PT-2024-8140

Name of the Vulnerable Software and Affected Versions: PostgreSQL versions prior to 17.1 PostgreSQL versions prior to 16.5 PostgreSQL versions prior to 15.9 PostgreSQL versions prior to 14.14 PostgreSQL versions prior to 13.17 PostgreSQL versions prior to 12.21 Description: The issue arises from...

The vulnerability of Adobe After Effects’ video and dynamic image editing software arises from operations that go beyond buffer boundaries in memory, allowing attackers to gain unauthorized access to protected information.

The vulnerability of Adobe After Effects video and dynamic image editing software relates to the execution of operations beyond buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information through a specially created file...

The vulnerability in the CORS mechanism of Mozilla Firefox, Firefox ESR, and the Thunderbird email client allows a hacker to bypass security restrictions, gain unauthorized access to protected information, and execute arbitrary code.

The vulnerability of the CORS mechanism in Mozilla Firefox, Firefox ESR, and the Thunderbird email client is related to the lack of measures taken to protect the structure of web pages during the processing of the resource://devtools path. Exploiting this vulnerability allows an attacker to bypas...

SQL Injection

Funadmin is vulnerable to SQL injection. The vulnerability is due to improper input validation in curd/table/savefield, allowing malicious SQL code to be executed. Attackers can exploit this vulnerability to manipulate database queries, potentially gaining unauthorized access to or tampering with...

WordPress plugin EleForms 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

The vulnerability of NVIDIA BlueField data processing processor microprogramming software, related to access control deficiencies, allows a intruder to gain unauthorized access to read and modify data, or to cause service failures.

The vulnerability of NVIDIA BlueField data processing processor microprogramming software is related to deficiencies in access control. Exploiting this vulnerability could allow an intruder to gain unauthorized access to read and modify data, or cause service failures...

Medium: java-11-amazon-corretto

Issue Overview: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Networking. Supported versions that are affected are Oracle Java SE: 8u421, 8u421-perf, 11.0.24, 17.0.12, 21.0.4, 23; Oracle GraalVM for JDK: 17.0.12...

The vulnerability of the Platypus.js tooling platform, related to incorrect path name restrictions for restricted access catalogs, allows attackers to gain access to confidential data.

The vulnerability of the Platypus.js tooling platform is related to an incorrect restriction on the path name to the restricted-access catalog. Allowing this to be exploited could enable a malicious actor to gain access to confidential data...

The vulnerability of the InnoDB component in the Oracle MySQL Server database management system allows a hacker to gain unauthorized access for reading, creating, modifying, and deleting data, or to cause service failures.

The vulnerability of the InnoDB component in the Oracle MySQL Server database management system is related to deficiencies in the authentication process. Exploiting this vulnerability can allow an attacker to gain unauthorized access for reading, creating, modifying, and deleting data, or to caus...

Security update for java-11-openjdk

This update for java-11-openjdk fixes the following issues: Updated to version 11.0.25+9 October 2024 CPU: CVE-2024-21208: Fixed partial DoS in component Networking bsc1231702 CVE-2024-21210: Fixed unauthorized read/write access to data in component Hotspot bsc1231711 CVE-2024-21217: Fixed partia...

Researchers Uncover Vulnerabilities in Open-Source AI and ML Models

A little over three dozen security vulnerabilities have been disclosed in various open-source artificial intelligence AI and machine learning ML models, some of which could lead to remote code execution and information theft. The flaws, identified in tools like ChuanhuChatGPT, Lunary, and LocalAI...

CVE-2024-8143: Data Access Operations Outside of Expected Data Manager Component

In the latest version 20240628 of gaizhenbiao/chuanhuchatgpt, an issue exists in the /file endpoint that allows authenticated users to access the chat history of other users. When a user logs in, a directory is created in the history folder with the user's name. By manipulating the /file endpoint...

Scoold 安全漏洞

Scoold is an open source team quiz and knowledge sharing platform by Erudika. Scoold suffers from a security vulnerability that stems from a semicolon path injection vulnerability found in the /api;/config endpoint, where by appending a semicolon to a URL, an attacker can bypass authentication an...

Cisco Secure Firewall Management Center SQL Injection Vulnerability

Cisco Secure Firewall Management Center FMC is a comprehensive, centralized management platform for Cisco's network security solutions. It provides unified management of firewalls, application control, intrusion prevention, URL filtering, and advanced malware protection. An SQL injection...

PT-2024-33137 · Neye3C · Neye3C

Name of the Vulnerable Software and Affected Versions: Neye3C version 4.5.2.0 Description: The issue concerns incorrect access control in the firmware update and download processes, allowing attackers to access sensitive information by analyzing the code and data within the APK file...

CVE-2024-20473: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center FMC Software could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. This vulnerability exists because the web-based management interface does not validat...

The vulnerability of the Imagine Cup platform’s code execution mechanism for Microsoft Azure Functions allows a hacker to gain unauthorized access to protected information.

The vulnerability of the Imagine Cup platform’s Microsoft Azure Functions component is related to lack of access control. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...

The vulnerability of the qcom component in the Linux operating system’s kernel allows a hacker to gain unauthorized access to confidential information.

The vulnerability of the qcom component in the Linux operating system’s kernel is related to improper control of resource identifiers. Exploiting this vulnerability can allow an attacker to gain unauthorized access to confidential information within the system...

CVE-2024-20472: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center FMC Software could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. This vulnerability exists because the web-based management interface does not validat...

CVE-2024-47912

A vulnerability in the AWV Audio, Web, and Video Conferencing component of Mitel MiCollab through 9.8 SP1 FP2 9.8.1.201 could allow an unauthenticated attacker to perform unauthorized data-access attacks due to missing authentication mechanisms. A successful exploit could allow an attacker to...