PT-2024-6974 · Microsoft · Windows Secure Kernel Mode +1

Name of the Vulnerable Software and Affected Versions: Windows Secure Kernel Mode affected versions not specified Description: The issue is related to a buffer overflow in memory, which can be exploited to elevate privileges. This can allow an attacker to affect the system. Recommendations: At th...

Camaleon CMS vulnerable to remote code execution through code injection (GHSL-2024-185)

The actions defined inside of the MediaController class do not check whether a given path is inside a certain path e.g. inside the media folder. If an attacker performed an account takeover of an administrator account See: GHSL-2024-184 they could delete arbitrary files or folders on the server...

PT-2024-4966 · Microsoft · Windows Imaging +1

Name of the Vulnerable Software and Affected Versions: Windows Imaging Component affected versions not specified Description: This vulnerability allows remote attackers to execute arbitrary code and affect the system. The issue is a buffer overflow in dynamically allocated memory within the Windo...

cosign: Malicious attachments can cause system-wide denial of service

A flaw was found in the Cosign package where a malicious attachment may trigger uncontrolled resource consumption by allocating too much memory. This flaw allows an attacker to craft a malicious attachment, resulting in a denial of service, possibly impacting other applications running on the sam...

CVE-2023-5938

Multiple functions use archives without properly validating the filenames therein, rendering the application vulnerable to path traversal via 'zip slip' attacks. An administrator able to provide tampered archives to be processed by the affected versions of Arc may be able to have arbitrary files...

CVE-2024-31474

There is an arbitrary file deletion vulnerability in the CLI service accessed by PAPI Aruba's Access Point management protocol. Successful exploitation of this vulnerability results in the ability to delete arbitrary files on the underlying operating system, which could lead to the ability to...

PT-2024-3585 · Microsoft · Windows Routing/Remote Access Service +1

Name of the Vulnerable Software and Affected Versions: Windows Routing and Remote Access Service RRAS affected versions not specified Description: The issue is related to errors of numerical truncation in the Windows RRAS service, allowing remote attackers to execute arbitrary code and affect the...

PT-2024-2245 · Microsoft · Windows Kernel +1

Name of the Vulnerable Software and Affected Versions: Windows Kernel affected versions not specified Description: The issue is related to insufficient protection of internal data in the Windows operating system kernel. It allows attackers to obtain sensitive information and potentially affect th...

Path traversal

Deno is a JavaScript, TypeScript, and WebAssembly runtime with secure defaults. Insufficient validation of parameters in Deno.makeTemp APIs would allow for creation of files outside of the allowed directories. This may allow the user to overwrite important files on the system that may affect othe...

PT-2024-1956 · Microsoft · Windows Printing Service +1

Name of the Vulnerable Software and Affected Versions: Windows Printing Service affected versions not specified Description: The issue is related to errors in the representation of information by the user interface of the Windows printing service. Exploitation of this issue may allow a remote...

PT-2024-1726 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue is related to errors in security settings, allowing an attacker to bypass security restrictions. This can potentially enable an attacker to affect the system. Recommendations: At...

CVE-2024-20961

...

CVE-2024-21735 Improper Authorization check in SAP LT Replication Server

SAP LT Replication Server - version S4CORE 103, S4CORE 104, S4CORE 105, S4CORE 106, S4CORE 107, S4CORE 108, does not perform necessary authorization checks. This could allow an attacker with high privileges to perform unintended actions, resulting in escalation of privileges, which has High impac...

CVE-2023-45619

There is an arbitrary file deletion vulnerability in the RSSI service accessed by PAPI Aruba's access point management protocol. Successful exploitation of this vulnerability results in the ability to delete arbitrary files on the underlying operating system, which could lead to the ability to...

PT-2023-6059 · Microsoft · Windows Power Management Service +1

Name of the Vulnerable Software and Affected Versions: Windows Power Management Service affected versions not specified Description: The issue is related to a lack of protection for service data in the Windows Power Management Service, which can be exploited to disclose protected information. Thi...

PT-2023-6043 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue is related to insufficient access control in the Windows operating system kernel, allowing an attacker to potentially elevate their privileges. This could affect the system, but...

PT-2023-4374 · Microsoft · Windows Kernel +1

Name of the Vulnerable Software and Affected Versions: Windows Kernel affected versions not specified Description: The issue is related to insufficient access control in the Windows operating system kernel, which can be exploited to elevate privileges. This allows an attacker to affect the system...

PT-2023-5570 · Microsoft · Windows Kernel +1

Name of the Vulnerable Software and Affected Versions: Windows Kernel affected versions not specified Description: The issue is related to insufficient access control in the Windows operating system kernel, which can be exploited to elevate privileges. This allows an attacker to affect the system...

PT-2023-3844 · Microsoft · Windows Failover Cluster +1

Name of the Vulnerable Software and Affected Versions: Windows Failover Cluster affected versions not specified Description: The issue is related to information disclosure in the Failover Cluster component of Windows operating systems. It allows a remote attacker to gain unauthorized access to...

KLA50475 OSI vulnerability in Apache Tomcat

An information disclosure vulnerability was found in Apache Tomcat. Malicious users can exploit this vulnerability to obtain sensitive information. Original advisories Fixed in Apache Tomcat 9.0.75 Related products Apache-Tomcat CVE list CVE-2023-34981 critical Solution Update to the latest versi...