Mozilla Thunderbird ESR Security Update (MFSA2024-69) - Mac OS X

Mozilla Thunderbird ESR is prone to an insufficient validation vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2024-45761

Dell OpenManage Server Administrator, versions 11.0.1.0 and prior, contains an improper input validation vulnerability. A remote low-privileged malicious user could potentially exploit this vulnerability to load any web plugins or Java class leading to the possibility of altering the behavior of...

CVE-2024-45761

Dell OpenManage Server Administrator (OMSA)

CVE-2024-45761

Dell OpenManage Server Administrator, versions 11.0.1.0 and prior, contains an improper input validation vulnerability. A remote low-privileged malicious user could potentially exploit this vulnerability to load any web plugins or Java class leading to the possibility of altering the behavior of...

Improper validation of IPv6 and IPvFuture addresses

...

Schneider Electric Modicon M340, MC80, and Momentum Unity M1E Improper Input Validation (CVE-2024-8936)

An Input Validation vulnerability exists that could lead to loss of confidentiality of controller memory after a successful Man-In-The-Middle attack followed by sending a crafted Modbus function call used to tamper with memory. This plugin only works with Tenable.ot. Please visit...

CVE-2024-52287 authentik performs insufficient validation of OAuth scopes

authentik is an open-source identity provider. When using the clientcredentials or devicecode OAuth grants, it was possible for an attacker to get a token from authentik with scopes that haven't been configured in authentik. authentik 2024.8.5 and 2024.10.3 fix this issue...

CVE-2024-10855 Image Optimizer, Resizer and CDN – Sirv <= 7.3.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Option Deletion

The Image Optimizer, Resizer and CDN – Sirv plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to insufficient validation on the filename parameter of the sirvuploadfilebychunks function and lack of in all versions up to, and including...

The vulnerability of Siemens SINEC Security Monitor’s security software lies in its improper validation of user-input data against a list of allowed values. This allows a perpetrator to compromise the integrity of the affected application configuration.

The vulnerability of Siemens SINEC Security Monitor software-related security protection lies in improper verification of the data entered by users against a list of allowed values. Exploiting this vulnerability could allow a malicious actor, operating remotely, to compromise the integrity of the...

PAN-OS: Improper Certificate Validation Enables Impersonation of a Legitimate GlobalProtect User

An improper certificate validation vulnerability in Palo Alto Networks PAN-OS software enables an authorized user with a specially crafted client certificate to connect to an impacted GlobalProtect portal or GlobalProtect gateway as a different legitimate user. This attack is possible only if you...

Intel Neural Compressor 输入验证错误漏洞

Intel Neural Compressor is an open source project from Intel Corporation USA designed to help developers easily implement AI model optimization. A security vulnerability exists in Intel Neural Compressor versions prior to v3.0 that stems from improper input validation. An attacker exploiting the...

Cisco Firepower Threat Defense和Cisco Adaptive Security Appliance 安全漏洞

Cisco Firepower Threat Defense FTD and Cisco Adaptive Security Appliance are both products of Cisco, Inc.Cisco Firepower Threat Defense is a suite of unified software that provides next-generation firewall services. Cisco Adaptive Security Appliance is a network appliance. It is used to protect...

KLA74117 Multiple vulnerabilities in Microsoft Browser

Multiple vulnerabilities were found in Microsoft Browser. Malicious users can exploit these vulnerabilities to execute arbitrary code, cause denial of service, spoof user interface, bypass security restrictions. Below is a complete list of vulnerabilities: 1. Use after free vulnerability in Parce...

CVE-2024-9981

The ee-class from FormosaSoft does not properly validate a specific page parameter, allowing remote attackers with regular privileges to upload a malicious PHP file first and then exploit this vulnerability to include the file, resulting in arbitrary code execution on the server...

CVE-2024-6763

CVE-2024-6763 affects the Jetty project (HttpURI utility) and involves insufficient validation of the URI authority segment. The vulnerability can lead to an open redirect or SSRF when a vulnerable Jetty HttpURI is used with certain (invalid) URIs, potentially depending on browser parsing differe...

CVE-2024-6763 Jetty URI parsing of invalid authority

Eclipse Jetty is a lightweight, highly scalable, Java-based web server and Servlet engine . It includes a utility class, HttpURI, for URI/URL parsing. The HttpURI class does insufficient validation on the authority segment of a URI. However the behaviour of HttpURI differs from the common browser...

PYSEC-2024-217

Gradio is an open-source Python package designed for quick prototyping. This is a data validation vulnerability affecting several Gradio components, which allows arbitrary file leaks through the post-processing step. Attackers can exploit these components by crafting requests that bypass expected...

GHSA-4Q3C-CJ7G-JCWF Gradio has several components with post-process steps allow arbitrary file leaks

Impact What kind of vulnerability is it? Who is impacted? This is a data validation vulnerability affecting several Gradio components, which allows arbitrary file leaks through the post-processing step. Attackers can exploit these components by crafting requests that bypass expected input...

Bandisoft BandiView 安全漏洞

Bandisoft bandiview is an image viewer and editor software from the Korean company Bandisoft. A security vulnerability exists in Bandisoft BandiView version 7.05, which stems from insufficient validation of PSD files, resulting in susceptibility to a buffer overflow attack of sub0x410d1d...

CVE-2024-47003 DoS via non-string message using permalink embed

Mattermost versions 9.11.x = 9.11.0 and 9.5.x = 9.5.8 fail to validate that the message of the permalink post is a string, which allows an attacker to send a non-string value as the message of a permalink post and crash the frontend...