RHEL 8 : linux-firmware (RHSA-2024:0561)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0561 advisory. The linux-firmware packages contain all of the firmware files that are required by various devices to operate. Security Fixes: hw amd: Retur...

RHEL 8 : postgresql:15 (RHSA-2023:7883)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7883 advisory. PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: postgresql: Buffer overrun from integer overflo...

KLA63367 Multiple vulnerabilities in Microsoft Browser

Multiple vulnerabilities were found in Microsoft Browser. Malicious users can exploit these vulnerabilities to obtain sensitive information, execute arbitrary code, cause denial of service, spoof user interface, gain privileges, bypass security restrictions. Below is a complete list of...

Security Bulletin: IBM Disconnected Log Collector is vulnerable to using components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that may be identified and exploited with automated tools. This update addresses these CVEs. Vulnerability Details CVEID:CVE-2023-35116 DESCRIPTION: Fasterxml jackson-databind is vulnerable to a denial of service, caused...

CVE-2023-36177

An issue was discovered in badaix Snapcast version 0.27.0, allows remote attackers to execute arbitrary code and gain sensitive information via crafted request in JSON-RPC-API...

CVE-2024-0580 Omission of key-controlled authorization in Qsige

Omission of user-controlled key authorization in the IDMSistemas platform, affecting the QSige product. This vulnerability allows an attacker to extract sensitive information from the API by making a request to the parameter '/qsige.locator/quotePrevious/centers/X', where X supports values 1,2,3,...

CVE-2024-20251

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to perform a stored cross-site scripting XSS attack against a user of the interface on an affected device. This vulnerability exists because the web-based...

CVE-2023-46942

Lack of authentication in NPM's package @evershop/evershop before version 1.0.0-rc.8, allows remote attackers to obtain sensitive information via improper authorization in GraphQL endpoints...

Judging Management System security breach

Judging Management System is a judging management system by Carlo Montero Personal Developer. A security vulnerability exists in Sourcecodester Judging Management System v1.0, which stems from an SQL injection vulnerability that allows remote attackers to execute arbitrary code and obtain sensiti...

Judging Management System security breach

Judging Management System is a judging management system by Carlo Montero Personal Developer. A security vulnerability exists in Sourcecodester Judging Management System v1.0, which stems from an SQL injection vulnerability that allows remote attackers to execute arbitrary code and obtain sensiti...

CVE-2023-30015

SQL Injection vulnerability in oretnom23 Judging Management System v1.0, allows remote attackers to execute arbitrary code and obtain sensitive information via txtsearch parameter in reviewsearch.php...

CVE-2023-30015

The CVE-2023-30015 entry describes a SQL Injection in oretnom23 Judging Management System v1.0, enabling remote attackers to execute arbitrary code and access sensitive data via the txtsearch parameter in review_search.php. Affected component: review_search.php; vulnerability type: SQL injection;...

CVE-2023-50612

Insecure Permissions vulnerability in fit2cloud Cloud Explorer Lite version 1.4.1, allow local attackers to escalate privileges and obtain sensitive information via the cloud accounts parameter...

CVE-2023-50343 Improper Access Control (Controller APIs) affects DRYiCE MyXalytics

HCL DRYiCE MyXalytics is impacted by an Improper Access Control Controller APIs vulnerability. Certain API endpoints are accessible to Customer Admin Users that can allow access to sensitive information about other users...

Null pointer dereference

A lack of pointer-validation logic in the sconedispatch component of SCONE before v5.8.0 for Intel SGX allows attackers to access sensitive information...

SQL Injection Vulnerability in SpringBlade of Shanghai Breadtech Co. Ltd (CNVD-2024-0586935)

SpringBlade is a development framework based on Spring Spring SpringMVC Beetl Beetlsql Shiro . Ltd SpringBlade has a SQL injection vulnerability that can be exploited by an attacker to obtain sensitive information from the database...

CVE-2023-29485

An issue was discovered in Heimdal Thor agent versions 3.4.2 and before on Windows and 2.6.9 and before on macOS, allows attackers to bypass network filtering, execute arbitrary code, and obtain sensitive information via DarkLayer Guard threat prevention module. NOTE: Heimdal disputes the validit...

CVE-2023-46348

SQL njection vulnerability in SunnyToo sturls before version 1.1.13, allows attackers to escalate privileges and obtain sensitive information via StUrls::hookActionDispatcher and StUrls::getInstanceId methods...

Google Android Framework Information Disclosure Vulnerability (CNVD-2024-07121)

Google Android is a Linux-based open source operating system from Google. An information disclosure vulnerability exists in Google Android Framework, which can be exploited by attackers to obtain sensitive information...

RHEL 9 : kernel (RHSA-2023:7382)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7382 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: net/sched: clsfw component can...