PT-2024-24915 · Dell · Dell Client Platform Bios

Name of the Vulnerable Software and Affected Versions: Dell Client Platform BIOS affected versions not specified Description: The issue is related to an Improper Input Validation vulnerability in an externally developed component. A high privileged attacker with local access could potentially...

PT-2024-6020 · Dell +1 · Dell Poweredge +1

Name of the Vulnerable Software and Affected Versions: Dell PowerEdge Platform, 14G Intel BIOS versions prior to 2.22.x Description: The issue is related to insufficient input validation in the BIOS software of Dell PowerEdge servers. This could allow an attacker with high privileges and local...

The vulnerability of the TPM2_GENERATED_VALUE() function in the TCG TPM2 TPM2 Software Stack, related to incorrect input validation, allows attackers to generate arbitrary price data that cannot be detected by Fapi_VerifyQuote.

The vulnerability of the TPM2GENERATEDVALUE function in the TCG TPM2 TPM2 Software Stack lies in the lack of checks to ensure that the magical number in the TPM2GENERATEDVALUE certificate is valid. Exploiting this vulnerability allows an attacker to generate arbitrary quote data that cannot be...

PT-2024-37097 · Logsign · Logsign Unified Secops Platform

Name of the Vulnerable Software and Affected Versions: Logsign Unified SecOps Platform affected versions not specified Description: This issue allows remote attackers to execute arbitrary code on affected installations. Although authentication is required to exploit this issue, the existing...

WordPress plugin Quotes for WooCommerce security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

Luxion KeyShot Viewer X_T File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Luxion KeyShot Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing ...

GHSA-3XR8-QFVJ-9P9J Arbitrary file deletion in litellm

BerriAI's litellm, in its latest version, is vulnerable to arbitrary file deletion due to improper input validation on the /audio/transcriptions endpoint. An attacker can exploit this vulnerability by sending a specially crafted request that includes a file path to the server, which then deletes...

CVE-2024-5267

Sonos Era 100 SMB2 Message Handling Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Sonos Era 100 smart speakers. Authentication is not required to exploit this vulnerability. The...

CVE-2024-20405

A vulnerability in the web-based management interface of Cisco Finesse could allow an unauthenticated, remote attacker to conduct a stored XSS attack by exploiting an RFI vulnerability. This vulnerability is due to insufficient validation of user-supplied input for specific HTTP requests that are...

CVE-2024-4084

A Server-Side Request Forgery SSRF vulnerability exists in the latest version of mintplex-labs/anything-llm, allowing attackers to bypass the official fix intended to restrict access to intranet IP addresses and protocols. Despite efforts to filter out intranet IP addresses starting with 192, 172...

CVE-2024-20881

Improper input validation vulnerability in chnactiv TA prior to SMR Jun-2024 Release 1 allows local privileged attackers lead to potential arbitrary code execution...

CVE-2024-4274

The Essential Real Estate plugin for WordPress is vulnerable to unauthorized loss of data due to insufficient validation on the removepropertyattachmentajax function in all versions up to, and including, 4.4.2. This makes it possible for authenticated attackers, with subscriber-level access and...

The vulnerability of the DNS resolver, knot resolver, arises due to insufficient validation of input data. This allows attackers to convert a domain protected by DNSSEC into a domain that is not protected by DNSSEC.

The vulnerability of the DNS resolver, Knot Resolver, exists due to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to trigger a Denial-of-Service attack by using multiple TCP connections...

CVE-2024-35140

IBM Security Verify Access Docker 10.0.0 through 10.0.6 could allow a local user to escalate their privileges due to improper certificate validation. IBM X-Force ID: 292416...

PT-2024-35503 · Kofax · Kofax Power Pdf

Name of the Vulnerable Software and Affected Versions: Kofax Power PDF affected versions not specified Description: This issue allows remote attackers to execute arbitrary code on affected installations of Kofax Power PDF. User interaction is required to exploit this issue, where the target must...

PT-2024-35504 · Kofax · Kofax Power Pdf

Name of the Vulnerable Software and Affected Versions: Kofax Power PDF affected versions not specified Description: This issue allows remote attackers to execute arbitrary code on affected installations. User interaction is required, where the target must visit a malicious page or open a maliciou...

The vulnerability of the tipc_udp_nl_dump_remoteip() function in the implementation of the TIPC protocol allows a attacker to gain access to protected data or cause a service failure.

The vulnerability of the tipcudpnldumpremoteip function in the net/tipc/udpmedia.c module of the TIPC Transparent Inter-Process Communication protocol implementation in the Linux operating system is related to incorrect validation of the received data. Exploiting this vulnerability may allow an...

The vulnerability of Firefox browser for iOS, related to insufficient validation of input data, allows attackers to bypass security restrictions and load arbitrary pages.

The vulnerability of Firefox browser for iOS is related to insufficient validation of input data when URLs are copied into the address bar. Exploiting this vulnerability allows a malicious actor to bypass security restrictions and load arbitrary pages...

PT-2024-23327 · A10 · A10 Thunder Adc

Name of the Vulnerable Software and Affected Versions: A10 Thunder ADC affected versions not specified Description: This issue allows remote attackers to execute arbitrary code on affected installations of A10 Thunder ADC. Authentication is required to exploit this issue. The specific flaw exists...

Vulnerability of the Server component: The DML of the Oracle MySQL Server database management system, which allows a hacker to cause a service failure.

The vulnerability of the Oracle MySQL Server component relates to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause service interruptions...