4750 matches found
phlex Cross-Site Scripting Vulnerability
phlex is a framework for building object-oriented views in Ruby. A cross-site scripting vulnerability exists in versions prior to phlex 1.9.1, which stems from code that is not properly case-sensitive, resulting in cross-site scripting...
Go SDK for CloudEvents Security Vulnerability
Go SDK for CloudEvents is an official CloudEvents SDK open sourced by CloudEvents. A security vulnerability exists in Go SDK for CloudEvents versions prior to 2.15.2, which stems from the presence of a credential leak...
AZL-35663 CVE-2024-24786 affecting package kubevirt for versions less than 1.2.0-10
The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set...
CVE-2024-23302
Couchbase Server before 7.2.4 has a private key leak in goxdcr.log...
jose2go Security Vulnerabilities
jose2go is a Golang implementation of the Javascript object signing and encryption specification for individual developers at DV. A security vulnerability exists in jose2go versions prior to 1.6.0, which originated from a vulnerability that allows an attacker to cause a denial of service via a...
PT-2024-15380 · Thales · Thales Safenet Sentinel Hasp Ldk
Name of the Vulnerable Software and Affected Versions: Thales SafeNet Sentinel HASP LDK versions prior to 9.16 Description: A flaw in the installer for Thales SafeNet Sentinel HASP LDK on Windows allows an attacker to escalate their privilege level via local access. Recommendations: For versions...
Apache DolphinScheduler 输入验证错误漏洞
Apache DolphinScheduler is a distributed DAG visualization-based workflow task scheduling system from the Apache Apache Foundation in the United States. An input validation error vulnerability exists in Apache DolphinScheduler versions prior to 3.2.1, which stems from the presence of incorrect...
PT-2024-18917
Name of the Vulnerable Software and Affected Versions sanitize-html versions prior to 2.12.1 Description The issue allows for Information Exposure when the style attribute is permitted on the backend, enabling an attacker to enumerate files in the system, including project dependencies. This coul...
UBUNTU-CVE-2023-6477
An issue has been discovered in GitLab EE affecting all versions starting from 16.5 before 16.7.6, all versions starting from 16.8 before 16.8.3, all versions starting from 16.9 before 16.9.1. When a user is assigned a custom role with admingroupmember permission, they may be able to make a group...
Hertzbeat Security Vulnerabilities
Hertzbeat is an open source real-time monitoring system from the dromara organization. A security vulnerability exists in Hertzbeat versions prior to 1.4.1, which stems from a JNDI injection in the JmxCollectImpl.java implementation of JMXConnectorFactory.connect...
PT-2024-1846 · Wireshark +2 · Wireshark +2
Name of the Vulnerable Software and Affected Versions: Wireshark versions prior to 4.2.0 Description: The issue is related to a buffer overflow in the pan/addr resolv.c component of Wireshark, which can be exploited by a remote attacker to cause a denial of service. The ws manuf lookup str functi...
PT-2024-1839 · Google +5 · Google Chrome +5
Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 122.0.6261.57 Microsoft Edge affected versions not specified Description: The issue is related to an inappropriate implementation in the Navigation function of the browsers, allowing a remote attacker to bypass...
Yealink Config Encrypt Tool Security Vulnerability
YeaLink Yealink Config Encrypt Tool is a configuration encryption tool from China YeaLink. A security vulnerability exists in Yealink Config Encrypt Tool versions prior to 1.2, which stems from a possible decryption risk when encrypting Autop deployment files with a default key...
PT-2024-21045 · Pimcore · Pimcore Admin Classic Bundle
Name of the Vulnerable Software and Affected Versions: pimcore/admin-ui-classic-bundle versions prior to 1.3.4 Description: A potential security issue has been discovered in the pimcore/admin-ui-classic-bundle. The issue involves a Host Header Injection in the invitationLinkAction function of the...
CVE-2023-6255
Use of Hard-coded Credentials vulnerability in Utarit Information Technologies SoliPay Mobile App allows Read Sensitive Strings Within an Executable.This issue affects SoliPay Mobile App: before 5.0.8...
CVE-2023-4993
Incorrect Use of Privileged APIs vulnerability in Utarit Information Technologies SoliPay Mobile App allows Collect Data as Provided by Users.This issue affects SoliPay Mobile App: before 5.0.8...
PT-2024-13834
Name of the Vulnerable Software and Affected Versions SoliPay Mobile App versions prior to 5.0.8 Description The issue is related to an Incorrect Use of Privileged APIs, also described as an Improper Privilege Management vulnerability, in the SoliPay Mobile App. This vulnerability allows for the...
Adobe Substance 3D Painter 缓冲区错误漏洞
Adobe Substance 3D Painter is a 3D texturing application from the American company Audobee Adobe. A buffer overflow vulnerability exists in Adobe Substance 3D Painter version 9.1.1 and prior versions, which stems from the presence of a write-anywhere vulnerability that could lead to the execution...
AZL-34559 CVE-2023-50387 affecting package bind for versions less than 9.20.0-1
Certain DNSSEC aspects of the DNS protocol in RFC 4033, 4034, 4035, 6840, and related RFCs allow remote attackers to cause a denial of service CPU consumption via one or more DNSSEC responses, aka the "KeyTrap" issue. One of the concerns is that, when there is a zone with many DNSKEY and RRSIG...
PT-2024-3264 · Intel · Intel Thunderbolt Dch Drivers
Name of the Vulnerable Software and Affected Versions: IntelR ThunderboltTM DCH drivers for Windows versions prior to 88 Description: The issue is related to improper buffer restrictions in some IntelR ThunderboltTM DCH drivers for Windows, which may allow a privileged user to potentially enable...