CVE-2024-1064 Improper Neutralization of HTTP Headers for Scripting Syntax in Crafty Controller 4

A host header injection vulnerability in the HTTP handler component of Crafty Controller allows a remote, unauthenticated attacker to trigger a Denial of Service DoS condition via a modified host header...

BELL-CVE-2024-24557

Bulletin has no description...

Integer Overflow

ffmpeg is vulnerable to Integer Overflow. The vulnerability is due to improper bounds checking of integer values. A remote attacker can execute arbitrary code via the JJPEG XL Parser...

CVE-2024-23824 mailcow ipixel flood attack leads to Denial of Service in admin page

mailcow is a dockerized email package, with multiple containers linked in one bridged network. The application is vulnerable to pixel flood attack, once the payload has been successfully uploaded in the logo the application goes slow and doesn't respond in the admin page. It is tested on the...

GHSA-QFV2-3P2F-VG48 Duplicate Advisory: Central Dogma Authentication Bypass Vulnerability via Session Leakage

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-34q3-p352-c7q8. This link is maintained to preserve external references. Original Description Central Dogma versions prior to 0.64.0 is vulnerable to Cross-Site Scripting XSS, which could allow for the leakage o...

Design/Logic Flaw

In Rapid Software LLC's Rapid SCADA versions prior to Version 5.8.4, the affected product stores plaintext credentials in various places. This may allow an attacker with local access to see them...

BELL-CVE-2023-6779

Bulletin has no description...

BELL-CVE-2024-0853

Bulletin has no description...

BELL-CVE-2024-21626

Bulletin has no description...

ASB-A-300741186

In removePersistentDot of SystemStatusAnimationSchedulerImpl.kt, there is a possible race condition due to a logic error in the code. This could lead to local escalation of privilege that fails to remove the persistent dot with no additional execution privileges needed. User interaction is not...

Enumeration of users in HashiCorp Vault

HashiCorp Vault and Vault Enterprise allowed the enumeration of users via the LDAP auth method. Fixed in 1.5.6 and 1.6.1...

AZL-34081 CVE-2024-23653 affecting package moby-compose for versions less than 2.17.2-7

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. In addition to running containers as build steps, BuildKit also provides APIs for running interactive containers based on built images. It was possible to use these APIs to ask...

BIT-CANVASLMS-2021-36539

Instructure Canvas LMS didn't properly deny access to locked/unpublished files when the unprivileged user access the DocViewer based file preview URL canvadocsessionurl...

BELL-CVE-2023-5992

Bulletin has no description...

SUSE CVE-2023-46840

Incorrect placement of a preprocessor directive in source code results in logic that doesn't operate as intended when support for HVM guests is compiled out of Xen...

Contact Form Entries < 1.3.3 - Admin+ Arbitrary File Upload

Description The plugin is vulnerable to arbitrary file uploads due to insufficient file validation on the 'viewpage' function, allowing authenticated attackers with administrator-level capabilities or above, to upload arbitrary files on the affected site's server which may make remote code...

The vulnerability of the microprogrammed software of Emerson Rosemount X-STREAM flow analyzers allows a intruder to disclose protected information.

The vulnerability of Microprogrammed Software in Emerson Rosemount X-STREAM flow analyzers is related to insufficient encryption reliability. Exploiting this vulnerability could allow a malicious actor to disclose the protected information...

PYSEC-2024-31

The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning FL and Multi-Party Computation MPC. It is possible to find out usernames from the response time of login requests. This could aid attackers in credential attacks. Version 4.2.0 patches this...

CVE-2024-22200 vantage6-UI docker image leaks software version information

vantage6-UI is the User Interface for vantage6. The docker image used to run the UI leaks the nginx version. To mitigate the vulnerability, users can run the UI as an angular application. This vulnerability was patched in 4.2.0...

PT-2024-1498 · Totolink · Totolink A3300R

Name of the Vulnerable Software and Affected Versions: TOTOLINK A3300R version 17.0.0cu.557 B20221024 Description: A command injection issue was found in the setMacFilterRules function due to inadequate neutralization of special elements. This allows a remote attacker to execute arbitrary command...