907 matches found
CVE-2024-11484
CVE-2024-11484 affects Code4Berry Decoration Management System 1.0. The vulnerability arises from manipulation of the parameter productimage1 in the file /decoration/admin/update_image.php (User Image Handler), leading to improper access controls. It is exploitable remotely and has publicly discl...
The vulnerability in the usb_device.cgi script of NETGEAR’s router microprogramming software allows a hacker to induce a service failure.
The vulnerability in the usbdevice.cgi script of NETGEAR’s R8500 and R7000P router microprogramming systems lies in a buffer overflow that occurs during the processing of the cifsuser, readaccess, and writeaccess parameters. Exploiting this vulnerability allows an attacker to trigger a...
CVE-2024-10526
The provided data confirms CVE-2024-10526 affects Rapid7 Velociraptor MSI Installer before version 0.73.3. The issue stems from the installer creating the installation directory with WRITE_DACL permissions for BUILTIN\Users, enabling non-admin local users to grant themselves Full Control on Veloc...
CVE-2024-34677
Exposure of sensitive information in System UI prior to SMR Nov-2024 Release 1 allow local attackers to make malicious apps appear as legitimate...
CVE-2024-42028
A Local privilege escalation vulnerability found in a Self-Hosted UniFi Network Server with UniFi Network Application Version 8.4.62 and earlier allows a malicious actor with a local operational system user to execute high privilege actions on UniFi Network Server...
CVE-2024-42028
A Local privilege escalation vulnerability found in a Self-Hosted UniFi Network Server with UniFi Network Application Version 8.4.62 and earlier allows a malicious actor with a local operational system user to execute high privilege actions on UniFi Network Server...
CVE-2024-42028
A Local privilege escalation vulnerability found in a Self-Hosted UniFi Network Server with UniFi Network Application Version 8.4.62 and earlier allows a malicious actor with a local operational system user to execute high privilege actions on UniFi Network Server...
CVE-2022-23862
A Local Privilege Escalation issue was discovered in Y Soft SAFEQ 6 Build 53. The SafeQ JMX service running on port 9696 is vulnerable to JMX MLet attacks. Because the service did not enforce authentication and was running under the "NT Authority\System" user, an attacker is able to use the...
CVE-2022-23862
CVE-2022-23862 affects Y Soft SAFEQ 6 Build 53. The SafeQ JMX service on port 9696 is vulnerable to JMX MLet attacks because authentication was not enforced and the service ran under NT AUTHORITY\System, enabling an attacker to execute arbitrary code and escalate to SYSTEM locally. Public PoC and...
CVE-2022-23862
A Local Privilege Escalation issue was discovered in Y Soft SAFEQ 6 Build 53. The SafeQ JMX service running on port 9696 is vulnerable to JMX MLet attacks. Because the service did not enforce authentication and was running under the "NT Authority\System" user, an attacker is able to use the...
CVE-2022-23862
A Local Privilege Escalation issue was discovered in Y Soft SAFEQ 6 Build 53. The SafeQ JMX service running on port 9696 is vulnerable to JMX MLet attacks. Because the service did not enforce authentication and was running under the "NT Authority\System" user, an attacker is able to use the...
system-user-zabbix-6.0.33-1.1 on GA media (moderate)
system-user-zabbix-6.0.33-1.1 on GA media Announcement ID: openSUSE-SU-2024:14356-1 Rating: moderate Cross-References: CVE-2024-36461 CVSS scores: CVE-2024-36461 SUSE : 9.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H Affected Products: openSUSE Tumbleweed An update that solves one vulnerability...
OPENSUSE-SU-2024:14356-1 system-user-zabbix-6.0.33-1.1 on GA media
These are all security issues fixed in the system-user-zabbix-6.0.33-1.1 package on the GA media of openSUSE Tumbleweed...
Untrusted Query Object Evaluation in RPC API
During the sign in and sign up operations through the SurrealDB RPC API, an arbitrary object would be accepted in order to support a wide array of types and structures that could contain user credentials. This arbitrary object could potentially contain any SurrealDB value, including an object...
ContiNew Admin SQL注入漏洞
ContiNew Admin is ContiNew open source a continuous iterative optimization of the front-end and back-end separation of the middle and back-end management system framework. ContiNew Admin version 3.2.0 SQL injection vulnerability exists , the vulnerability stems from the file...
PT-2024-38837 · Unknown · Continew Admin
Name of the Vulnerable Software and Affected Versions: ContiNew Admin version 3.2.0 Description: A critical issue was found in ContiNew Admin, affecting the function top.continew.starter.extension.crud.controller.BaseControllerpage of the file /api/system/user?deptId=1&page=1&size=10. The...
Apache StreamPark: Unchecked maven build params could trigger remote command execution
In streampark, the project module integrates Maven's compilation capabilities. The input parameter validation is not strict, allowing attackers to insert commands for remote command execution, The prerequisite for a successful attack is that the user needs to log in to the streampark system and...
openSUSE Security Advisory (SUSE-SU-2024:2260-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...