16955 matches found
Prototype Pollution
@sentry/browser is vulnerable to Prototype Pollution. The vulnerability is due to inadequate checks on user input or unsafe handling of data within an application when data is not properly validated or sanitized. It allows attackers to manipulate the prototype of objects, leading to potential...
CVE-2024-8927 cgi.force_redirect configuration is bypassable due to the environment variable collision
In PHP versions 8.1. before 8.1.30, 8.2. before 8.2.24, 8.3. before 8.3.12, HTTPREDIRECTSTATUS variable is used to check whether or not CGI binary is being run by the HTTP server. However, in certain scenarios, the content of this variable can be controlled by the request submitter via HTTP...
Schneider Electric Zelio Soft 资源管理错误漏洞
Schneider Electric Zelio Soft is a suite of logic controller programming software from Schneider Electric France. A resource management error vulnerability exists in Schneider Electric Zelio Soft versions prior to v5.4.2.2 that stems from the presence of a post-release reuse vulnerability that...
PT-2025-11523 · Dell · Os10
Name of the Vulnerable Software and Affected Versions: Dell SmartFabric OS10 Software versions 10.5.4.x through 10.6.0.x Description: The issue is related to an Improper Neutralization of Special Elements used in a Command, also known as 'Command Injection'. This could allow a high privileged...
BELL-CVE-2024-46951
Bulletin has no description...
BELL-CVE-2024-46952
Bulletin has no description...
BELL-CVE-2024-46953
Bulletin has no description...
BELL-CVE-2024-46954
Bulletin has no description...
CVE-2024-20098
In power, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08996886; Issue ID: MSV-1626...
CVE-2024-45249
Cavok – CWE-89: Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection'...
The Heimdal Software Kerberos 5 implementation is vulnerable to a null pointer dereferance. An attacker with network access to an application that depends on the vulnerable code path can cause the application to crash.
...
CVE-2024-47854
An XSS vulnerability was discovered in Veritas Data Insight before 7.1. It allows a remote attacker to inject an arbitrary web script into an HTTP request that could reflect back to an authenticated user without sanitization if executed by that user...
GHSA-JJ78-5FMV-MV28 Express Open Redirect vulnerability
URL Redirection to Untrusted Site 'Open Redirect' vulnerability in Express. This vulnerability affects the use of the Express Response object. This issue impacts Express: from 3.4.5 before 4.0.0-rc1...
CVE-2024-41596
Buffer Overflow vulnerabilities exist in DrayTek Vigor310 devices through 4.3.2.6 in the Vigor management UI because of improper retrieval and handling of the CGI form parameters...
CVE-2024-45872
Bandisoft BandiView 7.05 is vulnerable to Buffer Overflow via sub0x410d1d. The vulnerability occurs due to insufficient validation of PSD files...
CGA-29M6-VCQG-GW2W
Bulletin has no description...
Malicious File Download
scoutbrowser is vulnerable to Malicious File Download. The vulnerability is due to insufficient input validation for filenames, which does not properly sanitize the file extensions before serving the files to users, allowing attackers to manipulate file extensions and deliver malicious content...
The vulnerability of the microprogramming software for Rockwell Automation’s ControlLogix 5580 and GuardLogix 5580 allows a intruder to trigger a malfunction during maintenance.
The vulnerability of the microprogrammed software in Rockwell Automation’s ControlLogix 5580 and GuardLogix 5580 systems is related to insufficient checking of exceptional states. Exploiting this vulnerability can allow a malicious actor to cause malfunctions during maintenance operations...
PYSEC-2024-101
OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. A path traversal vulnerability inside of LocalMode's openlocalfile method allows an authenticated user with adequate permissions to download any .txt via the ScreensControllersh...