XML Entity Injection Vulnerability in Zhiyuan A8+ Collaboration Management Software of Beijing Zhiyuan Internet Software Co.

Zhiyuan A8+ collaborative management software is an integrated portal platform and work portal for grouping control and business control designed for grouping, internationalization, industrial chain and large-scale organizations, foreign-related work organizations and organization groups for...

Google Android elevation of privilege vulnerability (CNVD-2024-27515)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an elevation of privilege vulnerability that can be exploited by attackers to escalate privileges...

CVE-2023-42050 PDF-XChange Editor EMF File Parsing Use-After-Free Information Disclosure Vulnerability

PDF-XChange Editor EMF File Parsing Use-After-Free Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must...

CVE-2024-27752

Cross Site Scripting vulnerability in CSZ CMS v.1.3.0 allows a remote attacker to execute arbitrary code via the Default Keyword field in the settings function...

Denial of Service Vulnerability in Multiple Mozilla Products (CNVD-2024-37197)

Mozilla Firefox is an open source web browser.Mozilla Firefox ESR is an extended support version of Firefox the web browser.Mozilla Thunderbird is a suite of email client software separate from the Mozilla Application Suite. A denial of service vulnerability exists in several Mozilla products,...

PT-2024-9793 · Linux +4 · Linux Kernel +4

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to a memory error in the realloc function within the tools/nolibc/stdlib component of the Linux kernel. This error occurs because realloc copies an extra sizeofhea...

Microsoft Windows 10.0.17763.5458 - Kernel Privilege Escalation Exploit

Exploit Title : Microsoft Windows 10.0.17763.5458 - Kernel Privilege Escalation Exploit Author: E1 Coders CVE: CVE-2024-21338 require 'msf/core' class MetasploitModule 'CVE-2024-21338 Exploit', 'Description' = 'This module exploits a vulnerability in FooBar version 1.0. It may lead to remote code...

Exploit for Insufficient Verification of Data Authenticity in Rarlab Winrar

VolleyballSquid-----CVE-2023-38831-and-Bypass-UAC This is my...

The vulnerability of the Apache Avro data serialization library, related to deficiencies in the deserialization mechanism, allows attackers to trigger a service failure.

The vulnerability of the Apache Avro data serialization library is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability can allow an attacker to cause service failures...

Adobe Experience Manager Cross-Site Scripting Vulnerability (CNVD-2024-15361)

Adobe Experience Manager AEM is a set of content management solutions that can be used to build websites, mobile applications and forms from the American company Odobie Adobe. The program supports mobile content management, marketing and sales campaign management and multi-site management. A...

The vulnerability of the Python interpreter, related to errors in processing symbolic references, allows attackers to exploit their privileges.

The vulnerability of the Python interpreter is related to errors in processing symbolic references. Exploiting this vulnerability can allow attackers to enhance their privileges through a specially created symbolic reference...

CVE-2024-27914 Reflected Cross-Site Scripting (XSS) in search engine when debug mode is enabled in GLPI

GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. An unauthenticated user can provide a malicious link to a GLPI administrator in order to exploit a reflected XSS vulnerability. The XSS will only trigger if...

Microsoft Windows Kernel Elevation of Privilege Vulnerability (CNVD-2024-21147)

The Microsoft Windows Kernel is the kernel of the Windows operating system from the American company Microsoft. Microsoft Windows Kernel suffers from an elevation of privilege vulnerability due to a flaw in a kernel component that can be exploited by an attacker to gain SYSTEM privileges...

CVE-2024-27307

A vulnerability was found in JSONata. A malicious expression can exploit the transform operator to override properties on the Object constructor and prototype. This issue can result in denial of service, remote code execution, or other unforeseen behavior in applications that assess user-provided...

Apache Airflow Information Disclosure Vulnerability (CNVD-2024-26530)

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. An information disclosure vulnerability exists in Apache Airflow versions prior to...

The vulnerability of the hci_conn_getPhy function in the Linux operating system’s Bluetooth driver allows a hacker to cause a service failure.

The vulnerability of the hciconngetPhy function in the Linux operating system’s Bluetooth driver leads to a freeze. Exploiting this vulnerability can allow an attacker to cause service failures...

The vulnerability of the Microsoft Dynamics 365 resource planning software lies in the lack of measures taken to protect the website structure, allowing attackers to perform cross-site scripting attacks.

The vulnerability of the Microsoft Dynamics 365 resource planning software is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks using a specially created link...

Enhavo CMS Security Vulnerability

Enhavo CMS is a content management system from Enhavo. A security vulnerability exists in Enhavo CMS version v0.13.1. An attacker can exploit this vulnerability to execute arbitrary web script or HTML via a specially crafted payload injected into the Title text field...

How CVSS 4.0 changes (or doesn’t) the way we see vulnerability severity

Finding, managing and patching security vulnerabilities on any network, no matter the size, is a tall task. In the first week of 2024 alone, there were 621 new common IT security vulnerabilities and exposures CVEs disclosed worldwide, covering a range of applications, software and hardware that...

GHSA-9W99-78RJ-HMXQ Cross-site scripting (XSS) in the dynamic file uploads

Impact The dynamic file upload feature is subject to potential XSS attach in case the attacker manages to modify the file names of the records being uploaded to the server. This appears in sections where the user controls the file upload dialogs themselves and has the technical knowledge to chang...