16955 matches found
BELL-CVE-2024-43894
Bulletin has no description...
BELL-CVE-2024-43914
Bulletin has no description...
BELL-CVE-2024-43912
Bulletin has no description...
BELL-CVE-2024-43884
Bulletin has no description...
Denial Of Service (DoS)
Flowise is vulnerable to Denial of Service DoS. The vulnerability is due to improper handling of user-supplied input to the /api/v1/get-upload-file API endpoint, which allows an attacker to crash the instance running the vulnerable version...
CVE-2024-42900
Ruoyi v4.7.9 and before was discovered to contain a cross-site scripting XSS vulnerability via the sql parameter of the createTable function at /tool/gen/create...
PT-2024-31300 · Irfanview · Irfanview
Name of the Vulnerable Software and Affected Versions: Irfanview version 4.67.1.0 Description: An issue in the component EXR!ReadEXR+0x40ef1 of Irfanview allows attackers to cause an access violation via a crafted EXR file. This can lead to a Denial of Service DoS. Recommendations: For Irfanview...
CVE-2024-45049 Nix Hydra Missing authentication when triggering evaluations
Hydra is a Continuous Integration service for Nix based projects. It is possible to trigger evaluations in Hydra without any authentication. Depending on the size of evaluations, this can impact the availability of systems. The problem can be fixed by applying...
Buffer Overflow
Fort is vulnerable to Buffer Overflow. The vulnerability is caused due to a malicious RPKI repository that descends from a trusted Trust Anchor can serve via rsync or RRDP a resource certificate containing a Key Usage extension composed of more than two bytes of data. Fort writes this string into...
CVE-2024-5814 Unverifed Ciphersuite used on a client-side TLS1.3 Downgrade
A malicious TLS1.2 server can force a TLS1.3 client with downgrade capability to use a ciphersuite that it did not agree to and achieve a successful connection. This is because, aside from the extensions, the client was skipping fully parsing the server hello...
CVE-2024-5991 Buffer overread in domain name matching
In function MatchDomainName, input param str is treated as a NULL terminated string despite being user provided and unchecked. Specifically, the function X509checkhost takes in a pointer and length to check against, with no requirements that it be NULL terminated. If a caller was attempting to do...
PT-2024-38449 · Trellix · Trellix Fx +5
Name of the Vulnerable Software and Affected Versions: Trellix NX, EX, FX, AX, IVX, and CMS affected versions not specified Description: An authenticated user can access restricted files from Trellix products using path traversal for the URL of network anomaly download artifact. This issue allows...
CVE-2024-43258
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Store Locator Plus.This issue affects Store Locator Plus: from n/a through 2311.17.01...
BIT-GITLAB-2024-6502 Incorrect Provision of Specified Functionality in GitLab
An issue was discovered in GitLab CE/EE affecting all versions starting from 8.2 prior to 17.1.6 starting from 17.2 prior to 17.2.4, and starting from 17.3 prior to 17.3.1, which allows an attacker to create a branch with the same name as a deleted tag...
ROS-20240826-23
A vulnerability in the Blender three-dimensional computer graphics software suite is related to the lack of validation for values less than 0. Exploitation of the vulnerability allows an attacker acting remotely to gain access to sensitive data, compromise its integrity, and cause a denial of...
BELL-CVE-2024-43883
Bulletin has no description...
PT-2024-31501 · Hyperledger · Hyperledger Fabric
Name of the Vulnerable Software and Affected Versions: Hyperledger Fabric versions 2.5.0 through 2.5.9 Description: The issue is related to Hyperledger Fabric not verifying that a request has a timestamp within the expected time window. This problem can be exploited due to the lack of proper...
Diesel vulnerable to Binary Protocol Misinterpretation caused by Truncating or Overflowing Casts
The following presentation at this year's DEF CON was brought to our attention on the Diesel Gitter Channel: SQL Injection isn't Dead: Smuggling Queries at the Protocol Level Archive link for posterity. Essentially, encoding a value larger than 4GiB can cause the length prefix in the protocol to...
Improper Access Control
github.com/mattermost/mattermost-server is vulnerable to Improper Access Control. The vulnerability is caused due to a failure to enforce permissions which allows a guest user with read access to upload files to a channel...