CVE-2023-50913

The CVE-2023-50913 entry refers to the Oxide control plane software prior to version 5, where a Server-Side Request Forgery (SSRF) vulnerability is present. The issue affects the Oxide control plane software and is characterized by SSRF with high impact to confidentiality and integrity (per CVSS ...

PT-2024-9183 · Abb · Abb Aspect +2

Name of the Vulnerable Software and Affected Versions: ABB ASPECT - Enterprise version 3.08.02 NEXUS Series version 3.08.02 MATRIX Series version 3.08.02 Description: Information Disclosure vulnerabilities allow access to application configuration information. The issue is related to errors in...

CVE-2024-53472

WeGIA v3.2.0 was discovered to contain a Cross-Site Request Forgery CSRF...

op_panic in the base runtime can force a panic in the runtime's containing thread

Affected versions use denocore releases that expose Deno.core.ops.oppanic to the JS runtime in the base core This function when called triggers a manual panic in the thread containing the runtime. It can be fixed by stubbing out the exposed op: javascript Deno.core.ops.oppanic = msg = throw new...

GO-2024-3304 Moby Race Condition vulnerability in github.com/moby/moby

Moby Race Condition vulnerability in github.com/moby/moby...

CVE-2024-53133 drm/amd/display: Handle dml allocation failure to avoid crash

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Handle dml allocation failure to avoid crash Why In the case where a dml allocation fails for any reason, the current state's dml contexts would no longer be valid. Then subsequent calls dcstatecopyinternal would...

CVE-2024-12138 horilla create_skills deserialization

A vulnerability classified as critical was found in horilla up to 1.2.1. This vulnerability affects the function requestnew/getemployeeshift/createreimbursement/keyresultcurrentvalueupdate/createmeetings/createskills. The manipulation leads to deserialization. The attack can be initiated remotely...

Improper Message Recipient Validation

moodle/moodle is vulnerable to Improper Message Recipient Validation. The vulnerability is due to insufficient input validation. Specifically, the system does not properly verify that the message recipients belong to the set of users returned by the non-respondents report, allowing messages to be...

PT-2024-35144 · Tenda · Tenda Ac6V2

Name of the Vulnerable Software and Affected Versions: Tenda AC6V2 versions through 15.03.06.50 Description: The issue is a stack-based buffer overflow vulnerability in the setDoubleL2tpConfig-guest ip check modules, allowing buffer overflows. This vulnerability affects Tenda AC6V2 and can be...

Download All Files - Critical - Access bypass - SA-CONTRIB-2024-069

This module provides a field formatter for the field type 'file' called Table of files with download all link . The module had vulnerabilities allowing a user to download files they normally should not be able to download...

Pages Restriction Access - Critical - Access bypass - SA-CONTRIB-2024-068

Module to restrict access from anonymous and regular users to configured pre-defined pages. The module does not adequately handle protecting certain types of URLs...

Cisco Application Policy Infrastructure Permissions, Privileges, and Access Controls (CVE-2015-4235)

Cisco Application Policy Infrastructure Controller APIC devices with software before 1.03o and 1.1 before 1.11j and Nexus 9000 ACI devices with software before 11.04o and 11.1 before 11.11j do not properly restrict access to the APIC filesystem, which allows remote authenticated users to obtain...

CVE-2024-54675

app/webroot/js/workflows-editor/workflows-editor.js in MISP through 2.5.2 has stored XSS in the editor interface for an ad-hoc workflow...

Sensitive Information Exposure

Moodle is vulnerable to Sensitive Information Exposure. The vulnerability is due to sensitive secrets and keys not being excluded from site administration preset exports, potentially leading to unintentional data leaks when presets are shared with third parties...

BELL-CVE-2024-53103

Bulletin has no description...

BELL-CVE-2024-53120

Bulletin has no description...

BELL-CVE-2024-53108

Bulletin has no description...

BELL-CVE-2024-53106

Bulletin has no description...

ibexa/post-install affected by Breach with Varnish VCL

Impact This is not a vulnerability in the code per se, but included platform.sh Varnish VCL templates and Apache/Nginx vhost templates enable compression of API and JSON messages. This is a potential case of the BREACH vulnerability, which affects HTTP compression, where secrets can be extracted...

CVE-2024-53848

A flaw was found in check-jsonschema. The default cache strategy uses the basename of a remote schema as the name of the file in the cache, for example, https://example.org/schema.json, which will be stored as schema.json. This naming allows for conflicts. If an attacker can get a user to run...