The vulnerability of the Serial Peripheral Interface (SPI) protection function in AMD microprocessor software allows attackers to circumvent security restrictions, enhance their privileges, or execute arbitrary code.

The vulnerability of the Serial Peripheral Interface SPI protection function in AMD microprocessor-based software is related to insufficient protection of system data. Exploiting this vulnerability can allow attackers to circumvent security restrictions, gain additional privileges, or execute...

The vulnerability of the Mozilla Firefox browser for Android, related to deficiencies in access control, allows attackers to bypass security restrictions and compromise the integrity of protected information.

The vulnerability of the Mozilla Firefox browser for Android is related to deficiencies in access control, resulting from incorrect processing of the Principal object when opening new tabs. Exploiting this vulnerability allows a malicious actor to bypass security restrictions and compromise the...

Juniper SSR Security Bypass (JSA83126)

An Authentication Bypass Using an Alternate Path or Channel vulnerability in Juniper Networks Session Smart Router or conductor running with a redundant peer allows a network based attacker to bypass authentication and take full control of the device. Only routers or conductors that are running i...

KLA70210 SB vulnerability in Apache HTTP Server

Security bypass vulnerability was found in Apache HTTP Server. Malicious users can exploit this vulnerability to bypass security restrictions. Original advisories Fixed in Apache HTTP Server 2.4.61 Related products Apache-HTTP-Server CVE list CVE-2024-39884 unknown Solution Update to the latest...

CVE-2024-24749 Classpath resource disclosure in GWC Web Resource API on Windows / Tomcat

GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.23.5 and 2.24.3, if GeoServer is deployed in the Windows operating system using an Apache Tomcat web application server, it is possible to bypass existing input validation in the GeoWebCach...

Splunk Cloud Platform和Splunk Enterprise 安全漏洞

Splunk is a suite of data collection and analysis software from Splunk, Inc. in the United States. The software is primarily used to collect, index and analyze and the data it generates, including data generated by all IT systems and infrastructures physical, virtual machines and cloud. A securit...

Splunk Enterprise和Splunk Cloud Platform 安全漏洞

Splunk is a suite of data collection and analysis software from Splunk, Inc. in the United States. The software is primarily used to collect, index and analyze and the data it generates, including data generated by all IT systems and infrastructures physical, virtual machines and cloud. A securit...

KLA70199 Multiple vulnerabilities in Apache HTTP Server

Multiple vulnerabilities were found in Apache HTTP Server. Malicious users can exploit these vulnerabilities to bypass security restrictions, execute arbitrary code, cause denial of service. Below is a complete list of vulnerabilities: 1. Security vulnerability in SSRF can be exploited to bypass...

The vulnerability of the Microsoft Azure File Sync data synchronization service lies in the improper handling of symbolic links before accessing files. This allows attackers to circumvent existing security restrictions and enhance their privileges.

The vulnerability of the Microsoft Azure File Sync data synchronization service is related to the incorrect definition of symbolic links before accessing a file. Exploiting this vulnerability can allow an attacker to circumvent existing security restrictions and enhance their privileges...

CVE-2024-6257

HashiCorp’s go-getter library can be coerced into executing Git update on an existing maliciously modified Git Configuration, potentially leading to arbitrary code execution...

KLA69718 SB vulnerability in LibreOffice

Improper certificate validation vulnerability was found in LibreOffice. Malicious users can exploit this vulnerability to bypass security restrictions. Original advisories TLS certificate are not properly verified when utilizing LibreOfficeKit Related products LibreOffice CVE list CVE-2024-5261...

python-gunicorn: HTTP Request Smuggling due to improper validation of Transfer-Encoding headers

An HTTP Request Smuggling vulnerability was found in Gunicorn. By crafting requests with conflicting Transfer-Encoding headers, attackers can bypass security restrictions and access restricted endpoints. This issue is due to Gunicorn's handling of Transfer-Encoding headers, where it incorrectly...

PT-2024-29594 · Adobe · Experience Manager

Name of the Vulnerable Software and Affected Versions: Adobe Experience Manager versions 6.5.20 and earlier Description: The issue is related to an Improper Input Validation that could lead to a security feature bypass. A low-privileged attacker could leverage this to bypass security measures and...

The vulnerability of the Adobe Creative Cloud Desktop Application’s graphic editor app relates to an uncontrolled search path element, allowing attackers to bypass existing security restrictions and execute arbitrary code.

The vulnerability of the Adobe Creative Cloud Desktop Application’s graphic editor app relates to an uncontrolled search path element. Exploiting this vulnerability allows a hacker to bypass existing security restrictions and execute arbitrary code in the context of the current user, using a...

The vulnerability of the Rockwell Automation FactoryTalk View SE human-machine interface control software, related to deficiencies in authentication procedures, allows attackers to circumvent existing security restrictions.

The vulnerability of the Rockwell Automation FactoryTalk View SE human-machine interface management software is related to deficiencies in authentication procedures. Exploiting this vulnerability can allow attackers to circumvent existing security restrictions remotely...

Security Bulletin: AIX is vulnerable to security restrictions bypass due to cURL libcurl (CVE-2024-0853)

Summary Vulnerability in cURL libcurl could allow a remote attacker to bypass security restrictions CVE-2024-0853. AIX uses cURL libcurl as part of rsyslog, LV/PV encryption integration with HPCS and in Live Update for interacting with HMC. Vulnerability Details CVEID:CVE-2024-0853 DESCRIPTION:...

CVE-2024-38329

IBM Storage Protect for Virtual Environments: Data Protection for VMware 8.1.0.0 through 8.1.22.0 could allow a remote authenticated attacker to bypass security restrictions, caused by improper validation of user permission. By sending a specially crafted request, an attacker could exploit this...

CVE-2024-38329 IBM Storage Protect for Virtual Environments: Data Protection for VMware security bypass

IBM Storage Protect for Virtual Environments: Data Protection for VMware 8.1.0.0 through 8.1.22.0 could allow a remote authenticated attacker to bypass security restrictions, caused by improper validation of user permission. By sending a specially crafted request, an attacker could exploit this...

CVE-2024-38329 IBM Storage Protect for Virtual Environments: Data Protection for VMware security bypass

IBM Storage Protect for Virtual Environments: Data Protection for VMware 8.1.0.0 through 8.1.22.0 could allow a remote authenticated attacker to bypass security restrictions, caused by improper validation of user permission. By sending a specially crafted request, an attacker could exploit this...

KLA70302 Multiple vulnerabilities in Apache Tomcat

Multiple vulnerabilities were found in Apache Tomcat. Malicious users can exploit these vulnerabilities to cause denial of service. Below is a complete list of vulnerabilities: 1. Denial of service vulnerability in excessive HTTP headers when processing an HTTP/2 stream can be exploited to cause...