CVE-2024-21574

The issue stems from a missing validation of the pip field in a POST request sent to the /customnode/install endpoint used to install custom nodes which is added to the server by the extension. This allows an attacker to craft a request that triggers a pip install on a user controlled package or...

CVE-2024-47596

GStreamer is a library for constructing graphs of media-handling components. An OOB-read has been discovered in the qtdemuxparsesvq3stsddata function within qtdemux.c. In the FOURCCSMI case, seqhsize is read from the input file without proper validation. If seqhsize is greater than the remaining...

CVE-2024-10494

An out of bounds read due to improper input validation in HeapObjMapImpl.cpp in NI LabVIEW may disclose information or result in arbitrary code execution. Successful exploitation requires an attacker to provide a user with a specially crafted VI. This vulnerability affects LabVIEW 2024 Q3 and pri...

CVE-2024-55545 Reflected Cross-Site Scripting

Missing input validation in the ORing IAP-420 web-interface allows Cross-Site Scripting XSS.This issue affects IAP-420 version 2.01e and below...

CVE-2024-55545

CVE-2024-55545 affects ORing IAP-420 devices (web interface) with input validation failure leading to Reflected XSS in versions 2.01e and earlier. The root cause is missing input validation in the IAP-420 web UI, enabling cross-site scripting. Impact is client-side compromise through injected scr...

PT-2024-16481

Name of the Vulnerable Software and Affected Versions System Dashboard WordPress plugin versions prior to 2.8.15 Description The issue is related to the plugin not validating user input used in a path, which could allow high privilege users, such as admin, to perform path traversal attacks and re...

CVE-2024-12353

CVE-2024-12353 affects SourceCodester Phone Contact Manager System 1.0, specifically the User Menu component’s UserInterface::MenuDisplayStart function. The vulnerability arises from improper input validation caused by manipulating the name argument, enabling a local attack. Public exploit detail...

PT-2024-17470 · Tenable · Tenable Security Center

Name of the Vulnerable Software and Affected Versions: Tenable Security Center affected versions not specified Description: An Improper Certificate Validation issue exists, allowing an authenticated, privileged attacker to intercept email messages sent from Security Center via a rogue SMTP server...

CVE-2024-10771 SICK InspectorP61x, SICK InspectorP62x and SICK TiM3xx are vulnerable for remote code execution

Due to missing input validation during one step of the firmware update process, the product is vulnerable to remote code execution. With network access and the user level ”Service”, an attacker can execute arbitrary system commands in the root user’s contexts...

CVE-2024-12003

The WP System plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.1. This is due to missing or incorrect nonce validation on the generatewpsystempagecontent function. This makes it possible for unauthenticated attackers to inject malicious we...

PT-2024-16908

Name of the Vulnerable Software and Affected Versions Hi e-learning Learning Management System LMS versions prior to 06.12.2024 Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Reflected XSS...

CVE-2024-53846 ssl fails to validate incorrect extened key usage

OTP is a set of Erlang libraries, which consists of the Erlang runtime system, a number of ready-to-use components mainly written in Erlang, and a set of design principles for Erlang programs. A regression was introduced into the ssl application of OTP starting at OTP-25.3.2.8, OTP-26.2, and...

[R2] Security Center Version 6.5.0 Fixes Multiple Vulnerabilities

R2 Security Center Version 6.5.0 Fixes Multiple Vulnerabilities Arnie Cabral Thu, 12/05/2024 - 09:54 Security Center leverages third-party software to help provide underlying functionality. Several of the third-party components OpenSSL, PHP, Apache Portable Runtime were found to contain...

CVE-2024-53982 Arbitrary file download in Zoo-Project Echo Example

ZOO-Project is a C-based WPS Web Processing Service implementation. A path traversal vulnerability was discovered in Zoo-Project Echo example. The Echo example available by default in Zoo installs implements file caching, which can be controlled by user-given parameters. No input validation is...

CVE-2018-9394

In mtkp2pwextsetkey of drivers/misc/mediatek/connectivity/wlan/gen2/os/linux/glp2p.c, there is a possible OOB write due to improper input validation. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation...

ALSA-2024:10779 Moderate: python3:3.6.8 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...

Phoenix Contact PLCnext Improper Input Validation (CVE-2021-34570)

Multiple Phoenix Contact PLCnext control devices in versions prior to 2021.0.5 LTS are prone to a DoS attack through special crafted JSON requests. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable,...

CVE-2024-9369

Insufficient data validation in Mojo in Google Chrome prior to 129.0.6668.89 allowed a remote attacker who had compromised the renderer process to perform an out of bounds memory write via a crafted HTML page. Chromium security severity: High...

7-Zip Zstandard Decompression Integer Underflow Vulnerability - Windows

7zip is prone to a zstandard decompression integer underflow vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

GlobalProtect App: Insufficient Certificate Validation Leads to Privilege Escalation

An insufficient certification validation issue in the Palo Alto Networks GlobalProtect app enables attackers to connect the GlobalProtect app to arbitrary servers. This can enable a local non-administrative operating system user or an attacker on the same subnet to install malicious root...