12585 matches found
CVE-2024-22412 ClickHouse's Role-based Access Control is bypassed when query caching is enabled.
ClickHouse is an open-source column-oriented database management system. A bug exists in the cloud ClickHouse offering prior to version 24.0.2.54535 and in github.com/clickhouse/clickhouse version 23.1. Query caching bypasses the role based access controls and the policies being enforced on roles...
PT-2024-2273 · Unitronics · Unilogic
Name of the Vulnerable Software and Affected Versions: Unitronics Unistream Unilogic versions prior to 1.35.227 Description: The issue is related to the use of less trusted sources, which may allow remote code execution. Exploitation of this issue could enable a remote attacker to execute arbitra...
PT-2024-2290 · Adobe · Animate
Name of the Vulnerable Software and Affected Versions: Adobe Animate versions 24.0, 23.0.3 and earlier Description: The issue is caused by a buffer overflow in dynamic memory, which could allow an attacker to execute arbitrary code by using a specially crafted file. Exploitation of this issue...
PT-2024-2918 · Ivanti · Ivanti Avalanche
Name of the Vulnerable Software and Affected Versions: Ivanti Avalanche versions prior to 6.4.3 Description: The issue is related to a Path Traversal vulnerability in the web component of Ivanti Avalanche. This vulnerability allows a remote authenticated attacker to delete specific types of files...
PT-2024-14652 · Linux +10 · Linux Kernel +10
Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.7.0-rc3 Description: The Linux kernel has a vulnerability in the net/sched module, specifically in the act ct function. This function adds a reference to the skb socket buffer before defragmentation, which can...
JVN#94521208: Multiple vulnerabilities in FitNesse
FitNesse contains multiple vulnerabilities listed below. Multiple cross-site scripting CWE-79 - CVE-2024-23604, CVE-2024-28128 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N| Base Score: 6.1 CVSS v2| AV:N/AC:M/Au:N/C:N/I:P/A:N| Base Score: 4.3 Improper...
PT-2024-2912 · Ivanti · Ivanti Avalanche
Name of the Vulnerable Software and Affected Versions: Ivanti Avalanche versions prior to 6.4.3 Description: The issue is related to a Path Traversal vulnerability in the web component of Ivanti Avalanche. This vulnerability is due to incorrect restriction of the directory path name with limited...
Low: thunderbird
Issue Overview: The encrypted subject of an email message could be incorrectly and permanently assigned to an arbitrary other email message in Thunderbird's local cache. Consequently, when replying to the contaminated email message, the user might accidentally leak the confidential subject to a...
MGASA-2024-0062 Updated mplayer packages fix security vulnerabilities
The MPlayer Project mencoder SVN-r38374-13.0.1 is vulnerable to Divide By Zero via the function config of llibmpcodecs/vfscale.c. CVE-2022-38850 Certain The MPlayer Project products are vulnerable to Out-of-bounds Read via function readmetarecord of mplayer/libmpdemux/asfheader.c. This affects...
PT-2024-4249
Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 4.0.4 Apache CXF versions prior to 3.6.3 Apache CXF versions prior to 3.5.8 Description A Server-Side Request Forgery SSRF vulnerability in Apache CXF's Aegis DataBinding allows an attacker to perform SSRF style...
Cisco IOS XR Software SNMP Management Plane Protection ACL Bypass Vulnerability
A vulnerability in the UDP forwarding code of Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to bypass configured management plane protection policies and access the Simple Network Management Plane SNMP server of an affected device. This vulnerability is due to incorrect...
PT-2024-22522 · Dedecms · Dedecms
Name of the Vulnerable Software and Affected Versions: DedeCMS version 5.7 Description: A Cross-Site Request Forgery CSRF issue was found in DedeCMS. The vulnerability can be exploited via the "/dede/diy add.php" API endpoint. Recommendations: For DedeCMS version 5.7, update to a version that...
Apache Pulsar: Pulsar Functions Worker Allows Unauthorized File Access and Unauthorized HTTP/HTTPS Proxying
The Pulsar Functions Worker includes a capability that permits authenticated users to create functions where the function's implementation is referenced by a URL. The supported URL schemes include "file", "http", and "https". When a function is created using this method, the Functions Worker will...
Intel Chipset Software and SPS Advisory - Lenovo Support US
No description provided...
RLSA-2024:0950 Important: postgresql:15 security update
PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: postgresql: non-owner 'REFRESH MATERIALIZED VIEW CONCURRENTLY' executes arbitrary SQL CVE-2024-0985 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and oth...
PT-2024-21789 · Unknown · A-Blog Cms
Name of the Vulnerable Software and Affected Versions: a-blog cms versions 3.1.x through 3.1.9 and earlier a-blog cms versions 3.0.x through 3.0.30 and earlier a-blog cms versions 2.11.x through 2.11.59 and earlier a-blog cms versions 2.10.x through 2.10.51 and earlier a-blog cms version 2.9 and...
PT-2024-2105 · Ibm · Ibm Qradar Siem On Azure Cloud
Name of the Vulnerable Software and Affected Versions: Open Management Infrastructure OMI versions prior to the fixed version IBM QRadar SIEM on Azure Cloud versions 7.3.3 through 7.5.0 Description: The Open Management Infrastructure OMI Remote Code Execution Vulnerability is related to the use o...
2024.1 IPU - Intel® Chipset Software and SPS Advisory
Summary: Potential security vulnerabilities in the Intel® Converged Security Management Engine CSME installer, Intel® Local Manageability Service software and Intel® Server Platform Servcies SPS may allow information disclosure, escalation of privilege, or denial of service. Vulnerability Details...
PT-2024-20679 · Unknown · Skysea Client View
Name of the Vulnerable Software and Affected Versions: SKYSEA Client View versions from Ver.11.220 prior to Ver.19.2 Description: An improper access control issue exists in the resident process of SKYSEA Client View. This issue can be exploited to execute an arbitrary process with SYSTEM privileg...