148 matches found
Local File Inclusion (LFI)
moodle/moodle is vulnerable to Local File Inclusion LFI. The vulnerability is due to inadequate input validation when restoring block backups, which allows an attacker to manipulate the process and potentially include local files, which can lead to exploitation of the system...
Unspecified Vulnerability in Cisco TelePresence Collaboration Endpoint and Cisco RoomOS
Cisco RoomOS Software and Cisco TelePresence Collaboration Endpoint Software are both products of the U.S. company Cisco Cisco.Cisco RoomOS Software is a set of automatic management software for Cisco devices. The software is mainly used for upgrading and managing the motherboard firmware of Cisc...
Google Android elevation of privilege vulnerability (CNVD-2024-45225)
Google Android is a Linux-based open source operating system from Google. Google Android suffers from an elevation of privilege vulnerability caused by a lack of privilege checking in CreateofSettingsHomepageActivity.java, which can be exploited by an attacker to gain elevated privileges on the...
CVE-2024-41959
mailcow: dockerized is an open source groupware/email suite based on docker. An unauthenticated attacker can inject a JavaScript payload into the API logs. This payload is executed whenever the API logs page is viewed, potentially allowing an attacker to run malicious scripts in the context of th...
Google Chrome Code Execution Vulnerability (CNVD-2024-34498)
Google Chrome is a web browser from Google, an American company. Google Chrome suffers from a code execution vulnerability that originates from memory reuse after release in Tabs, which can be exploited by an attacker to execute arbitrary code on the system...
Google Chrome Code Execution Vulnerability (CNVD-2024-36093)
Google Chrome is a web browser from Google, an American company. A code execution vulnerability exists in Google Chrome, which can be exploited by an attacker to execute arbitrary code on a system...
Google Chrome memory misreference vulnerability (CNVD-2024-38802)
Google Chrome is a web browser from Google, an American company. Google Chrome suffers from a memory misreference vulnerability that can be exploited by an attacker to execute arbitrary code on the system...
CVE-2024-4322
A path traversal vulnerability exists in the parisneo/lollms-webui application, specifically within the /listpersonalities endpoint. By manipulating the category parameter, an attacker can traverse the directory structure and list any directory on the system. This issue affects the latest version...
Fortinet Releases Security Updates for Multiple Products
Fortinet released security updates to address vulnerabilities in multiple products, including OS and FortiProxy. A cyber threat actor could exploit some of these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review the following advisories and...
Wyrestorm Apollo VX20 < 1.3.58 - Incorrect Access Control 'Credentials Disclosure'
Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/WYRESTORMAPOLLOVX20INCORRECTACCESSCONTROLCREDENTIALSDISCLOSURECVE-2024-25735.txt + twitter.com/hyp3rlinx + ISR: ApparitionSec Vendor www.wyrestorm.com Product APOLLO VX20...
Moby and Open Container Initiative Release Critical Updates for Multiple Vulnerabilities Affecting Docker-related Components
Moby and the Open Container Initiative OCI have released updates for multiple vulnerabilities CVE-2024-23651, CVE-2024-23652, CVE-2024-23653, CVE-2024-21626 affecting Docker-related components, including Moby BuildKit and OCI runc. A cyber threat actor could exploit these vulnerabilities to take...
GTKWave OS Command Injection Vulnerability (CNVD-2024-39664)
GTKWave is a full-featured, GTK+-based waveform viewer from GTKWave. GTKWave version 3.3.115 suffers from an operating system command injection vulnerability that can be exploited by an attacker to cause arbitrary code execution via a specially crafted fst file...
CVE-2023-46805 (Authentication Bypass) & CVE-2024-21887 (Command Injection) for Ivanti Connect Secure and Ivanti Policy Secure Gateways
DESCRIPTION: Vulnerabilities have been discovered in Ivanti Connect Secure ICS, formerly known as Pulse Connect Secure and Ivanti Policy Secure gateways. These vulnerabilities impact all supported versions – Version 9.x and 22.x refer to Granular Software Release EOL Timelines and Support Matrix...
Google Android Code Execution Vulnerability (CNVD-2023-96686)
Google Android is a Linux-based open source operating system from Google. A code execution vulnerability exists in Google Android, which can be exploited by an attacker to execute arbitrary code on the system...
Oracle Releases October 2023 Critical Patch Update Advisory
Oracle has released its Critical Patch Update Advisory for October 2023 to address 387 vulnerabilities across multiple products. A cyber threat actor could exploit some of these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review the Oracle...
Apple Releases Security Updates for iOS and iPadOS
Apple has released security updates to address vulnerabilities in iOS and iPadOS. A cyber threat actor could exploit these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review the following advisory and apply the necessary updates: iOS 17.0.3 a...
Cisco Releases Security Advisories for Multiple Products
Cisco has released security advisories for vulnerabilities affecting multiple Cisco products. A remote cyber threat actor could exploit some of these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review the following advisories and apply the...
The Exploitation of Critical Zero-Day Vulnerability Found in MOVEit Transfer
Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary The MOVEit Transfer vulnerability is that it allows for unauthorized access to the database, potential manipulation or deletion of its contents, and exploitation of affected systems. To receive...
PT-2023-2625
Name of the Vulnerable Software and Affected Versions Windows affected versions not specified Description A security-feature bypass issue exists in the Secure Boot implementation of Windows operating systems. The problem is related to errors in accessing debugging functions during the boot proces...
