PT-2024-39534 · Tmsoft · Tmsoft Myauth Gateway

Name of the Vulnerable Software and Affected Versions: TMsoft MyAuth Gateway version 3 Description: A problematic vulnerability has been found in TMsoft MyAuth Gateway. The issue affects an unknown function of the file /index.php. The manipulation of the argument console/nocache/cmd leads to...

PT-2024-39462 · Unknown · Peadm Forge Module

Name of the Vulnerable Software and Affected Versions: PEADM Forge Module versions prior to 3.24.0 Description: A security misconfiguration was discovered in the software. Recommendations: For versions prior to 3.24.0, update to version 3.24.0 or later to resolve the issue...

CVE-2022-49037

Insertion of sensitive information into log file vulnerability in proxy settings component in Synology Drive Client before 3.3.0-15082 allows remote authenticated users to obtain sensitive information via unspecified vectors...

Remote Code Execution

com.alipay.sofa:hessian is vulnerable to Remote Code Execution. The vulnerability is due to a gadget chain that bypasses the SOFA Hessian protocol's blacklist protection mechanism. This gadget chain relies solely on JDK classes and does not require any third-party components. The issue is fixed i...

SUSE CVE-2024-46795

In the Linux kernel, the following vulnerability has been resolved: ksmbd: unset the binding mark of a reused connection Steve French reported null pointer dereference error from sha256 lib. cifs.ko can send session setup requests on reused connection. If reused connection is used for binding...

PT-2024-27229 · Openplc · Openplc

Name of the Vulnerable Software and Affected Versions: OpenPLC v3 b4702061dc14d1024856f71b4543298d77007b88 Description: An out-of-bounds read issue exists in the OpenPLC Runtime EtherNet/IP PCCC parser functionality. A specially crafted network request can lead to denial of service. An attacker c...

SUSE CVE-2024-46707

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Make ICCSGIEL1 undef in the absence of a vGICv3 On a system with a GICv3, if a guest hasn't been configured with GICv3 and that the host is not capable of GICv2 emulation, a write to any of the ICCSGIEL1 registers is...

DEBIAN-CVE-2024-46707

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Make ICCSGIEL1 undef in the absence of a vGICv3 On a system with a GICv3, if a guest hasn't been configured with GICv3 and that the host is not capable of GICv2 emulation, a write to any of the ICCSGIEL1 registers is...

UBUNTU-CVE-2024-46707

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Make ICCSGIEL1 undef in the absence of a vGICv3 On a system with a GICv3, if a guest hasn't been configured with GICv3 and that the host is not capable of GICv2 emulation, a write to any of the ICCSGIEL1 registers is...

WordPress MStore API plugin <= 4.15.3 - Authenticated (Subscriber+) Limited Arbitrary File Upload vulnerability

Authenticated Subscriber+ Limited Arbitrary File Upload vulnerability discovered by stealthcopter in WordPress Plugin MStore API versions = 4.15.3...

Zephyr 安全漏洞

Zephyr is an extensible real-time operating system RTOS open-sourced by Zephyr. A security vulnerability exists in Zephyr version 3.6 and earlier, which stems from an incorrect discard routine causing a heap overflow in bthcileadvextreport in /subsys/bluetooth/host/scan.c. The vulnerability is...

Zephyr 安全漏洞

Zephyr is an extensible real-time operating system RTOS open-sourced by Zephyr. A security vulnerability exists in Zephyr version 3.6 and prior versions, which stems from a lack of checking the length of netbuf when processing data for the RFCOMM protocol, which could lead to a heap-based buffer...

moziloCMS 安全漏洞

moziloCMS is a content management system CMS in the moziloCMS open source. A security vulnerability exists in moziloCMS version 3.0, which stems from the presence of a Reflective Cross-Site Scripting XSS vulnerability that could allow an attacker to execute arbitrary code in the context of a user...

undertow: response write hangs in case of Java 17 TLSv1.3 NewSessionTicket

A vulnerability was found in Undertow, where the chunked response hangs after the body was flushed. The response headers and body were sent but the client would continue waiting as Undertow does not send the expected 0\r\n termination of the chunked response. This results in uncontrolled resource...

PT-2024-21664 · Unknown · Notes Station 3

Name of the Vulnerable Software and Affected Versions: Notes Station 3 versions prior to 3.9.6 Description: A cross-site scripting XSS vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow authenticated users to inject malicious code via a network...

puppet-pulpcore: An authentication bypass vulnerability exists in pulpcore

An authentication bypass vulnerability has been identified in Pulpcore when deployed with Gunicorn versions prior to 22.0, due to the puppet-pulpcore configuration. This issue arises from Apache's modproxy not properly unsetting headers because of restrictions on underscores in HTTP headers,...

PT-2024-31712 · Unknown +1 · Codeigniter 3 +1

Name of the Vulnerable Software and Affected Versions: ASIS aka Aplikasi Sistem Sekolah using CodeIgniter 3 versions 3.0.0 through 3.2.0 Description: The issue allows attackers to inject SQL through the "index.php" file, which can be exploited to bypass authentication. This is achieved by injecti...

PT-2024-29314 · Unknown · Kashipara Responsive School Management System

Name of the Vulnerable Software and Affected Versions: Kashipara Responsive School Management System version 3.2.0 Description: A SQL injection vulnerability in the /smsa/admin login.php file allows an attacker to execute arbitrary SQL commands via the username parameter of the Admin Login Page...

CVE-2024-43259

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in JEM Plugins Order Export for WooCommerce.This issue affects Order Export for WooCommerce: from n/a through 3.23...

WordPress plugin WP Testimonial Widget SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection...