16962 matches found
PT-2024-11518 · Ibm · Ibm Robotic Process Automation
Name of the Vulnerable Software and Affected Versions: IBM Robotic Process Automation version 21.0.2 Description: The issue allows user ids to be exposed across tenants. Recommendations: For IBM Robotic Process Automation version 21.0.2, at the moment, there is no information about a newer versio...
CVE-2024-24337
CSV Injection vulnerability in '/members/moremember.pl' and '/admin/aqbudgets.pl' endpoints in Koha Library Management System version 23.05.05 and earlier allows attackers to to inject DDE commands into csv exports via the 'Budget' and 'Patrons Member' components...
CVE-2023-45718 HCL Sametime is impacted by a failure to invalidate sessions
Sametime is impacted by a failure to invalidate sessions. The application is setting sensitive cookie values in a persistent manner in Sametime Web clients. When this happens, cookie values can remain valid even after a user has closed out their session...
Sensitive Information Disclosure
github.com/rancher/rancher is vulnerable to Sensitive Information Disclosure. This vulnerability arises due to the exposure of various sensitive data, including HTTP headers, credentials, and API Server calls, leaked into Rancher's audit logs when AUDITLEVEL is set to 1 or above. An attacker can...
CVE-2024-23749
KiTTY versions 0.76.1.13 and before is vulnerable to command injection via the filename variable, occurs due to insufficient input sanitization and validation, failure to escape special characters, and insecure system calls at lines 2369-2390. This allows an attacker to add inputs inside the...
CVE-2024-25677
In Min before 1.31.0, local files are not correctly treated as unique security origins, which allows them to improperly request cross-origin resources. For example, a local file may request other local files through an XML document...
CVE-2024-0242 Unauthorized access to settings in Qolsys IQ Panel 4 and IQ4 Hub
Under certain circumstances IQ Panel4 and IQ4 Hub panel software prior to version 4.4.2 could allow unauthorized access to settings...
CVE-2024-1329 Nomad Vulnerable to Arbitrary Write Through Symlink Attack
HashiCorp Nomad and Nomad Enterprise 1.5.13 up to 1.6.6, and 1.7.3 template renderer is vulnerable to arbitrary file write on the host as the Nomad client user through symlink attacks. This vulnerability, CVE-2024-1329, is fixed in Nomad 1.7.4, 1.6.7, and 1.5.14...
PT-2024-12874
Name of the Vulnerable Software and Affected Versions Atos Unify OpenScape Voice Trace Manager versions prior to V8 R0.9.11 Description The issue allows authenticated path traversal in the user interface. Recommendations For versions prior to V8 R0.9.11, update to V8 R0.9.11 or later to resolve t...
GHSA-87M3-6QJ3-P3XH Liferay Portal denial of service (memory consumption)
The Document and Media widget In Liferay Portal 7.2.0 through 7.3.6, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 13, and older unsupported versions, does not limit resource consumption when generating a preview image, which allows remote...
GHSA-9VGQ-W5PV-V77Q Liferay Portal stored cross-site scripting (XSS) vulnerability
Stored cross-site scripting XSS vulnerability in the Portal Search module's Search Result app in Liferay Portal 7.2.0 through 7.4.3.11, and older unsupported versions, and Liferay DXP 7.4 before update 8, 7.3 before update 4, 7.2 before fix pack 17, and older unsupported versions allows remote...
BELL-CVE-2024-24575
Bulletin has no description...
CVE-2024-23769
Improper privilege control for the named pipe in Samsung Magician PC Software 8.0.0 for Windows allows a local attacker to read privileged data...
CVE-2024-23673 Apache Sling Servlets Resolver: Malicious code execution via path traversal
Malicious code execution via path traversal in Apache Software Foundation Apache Sling Servlets Resolver.This issue affects all version of Apache Sling Servlets Resolver before 2.11.0. However, whether a system is vulnerable to this attack depends on the exact configuration of the system. If the...
Denial Of Service (DoS)
graphql-go is vulnerable to Uncontrolled Recursion. The vulnerability is caused due to improper malformed input checks within parser.go, which results in Denial Of ServiceDoS...
BELL-CVE-2023-52426
Bulletin has no description...
CVE-2024-20819
Out-of-bounds Write vulnerabilities in svc1tdvldplhap of libsthmbc.so prior to SMR Feb-2024 Release 1 allows local attackers to trigger buffer overflow...
CVE-2024-24255
A Race Condition discovered in geofence.cpp and missionfeasibilitychecker.cpp in PX4 Autopilot 1.14 and earlier allows attackers to send drones on unintended missions...
CVE-2024-24254
PX4 Autopilot 1.14 and earlier, due to the lack of synchronization mechanism for loading geofence data, has a Race Condition vulnerability in the geofence.cpp and missionfeasibilitychecker.cpp. This will result in the drone uploading overlapping geofences and mission routes...