CVE-2024-56614 xsk: fix OOB map writes when deleting elements

In the Linux kernel, the following vulnerability has been resolved: xsk: fix OOB map writes when deleting elements Jordy says: " In the xskmapdeleteelem function an unsigned integer map-maxentries is compared with a user-controlled signed integer k. Due to implicit type conversion, a large unsign...

Fortinet FortiManager/FortiAnalyzer Authentication Bypass

The vulnerability of the software for centralized device management by Fortinet’s FortiManager and the network firewall FortiAnalyzer lies in the ability to bypass authentication by using a user-controlled key. Exploiting this vulnerability allows an attacker to gain unauthorized access to...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the id parameter in Oqtane.Controllers.UserController. Remediation Upgrade Oqtane.Server to version 6.0.1 or higher. References - GitHub Commit - GitHub PR - Medium Blog Credit: Rudra...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the id parameter in Oqtane.Controllers.UserController. Remediation Upgrade Oqtane.Framework to version 6.0.1 or higher. References - GitHub Commit - GitHub PR - Medium Blog Credit:...

LLM Evaluations Data Compromise

The vulnerability of the “Evaluations” function in the platform for monitoring, managing, and improving LLM applications involves bypassing authentication by using a user-controlled key. Exploiting this vulnerability allows an attacker to remotely influence the integrity of protected information ...

LLM Platform Authentication Bypass

The vulnerability of the platform for monitoring, managing, and improving LLM applications involves bypassing authentication by using a user-controlled key. Exploiting this vulnerability allows an attacker to influence the integrity and confidentiality of protected information by manipulating the...

asyncssh SSH Man-in-the-Middle

The vulnerability of the client-side and server-side implementations of the SSHv2 asyncssh protocol in Python lies in the ability to bypass authentication using a user-controlled key. Exploiting this vulnerability allows an attacker to perform “man-in-the-middle” attacks remotely...

CVE-2024-4464

Authorization bypass through user-controlled key vulnerability in streaming service in Synology Media Server before 1.4-2680, 2.0.5-3152 and 2.2.0-3325 allows remote attackers to read specific files via unspecified vectors...

CVE-2024-4464

Authorization bypass through user-controlled key vulnerability in streaming service in Synology Media Server before 1.4-2680, 2.0.5-3152 and 2.2.0-3325 allows remote attackers to read specific files via unspecified vectors...

CVE-2024-9819

Authorization Bypass Through User-Controlled Key vulnerability in NextGeography NG Analyser allows Functionality Misuse. This issue affects NG Analyser: before 2.2.711...

CVE-2024-8475

Authentication Bypass by Assumed-Immutable Data vulnerability in Digital Operation Services WiFiBurada allows Manipulating User-Controlled Variables. This issue affects WiFiBurada: before 1.0.5...

CVE-2024-8475

Authentication Bypass by Assumed-Immutable Data vulnerability in Digital Operation Services WiFiBurada allows Manipulating User-Controlled Variables. This issue affects WiFiBurada: before 1.0.5...

CVE-2024-8475

CVE-2024-8475 affects Digital Operation Services’ WiFiBurada prior to version 1.0.5. The issue is described as an Authentication Bypass by Assumed-Immutable Data, enabling manipulation of user‑controlled variables. Documented impact is limited to authentication bypass with no explicit exploitatio...

PT-2024-39864 · Nextgeography · Nextgeography Ng Analyser

Name of the Vulnerable Software and Affected Versions: NextGeography NG Analyser versions prior to 2.2.711 Description: The issue allows for unauthorized access through a user-controlled key, enabling misuse of functionality. Recommendations: For versions prior to 2.2.711, update to version 2.2.7...

CVE-2024-8475: Authentication Bypass by Assumed-Immutable Data

Authentication Bypass by Assumed-Immutable Data vulnerability in Digital Operation Services WiFiBurada allows Manipulating User-Controlled Variables. This issue affects WiFiBurada: before 1.0.5...

ComfyUI-Manager 安全漏洞

ComfyUI-Manager is an extension from the individual developer of Dr. Lt. Data designed to enhance the usability of ComfyUI. A security vulnerability exists in ComfyUI-Manager that stems from a lack of validation of the pip field, allowing an attacker to craft a request to trigger a pip installati...

Huawei EulerOS: Security Advisory for cups (EulerOS-SA-2024-2932)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

AbsysNet cgi-bin/ocap Component Brute Force

The vulnerability of the cgi-bin/ocap/ component of the AbsysNet library system is related to the ability to bypass authentication by using a user-controlled password. Exploiting this vulnerability could allow an attacker operating remotely to execute a brute-force attack...

CVE-2024-42422

Dell NetWorker, versions 19.10, contains an Authorization Bypass Through User-Controlled Key vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Information disclosure...

CVE-2023-2142 Nunjucks autoescape bypass leads to cross site scripting

In Nunjucks versions prior to version 3.2.4, it was possible to bypass the restrictions which are provided by the autoescape functionality. If there are two user-controlled parameters on the same line used in the views, it was possible to inject cross site scripting payloads using the backslash ...