PT-2024-21634

Name of the Vulnerable Software and Affected Versions ESPHome versions 2023.12.9 through 2024.2.0 Description A security misconfiguration in the edit configuration file API in the dashboard component of ESPHome allows authenticated remote attackers to read and write arbitrary files under the...

Dell SupportAssist for Business PCs Local Authentication Bypass Vulnerability

Dell SupportAssist for Business PCs is a client application for business computers from Dell USA. The program provides automated, proactive and predictive techniques for troubleshooting and more. A local authentication bypass vulnerability exists in Dell SupportAssist for Business PCs version...

PT-2024-11689 · Unknown · Livebox Collaboration Vdesk

Name of the Vulnerable Software and Affected Versions: LIVEBOX Collaboration vDesk versions through v031 Description: An issue was discovered allowing a URL Redirection to an Untrusted Site Open Redirect under the "/api/v1/notification/createnotification" endpoint. This enables an authenticated...

SUSE SLES12: postgresql13 / postgresql13-contrib / postgresql13-devel / etc (SUSE-SU-2024:0541-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:0541-1 advisory. Upgrade to 13.14: - CVE-2024-0985: Tighten security restrictions within REFRESH MATERIALIZED VIEW CONCURRENTLY bsc1219679. Tenable has...

PT-2024-21299 · Discourse · Discourse Calendar

Name of the Vulnerable Software and Affected Versions: Discourse Calendar affected versions not specified Description: The issue allows uninvited users to gain access to private events by crafting a request to update their attendance. This is related to the dynamic calendar feature in the first...

PT-2024-1926

Name of the Vulnerable Software and Affected Versions Rack versions 1.3.0 through 3.0.9 and 2.2.8.1. Description Rack is a modular Ruby web server interface. A denial of service DoS vulnerability exists due to improper handling of Range headers. Carefully crafted Range headers can cause the serve...

PT-2024-15671

Name of the Vulnerable Software and Affected Versions Microsoft Clarity plugin for WordPress versions up to, and including, 0.9.3 Description The issue is related to Cross-Site Request Forgery due to missing nonce validation on the edit clarity project id function. This allows unauthenticated...

PT-2024-20785 · Liferay · Liferay Dxp +1

Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.2.0 through 7.4.2 Liferay DXP 7.3 before service pack 3 Liferay DXP 7.2 before fix pack 15 Description: The Calendar module in the affected software does not escape user-supplied data in the default notification emai...

The vulnerability of Grub2 operating system loaders, related to incomplete cleanup of temporary or auxiliary resources, allows attackers to trigger a service failure.

The vulnerability of Grub2 operating system loaders is related to incomplete cleanup of temporary or auxiliary resources. Exploiting this vulnerability can allow an attacker to cause service failures...

CVE-2023-39249

Dell SupportAssist for Business PCs version 3.4.0 contains a local Authentication Bypass vulnerability that allows locally authenticated non-admin users to gain temporary privilege within the SupportAssist User Interface on their respective PC. The Run as Admin temporary privilege feature enables...

CVE-2023-39249

Dell SupportAssist for Business PCs version 3.4.0 contains a local Authentication Bypass vulnerability that allows locally authenticated non-admin users to gain temporary privilege within the SupportAssist User Interface on their respective PC. The Run as Admin temporary privilege feature enables...

Authentication flaw

Dell SupportAssist for Business PCs version 3.4.0 contains a local Authentication Bypass vulnerability that allows locally authenticated non-admin users to gain temporary privilege within the SupportAssist User Interface on their respective PC. The Run as Admin temporary privilege feature enables...

CVE-2023-39249

Dell SupportAssist for Business PCs version 3.4.0 contains a local Authentication Bypass vulnerability that allows locally authenticated non-admin users to gain temporary privilege within the SupportAssist User Interface on their respective PC. The Run as Admin temporary privilege feature enables...

CVE-2023-39249

Dell SupportAssist for Business PCs version 3.4.0 contains a local Authentication Bypass vulnerability that allows locally authenticated non-admin users to gain temporary privilege within the SupportAssist User Interface on their respective PC. The Run as Admin temporary privilege feature enables...

PT-2024-4736 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 9.2 through 16.11.5 GitLab CE/EE versions 17.0 through 17.0.3 GitLab CE/EE versions 17.1 through 17.1.1 Description: The issue concerns the processing logic for generating links in dependency files, which can lead to a...

PT-2024-12785 · Dell · Dell Supportassist

Name of the Vulnerable Software and Affected Versions: Dell SupportAssist for Business PCs version 3.4.0 Description: The issue allows locally authenticated non-admin users to gain temporary privilege within the SupportAssist User Interface on their respective PC. The Run as Admin temporary...

PT-2024-20834 · Unknown · Simple Admin Panel

Name of the Vulnerable Software and Affected Versions: Simple Admin Panel App version 1.0 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the orderID parameter at the "/adminView/viewEachOrder.php" API endpoint. Recommendations: For Simp...

Dell SupportAssist for Business PCs 安全漏洞

Dell SupportAssist for Business PCs is a client application for business computers from Dell USA. The program provides automated, proactive and predictive techniques for troubleshooting and more. A local authentication bypass vulnerability exists in Dell SupportAssist for Business PCs version...

GO-2024-2490 Path traversal in github.com/anchore/stereoscope

It is possible to craft an OCI tar archive that, when stereoscope attempts to unarchive the contents, will result in writing to paths outside of the unarchive temporary directory...

guava: insecure temporary directory creation

A flaw was found in Guava. The methodology for temporary directories and files can allow other local users or apps with accordant permissions to access the temp files, possibly leading to information exposure or tampering in the files created in the directory...