

Unitronics Vision PLC – CWE-676: Use of Potentially Dangerous Function may allow security feature bypass...

CVE-2024-38434

CVE-2024-38434 corresponds to CWE-676: Use of Potentially Dangerous Function, potentially bypassing security features. The IBM Engineering Systems Design Rhapsody bulletin lists affected products and versions (Rhapsody 9.0.2, 10.0, 10.0.1) with iFix updates (iFix004, iFix002, iFix003) as remediat...

CVE-2024-35198

TorchServe is a flexible and easy-to-use tool for serving and scaling PyTorch models in production. TorchServe 's check on allowedurls configuration can be by-passed if the URL contains characters such as ".." but it does not prevent the model from being downloaded into the model store. Once a fi...

Google Chrome Security Bypass Vulnerability (CNVD-2024-33615)

Google Chrome is a web browser from Google, an American company. A security bypass vulnerability exists in Google Chrome version 1.3.36.351 and prior versions, which stems from a mal-implementation issue found in the Sign-In module. An attacker could exploit the vulnerability to bypass security...

GHSA-WXCX-GG9C-FWP2 TorchServe vulnerable to bypass of allowed_urls configuration

Impact TorchServe's check on allowedurls configuration can be by-passed if the URL contains characters such as ".." but it does not prevent the model from being downloaded into the model store. Once a file is downloaded, it can be referenced without providing a URL the second time, which...

Apache StreamPipes 安全漏洞

Apache StreamPipes is a self-service industrial IoT toolkit from the Apache USA Foundation that enables non-technical users to connect, analyze and explore IIoT data streams. Apache StreamPipes suffers from a security bypass vulnerability that can be exploited by an attacker to create multiple...

Google Chrome Security Bypass Vulnerability (CNVD-2024-34505)

Google Chrome is a web browser from Google, an American company. Google Chrome suffers from a security bypass vulnerability, which can be exploited by an attacker to potentially exploit object damage via a crafted HTML page...

Google Chrome Security Bypass Vulnerability (CNVD-2024-34503)

Google Chrome is a web browser from Google, an American company. Google Chrome security bypass vulnerability can be exploited by an attacker to execute arbitrary code via a crafted HTML page...

The vulnerability of the Windows Enroll Engine component in Windows operating systems allows a hacker to bypass security restrictions.

The vulnerability of the Windows Enroll Engine component in Windows operating systems is related to errors in verifying the cryptographic signature. Exploiting this vulnerability could allow a perpetrator to circumvent security restrictions...

KLA70466 Multiple vulnerabilities in Apache HTTP Server

Multiple vulnerabilities were found in Apache HTTP Server. Malicious users can exploit these vulnerabilities to bypass security restrictions. Below is a complete list of vulnerabilities: 1. Security vulnerability in SSRF can be exploited to bypass security restrictions. 2. Security vulnerability ...

Security Bulletin: A vulnerability in axios affects IBM Robotic Process Automation and may result in a bypass of security restrictions (CVE-2024-28849)

Summary A vulnerability in axios affects IBM Robotic Process Automation resulting in a bypass of security restrictions. axios is used by IBM Robotic Process Automation as part of the Control Center. This bulletin identifies the security fixes to apply to address the vulnerability. Vulnerability...

Google Chrome 安全漏洞

Google Chrome is a web browser from Google, an American company. A security bypass vulnerability exists in Google Chrome version 1.3.36.351 and prior versions, which stems from a mal-implementation issue found in the Sign-In module. An attacker could exploit the vulnerability to bypass security...

Google Chrome 安全漏洞

Google Chrome is a web browser from Google, an American company. Google Chrome security bypass vulnerability can be exploited by an attacker to execute arbitrary code via a crafted HTML page...

KLA70479 Multiple vulnerabilities in Mozilla Thunderbird

Multiple vulnerabilities were found in Mozilla Thunderbird. Malicious users can exploit these vulnerabilities to execute arbitrary code, cause denial of service, perform cross-site scripting attack, bypass security restrictions, spoof user interface, gain privileges, obtain sensitive information...

The vulnerability of the BitLocker data protection function in Windows operating systems allows attackers to circumvent existing security restrictions and gain access to encrypted data.

The vulnerability of the BitLocker data protection function in Windows operating systems is related to a breach of the data protection mechanism. Exploiting this vulnerability can allow attackers to circumvent existing security restrictions and gain access to encrypted data...

The vulnerability of the Analytics Workspace web interface module in the Splunk Web platform for operational analysis in Splunk Enterprise allows a hacker to bypass security restrictions and execute arbitrary commands.

The vulnerability of the Analytics Workspace web interface in the Splunk Web platform for operational analysis in Splunk Enterprise is related to insufficient protection of sensitive data. Exploiting this vulnerability allows a malicious actor to bypass security restrictions and execute arbitrary...