The vulnerability of the Navidrome media server, related to the lack of protective measures for the SQL query structure, allows attackers to execute arbitrary code and disclose the protected information.

The vulnerability of the Navidrome media server relates to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code and disclose sensitive information by sending specially crafted SQL queries...

The vulnerability of the Core server component of Oracle WebLogic Server, a software platform of Oracle Fusion Middleware, allows an attacker to gain full access to the vulnerable software.

The vulnerability of the Core server component of Oracle WebLogic Server, a software platform of Oracle Fusion Middleware, is related to errors in processing input data. Exploiting this vulnerability allows an attacker, operating remotely, to gain full access to the vulnerable software by sending...

Admidio Vulnerable to HTML Injection In The Messages Section

An unsafe deserialization vulnerability allows any unauthenticated user to execute arbitrary code on the server...

AZL-50366 CVE-2024-21219 affecting package mysql for versions less than 8.0.40-1

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: DML. Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and 9.0.1 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromi...

CVE-2024-21196

CVE-2024-21196 affects the Oracle MySQL Server (component: Server: X Plugin). Affected versions are 8.0.39 and earlier, 8.4.2 and earlier, and 9.0.1 and earlier. The description states that a low-privileged attacker with network access via multiple protocols can exploit this to cause the MySQL Se...

CVE-2024-48914

Summary (CVE-2024-48914): Vendure’s asset server plugin allows an attacker to traverse the server filesystem and read arbitrary files, including configs and environment data, due to using the decoded request path directly in path.join (no normalization). A second vector in the same code path can ...

CVE-2024-46898

SHIRASAGI prior to v1.19.1 processes URLs in HTTP requests improperly, resulting in a path traversal vulnerability. If this vulnerability is exploited, arbitrary files on the server may be retrieved when processing crafted HTTP requests...

CVE-2024-42640

CVE-2024-42640 affects the Angular-base64-upload library prior to v0.1.21. The root cause is unauthenticated remote code execution via the demo/server.php endpoint, allowing an attacker to upload arbitrary content that can be accessed at demo/uploads and executed on the server. Affected packages ...

The vulnerability of the Remote Desktop Protocol Server, which handles remote desktop connections for Windows operating systems, allows a hacker to execute arbitrary code.

The vulnerability of the Remote Desktop Protocol Server for Windows operating systems relates to the use of memory after it is freed. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

CVE-2024-43582

Remote Desktop Protocol Server Remote Code Execution Vulnerability...

Exposure Of Information Through Directory Listing

@saltcorn/server is vulnerable to Exposure of Information Through Directory Listing. The vulnerability is due to missing validations of the builddirname parameter. This allows an attacker with admin permission to view files and directories on the filesystem...

CVE-2024-46887

The web server of affected devices do not properly authenticate user request to the '/ClientArea/RuntimeInfoData.mwsl' endpoint. This could allow an unauthenticated remote attacker to gain knowledge about current actual and configured maximum cycle times as well as about configured maximum...

Security Bulletin: Multiple vulnerabilities in microsoft.netcore.app affect IBM Robotic Process Automation.

Summary Multiple vulnerabilities in IBM microsoft.netcore.app affect IBM Robotic Process Automation. The vulnerabilities exist in BrotliSharpLib which was determined to not be required by IBM Robotic Process Automation. The offending module was removed from the product. Vulnerability Details...

The vulnerability of the cfGetPrinterAttributes5 function in the libcupsfilters library of the CUPS printing server allows a attacker to disclose protected information.

The vulnerability of the cfGetPrinterAttributes5 function in the libcupsfilters library of the CUPS printing server is related to the lack of measures taken to neutralize special elements used in OS commands. Exploiting this vulnerability may allow a malicious actor to disclose protected...

CVE-2024-6394

CVE-2024-6394 is a Local File Inclusion vulnerability affecting parisneo/lollms-webui versions below 9.8, caused by unverified path concatenation in the serve_js function of app.py. This flaw enables path traversal to access arbitrary server files, potentially exposing sensitive data such as priv...

Unauthorized File Access

Mesop is vulnerable to insufficient input validation. The vulnerability is due to lack of proper input validation mechanisms in the specific endpoint of the Mesop application, which allows an attacker to access files on the server that are not intended to be served...

MacTaggart Scott: Overwrite any file of the web server

The web server was vulnerable to file overwrite due to a vulnerable module used to generate files. An attacker could have overwritten any file on the web server, including critical system files, by sending a specially crafted request...

The vulnerability of the web servers of the microprogramming software for communication modules of SIMATIC CP, SIPLUS ET, and SIPLUS NET CP allows a perpetrator to cause service interruptions.

The vulnerability of the web servers of microprogramming software for communication modules of SIMATIC CP, SIPLUS ET, and SIPLUS NET CP is related to the use of memory after it is freed. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

GHSA-WCJW-3V6P-4V3R MindsDB Eval Injection vulnerability

An arbitrary code execution vulnerability exists in versions 23.10.3.0 up to 24.7.4.1 of the MindsDB platform, when the Weaviate integration is installed on the server. If a specially crafted ‘SELECT WHERE’ clause containing Python code is run against a database created with the Weaviate engine,...

PYSEC-2024-77

An arbitrary code execution vulnerability exists in versions 23.10.3.0 up to 24.7.4.1 of the MindsDB platform, when the Weaviate integration is installed on the server. If a specially crafted ‘SELECT WHERE’ clause containing Python code is run against a database created with the Weaviate engine,...