Django SQL injection vulnerability

Django is a set of open source web application framework based on Python language from Django Foundation. The framework includes an object-oriented mapper, view system, template system, and more. An SQL injection vulnerability exists in Django versions prior to 5.0 to 5.0.8 and 4.2 to 4.2.15, whi...

Automation Anywhere Automation 360 security vulnerabilities

Automation Anywhere Automation 360 is a cloud-native end-to-end intelligent automation platform from Automation Anywhere, Inc. A security vulnerability exists in Automation Anywhere Automation 360 version 21094, which stems from the inclusion of a CSV injection vulnerability that allows an attack...

GHSA-6FCF-G3MP-XJ2X memos vulnerable to Server-Side Request Forgery in /o/get/httpmeta

memos is a privacy-first, lightweight note-taking service. In memos 0.13.2, an SSRF vulnerability exists at the /o/get/httpmeta that allows unauthenticated users to enumerate the internal network and receive limited html values in json form. This vulnerability is fixed in 0.16.1...

Arbitrary Code Execution

golang/go is vulnerable to Arbitrary Code Execution. The vulnerability is due to improper sanitization of environment variable values, which results in the output of the "go env" command to include arbitrary commands or new environment variables when executed as a shell script...

Unspecified vulnerability in Linux kernel (CNVD-2024-35101)

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that originates in the bpf module in the BPFCOREREADBITFIELD macro, where the variable val may be uninitialized. This could...

CVE-2024-42133

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Ignore too large handle values in BIG hcilebigsyncestablishedevt is necessary to filter out cases where the handle value is belonging to ida id range, otherwise ida will be erroneously released in hciconncleanup...

Django -- multiple vulnerabilities

Django reports: CVE-2024-41989: Memory exhaustion in django.utils.numberformat.floatformat. CVE-2024-41990: Potential denial-of-service in django.utils.html.urlize. CVE-2024-41991: Potential denial-of-service vulnerability in django.utils.html.urlize and AdminURLFieldWidget. CVE-2024-42005:...

UBUNTU-CVE-2024-42161

In the Linux kernel, the following vulnerability has been resolved: bpf: Avoid uninitialized value in BPFCOREREADBITFIELD Changes from V1: - Use a default branch in the switch statement to initialize val'. GCC warns that val' may be used uninitialized in the BPFCREREADBITFIELD macro, defined in...

CVE-2024-42133

The CVE-2024-42133 issue affects the Linux kernel Bluetooth subsystem. It fixes an incorrect handling of large handle values in the BIG (BIG_SYNC_ESTABLISHED) path by filtering handles to ensure that IDs do not get released erroneously during hci_conn_cleanup. The vulnerability arises from miscla...

CVE-2024-42133 Bluetooth: Ignore too large handle values in BIG

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Ignore too large handle values in BIG hcilebigsyncestablishedevt is necessary to filter out cases where the handle value is belonging to ida id range, otherwise ida will be erroneously released in hciconncleanup...

CVE-2024-42133 Bluetooth: Ignore too large handle values in BIG

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Ignore too large handle values in BIG hcilebigsyncestablishedevt is necessary to filter out cases where the handle value is belonging to ida id range, otherwise ida will be erroneously released in hciconncleanup...

CVE-2024-42133

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Ignore too large handle values in BIG hcilebigsyncestablishedevt is necessary to filter out cases where the handle value is belonging to ida id range, otherwise ida will be erroneously released in hciconncleanup...

CVE-2024-42114

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: restrict NL80211ATTRTXQQUANTUM values syzbot is able to trigger softlockups, setting NL80211ATTRTXQQUANTUM to 2^31. We had a similar issue in schfq, fixed with commit d9e15a273306 "pktsched: fq: do not accept sill...

PT-2024-10465

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.43 Description The issue is related to the Bluetooth component in the Linux kernel, where improper input validation can lead to a denial of service. Specifically, the hci le big sync established evt function...

Moodle XSS

The vulnerability in the virtual learning environment Moodle exists due to the lack of measures taken to protect the structure of the web page. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks by sending a specially crafted CSV file...

Linux Kernel Security Vulnerabilities

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in Linux kernel that stems from the use of uninitialized values in the copyname function, resulting in a kernel memory error...

Dahua Security Cameras Use of Insufficiently Random Values (CVE-2020-9502)

Some Dahua products with Build time before December 2019 have Session ID predictable vulnerabilities. During normal user access, an attacker can use the predicted Session ID to construct a data packet to attack the device. This plugin only works with Tenable.ot. Please visit...

Siemens SIMATIC S7-200 SMART Devices Use of Insufficiently Random Values (CVE-2024-35292)

Affected devices are using a predictable IP ID sequence number. This leaves the system susceptible to a family of attacks which rely on the use of predictable IP ID sequence numbers as their base method of attack and eventually could allow an attacker to create a denial-of-service condition. This...

Default values of properties when creating a single-session OS static delivery group

When creating a single-session OS static delivery group, please be aware of the default values for its properties: AutomaticPowerOnForAssigned: True AutomaticPowerOnForAssignedDuringPeak: False These properties affect the behavior of assigned machines in the delivery group. Please refer to the...

LOV Component Data Access

The vulnerability of the LOV component in terms of technical maintenance, repairs, and major overhauls of Oracle system equipment exists due to insufficient verification of input data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain access to read, modify, add, or...