16955 matches found
BELL-CVE-2024-47660
Bulletin has no description...
BELL-CVE-2024-47672
Bulletin has no description...
OSV-2024-1207 Security exception in org.apache.poi.hdgf.streams.CompressedStreamStore.decompress
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=372515093 Crash type: Security exception Crash state: org.apache.poi.hdgf.streams.CompressedStreamStore.decompress org.apache.poi.hdgf.streams.CompressedStreamStore. org.apache.poi.hdgf.streams.Stream.createStream...
OSV-2024-1205 Memcpy-param-overlap in repeat
OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=372515088 Crash type: Memcpy-param-overlap Crash state: repeat repeat pere...
WordPress plugin Bit Form 输入验证错误漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An input validation error...
PYSEC-2024-198
Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves data exposure due to the enablemonitoring flag not properly disabling monitoring when set to False. Even when monitoring is supposedly disabled, an attacker or unauthorized user can still access th...
GHSA-HM3C-93PG-4CXW In Gradio, the `enable_monitoring` flag set to `False` does not disable monitoring
Impact What kind of vulnerability is it? Who is impacted? This vulnerability involves data exposure due to the enablemonitoring flag not properly disabling monitoring when set to False. Even when monitoring is supposedly disabled, an attacker or unauthorized user can still access the monitoring...
CVE-2024-9312
Authd, through version 0.3.6, did not sufficiently randomize user IDs to prevent collisions. A local attacker who can register user names could spoof another user's ID and gain their privileges...
Improper Authentication
github.com/ubuntu/authd is vulnerable to Improper Authentication. The vulnerability is due to improper management of broker-managed users, allowing them to impersonate any other user managed by the same broker and perform PAM operations, including authentication...
MAL-2024-9157 Malicious code in knu2bb (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 244d62f88aebd6b02796516f10f0cb8eba074b905b90a8c3cb938789c12c04f1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2024-9121 Malicious code in 9sx4qq (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 93e7ac80522a29318316b44f427a42711f885ebdb471e8bf73e51a4c1fb84742 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
BELL-CVE-2024-43485
Bulletin has no description...
BELL-CVE-2024-43483
Bulletin has no description...
Denial Of Service (DoS)
@rocket.chat/message-parser is vulnerable to Denial Of Service DoS. The vulnerability is due to by crafted messages with specific characters crashing the workspace due to an issue in the message parser, allowing an attacker to exploit this weakness...
MAL-2024-9159 Malicious code in kubeman (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7e6d4cbe85dc40f9f7ef83650de23c841fe055085bfe4da5053024d3e3dbb686 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Facets - Critical - Cross Site Scripting - SA-CONTRIB-2024-047
This module enables you to to easily create and manage faceted search interfaces. The module doesn't sufficiently filter for malicious script leading to a reflected cross site scripting XSS vulnerability. The vulnerability exists in the Facets Summary submodule. If you do not use that sub module...
PT-2024-7663 · Curl +9 · Curl +9
Name of the Vulnerable Software and Affected Versions: curl versions prior to 8.10.1 Description: The issue is related to the implementation of the HSTS HTTP Strict Transport Security mechanism in the curl utility. When curl is asked to use HSTS, the expiry time for a subdomain might overwrite a...
CVE-2024-43484
.NET, .NET Framework, and Visual Studio Denial of Service Vulnerability...