17016 matches found
Path Traversal / Code Injection
willdurand/js-translation-bundle is vulnerable to path traversal and JavaScript code injection. These vulnerabilities are due to insufficient input validation, allowing attackers to manipulate file paths and inject malicious scripts into the application...
CVE-2024-0085
NVIDIA vGPU software for Windows and Linux contains a vulnerability where unprivileged users could execute privileged operations on the host. A successful exploit of this vulnerability might lead to data tampering, escalation of privileges, and denial of service...
CVE-2024-0085
CVE-2024-0085 concerns NVIDIA vGPU software for Windows and Linux, where an unprivileged user could perform privileged host operations. Documents consistently describe impact as data tampering, privilege escalation, and denial of service. Red Hat and other sources align on NVIDIA GPU Driver compo...
GHSA-F7Q4-9GWV-6774 Magento Open Source Improper Authentication vulnerability
Adobe Commerce versions 2.4.7, 2.4.6-p5, 2.4.5-p7, 2.4.4-p8 and earlier are affected by an Improper Authentication vulnerability that could result in privilege escalation. An attacker could exploit this vulnerability to gain unauthorized access or elevated privileges within the application...
BELL-CVE-2024-36971
Bulletin has no description...
BELL-CVE-2024-36969
Bulletin has no description...
BELL-CVE-2024-36968
Bulletin has no description...
CVE-2024-1659 Arbitrary File Upload in MegaBIP
Arbitrary File Upload vulnerability in MegaBIP software allows attacker to upload any file to the server including a PHP code file without an authentication. This issue affects MegaBIP software versions through 5.10...
CVE-2024-1577 Remote Code Execution in MegaBIP
Remote Code Execution vulnerability in MegaBIP software allows to execute arbitrary code on the server without requiring authentication by saving crafted by the attacker PHP code to one of the website files. This issue affects MegaBIP software versions through 5.11.2...
CVE-2024-1576 SQL Injection in MegaBIP
SQL Injection vulnerability in MegaBIP software allows attacker to obtain site administrator privileges, including access to the administration panel and the ability to change the administrator password. This issue affects MegaBIP software versions through 5.09...
MAL-2024-1590 Malicious code in ing-feat-lu-luxtrust-smartcard-authentication (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis e101f8c803c8ca5e2fddab02abc82d9de8ce89fd23fb6f52bc2fd31a73c0fa01 The OpenSSF Package Analysis project identified 'ing-feat-lu-luxtrust-smartcard-authentication' @ 200.0.1 npm as malicious. It is considered...
MAL-2024-1589 Malicious code in ing-feat-lu-luxtrust-scan-authentication (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 7a039831f4f0151208c7b3baf088dc5e4ca8dd88bbcbc4b5317c3b5e278557e7 The OpenSSF Package Analysis project identified 'ing-feat-lu-luxtrust-scan-authentication' @ 200.0.1 npm as malicious. It is considered maliciou...
Insufficient Session Expiration
zenml is vulnerable to Insufficient Session Expiration. The vulnerability is due to the application not terminating existing sessions after a user's password is updated, allowing attackers to maintain access even after security credentials have been changed...
Regular Expression Denial Of Service (ReDoS)
ua-parser/uap-php is vulnerable toRegular Expression Denial Of Service ReDoS. The vulnerability is due to use of inefficient or poorly constructed regular expressions that can take an exceptionally long time to evaluate against certain input strings, which results in Regular Expression Denial Of...
CVE-2024-32143 WordPress Podlove Podcast Publisher plugin <= 4.1.0 - Broken Access Control vulnerability
Missing Authorization vulnerability in Podlove Podlove Podcast Publisher.This issue affects Podlove Podcast Publisher: from n/a through 4.1.0...
Google Chrome 安全漏洞
Google Chrome is a web browser from Google, an American company. A security bypass vulnerability previously existed in Google Chrome version 126.0.6478.54, which can be exploited by attackers to bypass security restrictions...
PT-2024-6619
Name of the Vulnerable Software and Affected Versions: VLC media player versions 3.0.20 and earlier Description: The issue is related to an integer overflow in VLC media player, which could be triggered by a maliciously crafted mms stream, potentially leading to a denial of service or arbitrary...
@grpc/grpc-js can allocate memory for incoming messages well above configured limits
Impact There are two separate code paths in which memory can be allocated per message in excess of the grpc.maxreceivemessagelength channel option: 1. If an incoming message has a size on the wire greater than the configured limit, the entire message is buffered before it is discarded. 2. If an...
CVE-2024-27838
The issue was addressed by adding additional logic. This issue is fixed in tvOS 17.5, iOS 16.7.8 and iPadOS 16.7.8, visionOS 1.2, Safari 17.5, iOS 17.5 and iPadOS 17.5, watchOS 10.5, macOS Sonoma 14.5. A maliciously crafted webpage may be able to fingerprint the user...