Amazon Linux 2022 : golang, golang-bin, golang-misc (ALAS2022-2021-007)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2021-007 advisory. A validation flaw was found in golang. When invoking functions from WASM modules built using GOARCH=wasm GOOS=js, passing very large arguments can cause portions of the module to be overwritten...

CVE-2024-55544 Authenticated Command Injection

Missing input validation in the ORing IAP-420 web-interface allows authenticated Command Injections on OS level.This issue affects IAP-420 version 2.01e and below...

The vulnerability of the instance_create() method in the program for monitoring and adaptive configuration of system devices allows attackers to perform spoofing attacks.

The vulnerability of the instancecreate method in the program for monitoring and adaptive configuration of system devices related to insufficient validation of input data when processing the instancename parameter. Exploiting this vulnerability allows attackers to perform spoofing attacks...

CVE-2024-12353

A vulnerability, which was classified as problematic, has been found in SourceCodester Phone Contact Manager System 1.0. This issue affects the function UserInterface::MenuDisplayStart of the component User Menu. The manipulation of the argument name leads to improper input validation. Attacking...

Tenable Security Center 安全漏洞

Tenable Security Center is a security center from Tenable USA. Tenable Security Center has a security vulnerability that originates from incorrect certificate validation. An authenticated, privileged attacker could use this vulnerability to intercept email sent from Security Center via a maliciou...

OpenBSD 安全漏洞

OpenBSD is a cross-platform, BSD-based UNIX-like operating system from the Canadian OpenBSD organization. A security vulnerability exists in OpenBSD versions prior to OpenBSD 7.5 errata 009 and OpenBSD versions prior to OpenBSD 7.4 errata 022, which stems from improper validation of the readdir...

MOXA VPort 07-3 Series 安全漏洞

MOXA VPort 07-3 Series is a series of network cameras from China-based MOXA. A security vulnerability exists in MOXA VPort 07-3 Series version 1.0, which stems from insufficient input validation and could lead to a denial of service condition or cause a service crash...

SUSE-SU-2024:4153-1 Security update for python310

This update for python310 fixes the following issues: - CVE-2024-11168: improper validation of IPv6 and IPvFuture addresses. bsc1233307 Bug fixes: - Remove -IVendor/ from python-config. bsc1231795 - Include renaming :noindex: option to :no-index: in Sphinx 7.2. bsc1232750...

NachoVPN Tool Exploits Flaws in Popular VPN Clients for System Compromise

Cybersecurity researchers have disclosed a set of flaws impacting Palo Alto Networks and SonicWall virtual private network VPN clients that could be potentially exploited to gain remote code execution on Windows and macOS systems. "By targeting the implicit trust VPN clients place in servers,...

SAMSUNG mobile 安全漏洞

SAMSUNG mobile is a cell phone from the South Korean company Samsung SAMSUNG. A security vulnerability exists in SAMSUNG mobile prior to SMR-Dec-2024 Release 1, which stems from improper input validation and allows a local attacker to broadcast a signal to discover Bluetooth on a Galaxy Watch...

PT-2024-9306 · Sap · Sap Netweaver Administrator

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver Administrator affected versions not specified Description: The issue allows an authenticated attacker to enumerate accessible HTTP endpoints in the internal network by specially crafting HTTP requests, potentially resulting in...

OpenSolution Quick CMS 安全漏洞

OpenSolution Quick CMS is a free content management system from the OpenSolution organization. A security vulnerability exists in OpenSolution Quick CMS version 6.7 that stems from improper validation of user-supplied input, absolute path traversal, and allows an attacker to delete files stored o...

CVE-2024-11802

The CVE-2024-11802 issue affects Fuji Electric Tellus Lite V-Simulator 5 V8, where the V-Simulator 5 V8 file parsing handles V8 files without proper length validation, causing a stack-based buffer overflow. This enables arbitrary code execution in the affected process and requires user interactio...

PT-2024-10212 · Ixsystems · Truenas Core

Name of the Vulnerable Software and Affected Versions: iXsystems TrueNAS CORE versions prior to 13.0-U6.3 Description: The issue is related to the tarfile.extractall method, which lacks proper validation of a user-supplied path prior to using it in file operations. This allows network-adjacent...

AZL-53540 CVE-2024-8676 affecting package cri-o 1.30.1-1

A vulnerability was found in CRI-O, where it can be requested to take a checkpoint archive of a container and later be asked to restore it. When it does that restoration, it attempts to restore the mounts from the restore archive instead of the pod request. As a result, the validations run on the...

PT-2024-16713 · WordPress · Apppresser

Name of the Vulnerable Software and Affected Versions: The AppPresser – Mobile App Framework plugin for WordPress versions up to, and including, 4.4.6 Description: The issue is related to privilege escalation via account takeover. This occurs because the plugin does not properly validate a user's...

The vulnerability of software platforms for developing and managing Adobe Commerce and Magento Open Source online stores lies in insufficient validation of requests on the server side. This allows attackers to execute SSRF attacks.

The vulnerability of software platforms for developing and managing Adobe Commerce and Magento Open Source online stores is related to insufficient testing of requests on the server side. Exploiting this vulnerability allows a malicious actor to execute an SSRF attack remotely...

Deserialization of Untrusted Data in Hugging Face Transformers

Hugging Face Transformers MaskFormer Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hugging Face Transformers. User interaction is required to exploit this vulnerability...

CVE-2024-11546

IrfanView DXF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView. User interaction is required to exploit this vulnerability in that the target must visit a malicious pag...

CVE-2024-5579

Allegra renderFieldMatch Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Allegra. Authentication is required to exploit this vulnerability. The specific flaw exists within the...