CVE-2020-5970

NVIDIA Virtual GPU Manager contains a vulnerability in the vGPU plugin, in which an input data size is not validated, which may lead to tampering or denial of service. This affects vGPU version 8.x prior to 8.4, version 9.x prior to 9.4 and version 10.x prior to 10.3...

CVE-2020-5972

NVIDIA Virtual GPU Manager contains a vulnerability in the vGPU plugin, in which local pointer variables are not initialized and may be freed later, which may lead to tampering or denial of service. This affects vGPU version 8.x prior to 8.4, version 9.x prior to 9.4 and version 10.x prior to 10....

CVE-2020-5968

NVIDIA Virtual GPU Manager contains a vulnerability in the vGPU plugin, in which the software does not restrict or incorrectly restricts operations within the boundaries of a resource that is accessed by using an index or pointer, such as memory or files, which may lead to code execution, denial ...

CVE-2019-4409

HCL Traveler versions 9.x and earlier are susceptible to cross-site scripting attacks. On the Problem Report page of the Traveler servlet pages, there is a field to specify a file attachment to provide additional problem details. An invalid file name returns an error message that includes the...

CVE-2019-2018

In resetPasswordInternal of DevicePolicyManagerService.java, there is a possible bypass of password reset protection due to an unusual root cause. Remote user interaction is needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9Android ID: A-110172241...

BIT-NODE-MIN-2025-23167

A flaw in Node.js 20's HTTP parser allows improper termination of HTTP/1 headers using \r\n\rX instead of the required \r\n\r\n. This inconsistency enables request smuggling, allowing attackers to bypass proxy-based access controls and submit unauthorized requests. The issue was resolved by...

Oracle MySQL 安全漏洞

Oracle MySQL is an open source relational database management system from Oracle Corporation.MySQL Server is one of the database server components. A security vulnerability exists in Oracle MySQL Server of Oracle MySQL, which stems from a flaw in the PS component that could lead to a complete...

Really Simple Security Plugin for WordPress 9.x < 9.1.2 Authentication Bypass

The WordPress Really Simple Security Plugin installed on the remote host is affected by an Authentication Bypass vulnerability. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number. No source data...

CVE-2024-46872

Mattermost versions 9.10.x ≤ 9.10.2, 9.11.x ≤ 9.11.1, 9.5.x ≤ 9.5.9 expose a frontend input sanitization flaw used for redirection, enabling a one-click client-side path traversal that leads to CSRF in Playbooks. Root cause: improper sanitization in frontend redirection logic. Impact: CSRF in Pla...

afw (>=0.0.6 <=0.0.21), akasha-plus (>=0.3.0 <=0.3.17) +16 more potentially affected by CVE-2024-21272 via mysql-connector-python (=9.0.0)

mysql-connector-python PYPI version =9.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on mysql-connector-python and may be impacted: - afw =0.0.6, =0.3.0, =1.0.6, =0.2.1, =0.1.0, =0.8.0, =0.6.6, =1.0.0, =0.2.19, =0.1.0, =0.0.1, =0.0.2, =0.0.5 and mor...

Microsoft Windows Security Feature Bypass And Spoofing Vulnerabilities (KB5043049)

This host is missing an important security update according to Microsoft KB5043049 SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

GHSA-Q5WX-M95R-4CGC Concrete CMS Stored Cross-site Scripting vulnerability

Concrete CMS versions 9.0.0 to 9.3.2 and below 8.5.18 are vulnerable to Stored XSS in RSS Displayer when user input is stored and later embedded into responses. A rogue administrator could inject malicious code into fields due to insufficient input validation...

CVE-2024-4353 Stored XSS in Generate Board Name Input Field

Concrete CMS versions 9.0.0 through 9.3.2 are affected by a stored XSS vulnerability in the generate dashboard board instance functionality. The Name input field does not check the input sufficiently letting a rogue administrator have the capability to inject malicious JavaScript code. The Concre...

CVE-2024-39777

Mattermost versions 9.9.x = 9.9.0, 9.5.x = 9.5.6, 9.7.x = 9.7.5 and 9.8.x = 9.8.1 fail to disallow unsolicited invites to expose access to local channels, when shared channels are enabled, which allows a malicious remote to send an invite with the ID of an existing local channel, and that local...

CVE-2024-39274

Mattermost server vulnerability CVE-2024-39274: Affected versions include Mattermost 9.9.x up to 9.9.0, 9.5.x up to 9.5.6, 9.7.x up to 9.7.5, and 9.8.x up to 9.8.1. The issue is improper validation of the channel from sync messages being a shared channel when shared channels are enabled, which ca...

Splunk Enterprise 9.0.0 < 9.0.10, 9.1.0 < 9.1.5, 9.2.0 < 9.2.2 (SVD-2024-0706)

The version of Splunk installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the SVD-2024-0706 advisory. - In Splunk Enterprise versions below 9.2.2, 9.1.5, and 9.0.10 and Splunk Cloud Platform versions below 9.1.2312.200 and...

Security Bulletin: Vulnerability in FOS firmware used by IBM b-type SAN directors and switches.

Summary The b-type products are vulnerable due to an OpenSSL issue in the FOS firmware. The vulnerability has been addressed and can be resolved by applying the FOS code level listed below. Vulnerability Details CVEID:CVE-2023-2650 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused...

CVE-2024-31309

HTTP/2 CONTINUATION DoS attack can cause Apache Traffic Server to consume more resources on the server. Version from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.3 are affected. Users can set a new setting proxy.config.http2.maxcontinuationframesperminute to limit the number of CONTINUATION frames...

GHSA-PJ42-R64F-4XFQ Concrete CMS Stored XSS on the calendar color settings screen

Concrete CMS version 9 before 9.2.8 and previous versions prior to 8.5.16 is vulnerable to Stored XSS on the calendar color settings screen since Information input by the user is output without escaping. A rogue administrator could inject malicious javascript into the Calendar Color Settings scre...

GHSA-9QHC-PG6J-WF23 Concrete CMS Stored XSS in blocks of type file

Concrete CMS version 9 below 9.2.8 and previous versions below 8.5.16 is vulnerable to Stored XSS in blocks of type file. Stored XSS could be caused by a rogue administrator adding malicious code to the link-text field when creating a block of type file. The Concrete CMS security team gave this...