CVE-2024-0242 Unauthorized access to settings in Qolsys IQ Panel 4 and IQ4 Hub

Under certain circumstances IQ Panel4 and IQ4 Hub panel software prior to version 4.4.2 could allow unauthorized access to settings...

CVE-2024-1329 Nomad Vulnerable to Arbitrary Write Through Symlink Attack

HashiCorp Nomad and Nomad Enterprise 1.5.13 up to 1.6.6, and 1.7.3 template renderer is vulnerable to arbitrary file write on the host as the Nomad client user through symlink attacks. This vulnerability, CVE-2024-1329, is fixed in Nomad 1.7.4, 1.6.7, and 1.5.14...

PT-2024-12874

Name of the Vulnerable Software and Affected Versions Atos Unify OpenScape Voice Trace Manager versions prior to V8 R0.9.11 Description The issue allows authenticated path traversal in the user interface. Recommendations For versions prior to V8 R0.9.11, update to V8 R0.9.11 or later to resolve t...

GHSA-87M3-6QJ3-P3XH Liferay Portal denial of service (memory consumption)

The Document and Media widget In Liferay Portal 7.2.0 through 7.3.6, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 13, and older unsupported versions, does not limit resource consumption when generating a preview image, which allows remote...

GHSA-9VGQ-W5PV-V77Q Liferay Portal stored cross-site scripting (XSS) vulnerability

Stored cross-site scripting XSS vulnerability in the Portal Search module's Search Result app in Liferay Portal 7.2.0 through 7.4.3.11, and older unsupported versions, and Liferay DXP 7.4 before update 8, 7.3 before update 4, 7.2 before fix pack 17, and older unsupported versions allows remote...

BELL-CVE-2024-24575

Bulletin has no description...

CVE-2024-23769

Improper privilege control for the named pipe in Samsung Magician PC Software 8.0.0 for Windows allows a local attacker to read privileged data...

CVE-2024-23673 Apache Sling Servlets Resolver: Malicious code execution via path traversal

Malicious code execution via path traversal in Apache Software Foundation Apache Sling Servlets Resolver.This issue affects all version of Apache Sling Servlets Resolver before 2.11.0. However, whether a system is vulnerable to this attack depends on the exact configuration of the system. If the...

Denial Of Service (DoS)

graphql-go is vulnerable to Uncontrolled Recursion. The vulnerability is caused due to improper malformed input checks within parser.go, which results in Denial Of ServiceDoS...

BELL-CVE-2023-52426

Bulletin has no description...

CVE-2024-20819

Out-of-bounds Write vulnerabilities in svc1tdvldplhap of libsthmbc.so prior to SMR Feb-2024 Release 1 allows local attackers to trigger buffer overflow...

CVE-2024-24255

A Race Condition discovered in geofence.cpp and missionfeasibilitychecker.cpp in PX4 Autopilot 1.14 and earlier allows attackers to send drones on unintended missions...

CVE-2024-24254

PX4 Autopilot 1.14 and earlier, due to the lack of synchronization mechanism for loading geofence data, has a Race Condition vulnerability in the geofence.cpp and missionfeasibilitychecker.cpp. This will result in the drone uploading overlapping geofences and mission routes...

BELL-CVE-2024-25062

Bulletin has no description...

CVE-2023-52426

libexpat through 2.5.0 allows recursive XML Entity Expansion if XMLDTD is undefined at compile time...

CVE-2024-1064 Improper Neutralization of HTTP Headers for Scripting Syntax in Crafty Controller 4

A host header injection vulnerability in the HTTP handler component of Crafty Controller allows a remote, unauthenticated attacker to trigger a Denial of Service DoS condition via a modified host header...

BELL-CVE-2024-24557

Bulletin has no description...

Integer Overflow

ffmpeg is vulnerable to Integer Overflow. The vulnerability is due to improper bounds checking of integer values. A remote attacker can execute arbitrary code via the JJPEG XL Parser...

CVE-2024-23824 mailcow ipixel flood attack leads to Denial of Service in admin page

mailcow is a dockerized email package, with multiple containers linked in one bridged network. The application is vulnerable to pixel flood attack, once the payload has been successfully uploaded in the logo the application goes slow and doesn't respond in the admin page. It is tested on the...

GHSA-QFV2-3P2F-VG48 Duplicate Advisory: Central Dogma Authentication Bypass Vulnerability via Session Leakage

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-34q3-p352-c7q8. This link is maintained to preserve external references. Original Description Central Dogma versions prior to 0.64.0 is vulnerable to Cross-Site Scripting XSS, which could allow for the leakage o...