CVE-2024-0402 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab

An issue has been discovered in GitLab CE/EE affecting all versions from 16.0 prior to 16.6.6, 16.7 prior to 16.7.4, and 16.8 prior to 16.8.1 which allows an authenticated user to write files to arbitrary locations on the GitLab server while creating a workspace...

PT-2024-15619 · Sourcecodester · Sourcecodester Best House Rental Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester House Rental Management System version 1.0 Description: A critical issue was found in the SourceCodester House Rental Management System, affecting some unknown functionality of the file manage user.php of the component Edit Use...

CVE-2023-48246

The vulnerability allows a remote attacker to download arbitrary files in all paths of the system under the context of the application OS user “root” via a crafted HTTP request...

PYSEC-2023-265

Apache Airflow, in versions prior to 2.8.0, contains a security vulnerability that allows an authenticated user with limited access to some DAGs, to craft a request that could give the user write access to various DAG resources for DAGs that the user had no access to, thus, enabling the user to...

CVE-2023-44289

Dell Command | Configure versions prior to 4.11.0, contain an improper access control vulnerability. A local malicious standard user could potentially exploit this vulnerability while repairing/changing installation, leading to privilege escalation...

SUSE CVE-2015-3151

Directory traversal vulnerability in abrt-dbus in Automatic Bug Reporting Tool ABRT allows local users to read, write to, or change ownership of arbitrary files via unspecified vectors to the 1 NewProblem, 2 GetInfo, 3 SetElement, or 4 DeleteElement method...

CVE-2023-45384

KnowBand supercheckout 5.0.7 and 6.0.7 is vulnerable to Unrestricted Upload of File with Dangerous Type. In the module "Module One Page Checkout, Social Login & Mailchimp" supercheckout, a guest can upload files with extensions .php...

Best Courier Management System Code Issue Vulnerability

Best Courier Management System is a courier management system by Mayuri K., a personal developer. A security vulnerability exists in Best Courier Management System version 1.0, which was discovered to contain an arbitrary file upload vulnerability via the updateuser function...

CVE-2023-4163 Possible buffer overflow in portcfgfportbuffers in Brocade Fabric OS

In Brocade Fabric OS before v9.2.0a, a local authenticated privileged user can trigger a buffer overflow condition, leading to a kernel panic with large input to buffers in the portcfgfportbuffers command...

SUSE-SU-2023:3365-1 Security update for krb5

This update for krb5 fixes the following issues: - CVE-2023-36054: Fixed a DoS that could be triggered by an authenticated remote user. bsc1214054...

CVE-2023-21185

In multiple functions of WifiNetworkFactory.java, there is a missing permission check. This could lead to local escalation of privilege from the guest user with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android I...

CVE-2023-3358

A null pointer dereference was found in the Linux kernel's Integrated Sensor Hub ISH driver. This issue could allow a local user to crash the system...

PT-2023-20371 · Dell · Dell Bios

Name of the Vulnerable Software and Affected Versions: Dell BIOS affected versions not specified Description: The issue is related to improper input validation in Dell BIOS, allowing a local authenticated malicious user with administrator privileges to potentially modify a UEFI variable...

CVE-2022-41736 IBM Spectrum Scale Container Native Storage Access privilege escalation

IBM Spectrum Scale Container Native Storage Access 5.1.2.1 through 5.1.6.0 contains an unspecified vulnerability that could allow a local user to obtain root privileges. IBM X-Force ID: 237810...

CVE-2023-28528 IBM AIX command execution

IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout command to execute arbitrary commands. IBM X-Force ID: 251207...

PT-2023-20123 · Nvidia +1 · Nvidia Cuda Toolkit +1

Name of the Vulnerable Software and Affected Versions: NVIDIA CUDA Toolkit SDK affected versions not specified Description: The issue is a NULL pointer dereference in cuobjdump. A local user running the tool against a malformed binary may cause a limited denial of service. Recommendations: At the...

CVE-2023-1670

A flaw use after free in the Linux kernel Xircom 16-bit PCMCIA PC-card Ethernet driver was found.A local user could use this flaw to crash the system or potentially escalate their privileges on the system...

CVE-2023-1670

A flaw use after free in the Linux kernel Xircom 16-bit PCMCIA PC-card Ethernet driver was found.A local user could use this flaw to crash the system or potentially escalate their privileges on the system...

CVE-2023-27270 Denial of Service (DoS) in SAP NetWeaver AS for ABAP and ABAP Platform

SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, has multiple vulnerabilities in a class for test purposes in which an attacker authenticated as a non-administrative user can craft a request with certain...

PT-2023-16660 · Trellix · Trellix Intelligent Sandbox Cli

Name of the Vulnerable Software and Affected Versions: Trellix Intelligent Sandbox CLI versions 5.2 and earlier Description: A command injection issue allows a local user to inject and execute arbitrary operating system commands using specially crafted strings. This is due to insufficient...