4807 matches found
Huawei Lion-AL00C 安全漏洞
The Huawei Lion-AL00C is a smartphone from the Chinese company Huawei Huawei. The Huawei Lion-AL00C suffers from a stack overflow vulnerability that stems from a lack of sufficient checksums. An attacker could exploit the vulnerability to cause tampering of information, affecting availability...
Linux kernel 安全漏洞
Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from an incorrect call point to netdevtxresetqueue in the virtionet driver...
CVE-2024-55539
Weak algorithm used to sign RPM package. The following products are affected: Acronis Cyber Protect Cloud Agent Linux before build 39185, Acronis Cyber Protect 16 Linux before build 39938...
Incorrect Authorization
Overview Affected versions of this package are vulnerable to Incorrect Authorization through the manipulation of the notification ID in the request URL by a logged-in attacker. This issue due to insufficient authorization checks, enabling attackers to view sensitive mail details belonging to othe...
PT-2024-16364 · WordPress · Maxbuttons
Name of the Vulnerable Software and Affected Versions: MaxButtons WordPress plugin versions prior to 9.8.1 Description: The issue is related to the MaxButtons WordPress plugin, which does not properly sanitise and escape some of its settings. This could allow high-privilege users, such as...
The vulnerability of the operating system for managing Synology Router Manager allows for cross-site scripting attacks, as a lack of security measures has been taken to protect the website structure. This vulnerability enables attackers to carry out cross-site scripting attacks.
The vulnerability of the Synology Router Manager operating system for managing network devices is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...
CVE-2024-12025
The WordPress Collapsing Categories plugin (versions
The vulnerability of the wpforms_is_admin_page() function in the WPForms plugin of the WordPress content management system allows a hacker to gain unauthorized access to read and modify data.
The vulnerability of the wpformsisadminpage function in the WPForms plugin related to deficiencies in the authentication process. Exploiting this vulnerability could allow an attacker to gain unauthorized access to read and modify data...
The vulnerability in virtual and physical systems of Veeam Backup & Replication lies in the insufficient protection of registration data, allowing attackers to execute arbitrary codes.
The vulnerability of virtual and physical systems managed by Veeam Backup & Replication is related to insufficient protection of registration data. Exploiting these vulnerabilities could allow a malicious actor, operating remotely, to execute arbitrary code...
The vulnerability of the REFLASH_DDU_FindFile function in the Visteon Infotainment automotive application allows a intruder to execute arbitrary code.
The vulnerability of the REFLASHDDUFindFile function in the Visteon Infotainment automotive application platform exists due to the lack of measures to neutralize specific elements. Exploiting this vulnerability allows a hacker to execute arbitrary code in the basic operating system...
The vulnerability of the “export_log” application interface in the microprogramming system of multifunctional wireless access points of Advantech models EKI-6333AC-2G, EKI-6333AC-2GD, and EKI-6333AC-1GPO allows a perpetrator to compromise the confidentiality, integrity, and accessibility of protected information.
The vulnerability of the “exportlog” application interface in the microprogramming devices of the multifunctional wireless access points Advantech EKI-6333AC-2G, EKI-6333AC-2GD, and EKI-6333AC-1GPO exists due to the failure to take measures to neutralize the special elements used in the operating...
Chunghwa Telecom tbm-client 安全漏洞
Chunghwa Telecom tbm-client is an application from Chunghwa Telecom China. A security vulnerability exists in Chunghwa Telecom tbm-client versions 0.3.15 through 0.3.20, which stems from the presence of arbitrary file deletion and lack of CSRF protection, as well as an absolute path traversal...
CVE-2023-38483
Missing Authorization vulnerability in dylanblokhuis Instant CSS instant-css allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Instant CSS: from n/a through = 1.1.4...
PT-2024-36553 · Weasis · Weasis
Name of the Vulnerable Software and Affected Versions: Weasis version 4.5.1 Description: The issue concerns a hardcoded key for symmetric encryption of proxy credentials in the ui/pref/ProxyPrefView.java file within the weasis-core component of Weasis. This hardcoded key is used for the symmetric...
SUSE CVE-2024-45719
Inadequate Encryption Strength vulnerability in Apache Answer. This issue affects Apache Answer: through 1.4.0. The ids generated using the UUID v1 version are to some extent not secure enough. It can cause the generated token to be predictable. Users are recommended to upgrade to version 1.4.1,...
The vulnerability of Active Directory Certificate Services on Windows operating systems allows attackers to increase their privileges.
The vulnerability of Active Directory Certificate Services on Windows operating systems is related to deficiencies in the authentication process. Exploiting this vulnerability can allow attackers to gain increased privileges...
The vulnerability of the Drupal CMS system’s kernel allows attackers to enhance their privileges.
The vulnerability of the Drupal CMS system’s kernel is related to deficiencies in authentication procedures. Exploiting this vulnerability can allow attackers to enhance their privileges remotely...
sigstore has insufficient validation of integration timestamp during verification
Summary Versions of sigstore-python newer than 2.0.0 but prior to 3.6.0 perform insufficient validation of the "integration time" present in "v2" and "v3" bundles during the verification flow: the "integration time" is verified if a source of signed time such as an inclusion promise is present, b...
php: XML loading external entity without being enabled
A flaw was found in PHP due to inadequate validation of user-supplied XML input. By leveraging specially crafted XML code, a remote attacker could obtain sensitive information by viewing the contents of arbitrary files on the system or initiating requests to external systems. This issue may allow...
Method Exposure
orchid/platform is vulnerable to Method Exposure. The vulnerability is due to inadequate access control in the asynchronous modal functionality of the Orchid Platform, allows arbitrary methods within the Screen class to be called without proper validation, enabling attackers to exploit the expose...