3753 matches found
CVE-2024-36474
An integer overflow vulnerability exists in the Compound Document Binary File format parser of the GNOME Project G Structured File Library libgsf version v1.14.52. A specially crafted file can result in an integer overflow when processing the directory from the file that allows for an out-of-boun...
CVE-2024-9395
A specially crafted filename containing a large number of spaces could obscure the file's extension when displayed in the download dialog. This bug only affects Firefox for Android. Other versions of Firefox are unaffected. This vulnerability affects Firefox 131...
CVE-2024-9394
An attacker could, via a specially crafted multipart response, execute arbitrary JavaScript under the resource://devtools origin. This could allow them to access cross-origin JSON content. This access is limited to "same site" documents by the Site Isolation feature on desktop clients, but full...
CVE-2024-9395
A specially crafted filename containing a large number of spaces could obscure the file's extension when displayed in the download dialog. This bug only affects Firefox for Android. Other versions of Firefox are unaffected. This vulnerability affects Firefox 131...
CVE-2024-9399
A website configured to initiate a specially crafted WebTransport session could crash the Firefox process leading to a denial of service condition. This vulnerability affects Firefox 131, Firefox ESR 128.3, Thunderbird 128.3, and Thunderbird 131...
Advantech ADAM-5630 访问控制错误漏洞
The Advantech ADAM-5630 is an Edge Intelligent Data Acquisition Controller from Advantech China. The Advantech ADAM-5630 suffers from an access control error vulnerability that originates from the ability to execute built-in commands without authentication via a specially crafted request...
CVE-2024-44187
A vulnerability was found in WebKit. This flaw allows a remote attacker to exfiltrate data cross-origin by convincing a victim to visit a specially crafted website, which results in obtaining sensitive information. Mitigation Mitigation for this issue is either not available or the currently...
CVE-2024-8942
Vulnerability in Scriptcase version 9.4.019 that consists of a Cross-Site Scripting XSS, due to the lack of input validation, affecting the “idformmsgtitle” parameter, among others. This vulnerability could allow a remote user to send a specially crafted URL to a victim and retrieve their...
CVE-2024-8942 Cross-site Scripting vulnerability on Scriptcase
Vulnerability in Scriptcase version 9.4.019 that consists of a Cross-Site Scripting XSS, due to the lack of input validation, affecting the “idformmsgtitle” parameter, among others. This vulnerability could allow a remote user to send a specially crafted URL to a victim and retrieve their...
MacTaggart Scott: Overwrite any file of the web server
The web server was vulnerable to file overwrite due to a vulnerable module used to generate files. An attacker could have overwritten any file on the web server, including critical system files, by sending a specially crafted request...
CVE-2024-45769 Pcp: pmcd heap corruption through metric pmstore operations
A vulnerability was found in Performance Co-Pilot PCP. This flaw allows an attacker to send specially crafted data to the system, which could cause the program to misbehave or crash...
The vulnerability of Adobe Illustrator’s graphic editor, related to integer overflow, allows a hacker to execute arbitrary code.
The vulnerability of Adobe Illustrator’s graphic editor is related to a numerical overflow condition. Exploiting this vulnerability allows an attacker to execute arbitrary code in the context of the current user, using a specially created file...
CVE-2024-45815
A flaw was found in the backstage/plugin-catalog-backend package. A malicious actor with authenticated access to a Backstage instance with the catalog backend plugin installed is able to interrupt the service using a specially crafted query to the catalog API. Mitigation Mitigation for this issue...
CVE-2024-45815 Prototype pollution in @backstage/plugin-catalog-backend
Backstage is an open framework for building developer portals. A malicious actor with authenticated access to a Backstage instance with the catalog backend plugin installed is able to interrupt the service using a specially crafted query to the catalog API. This has been fixed in the 1.26.0 relea...
CVE-2024-38813 Privilege escalation vulnerability
The vCenter Server contains a privilege escalation vulnerability. A malicious actor with network access to vCenter Server may trigger this vulnerability to escalate privileges to root by sending a specially crafted network packet...
SUSE SLES15 Security Update : 389-ds (SUSE-SU-2024:3257-1)
The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3257-1 advisory. - Update to version 1.4.4.20git3.e7ac6d87: - CVE-2024-3657: DOS via via specially crafted kerberos AS-REQ request. bsc1225512 -...
CVE-2024-45801
A flaw was found in DOMPurify. This issue may allow an attacker to use specially-crafted HTML to bypass the depth checking or use Prototype Pollution to weaken the depth check, which can lead to cross site scripting XSS attacks. Mitigation Mitigation for this issue is either not available or the...
CVE-2024-45104
A valid, authenticated LXCA user without sufficient privileges may be able to use the device identifier to modify an LXCA managed device through a specially crafted web API call...
CVE-2024-45383
A mishandling of IRP requests vulnerability exists in the HDAudBusDMA interface of Microsoft High Definition Audio Bus Driver 10.0.19041.3636 WinBuild.160101.0800. A specially crafted application can issue multiple IRP Complete requests which leads to a local denial-of-service. An attacker can...
CVE-2024-45383
A mishandling of IRP requests vulnerability exists in the HDAudBusDMA interface of Microsoft High Definition Audio Bus Driver 10.0.19041.3636 WinBuild.160101.0800. A specially crafted application can issue multiple IRP Complete requests which leads to a local denial-of-service. An attacker can...