CVE-2024-45723 goTenna Pro ATAK Plugin Use of Cryptographically Weak Pseudo-Random Number Generator

The goTenna Pro ATAK Plugin does not use SecureRandom when generating passwords for sharing cryptographic keys. The random function in use makes it easier for attackers to brute force this password if the broadcasted encryption key is captured over RF. This only applies to the optional broadcast ...

The vulnerability of the Ceph storage system, related to deficiencies in authentication procedures, allows attackers to gain access to confidential data and compromise its integrity.

The vulnerability of the Ceph storage system is related to deficiencies in authentication procedures. Exploiting this vulnerability allows a malicious actor, operating remotely, to gain access to confidential data and compromise its integrity...

GHSA-58VJ-CV5W-V4V6 Navidrome has Multiple SQL Injections and ORM Leak

Security Advisory: Multiple Vulnerabilities in Navidrome Summary Navidrome automatically adds parameters in the URL to SQL queries. This can be exploited to access information by adding parameters like password=... in the URL ORM Leak. Furthermore, the names of the parameters are not properly...

protobuf-java has potential Denial of Service issue

Summary When parsing unknown fields in the Protobuf Java Lite and Full library, a maliciously crafted message can cause a StackOverflow error and lead to a program crash. Reporter: Alexis Challande, Trail of Bits Ecosystem Security Team Affected versions: This issue affects all versions of both t...

CGA-Q4FH-WG3W-H9G4

Bulletin has no description...

CVE-2023-41611

Victure PC420 1.1.39 was discovered to use a weak and partially hardcoded key to encrypt data...

CVE-2023-41612

Victure PC420 firmware 1.1.39 was found to use a weak encryption key for the file enabled_telnet.dat on the Micro SD card. The affected component is the device’s software/firmware handling that file; the weakness is tied to the encryption key rather than a code path detail in the provided documen...

The vulnerability of the Forklift Controller component of the Red Hat Migration Toolkit for Virtualization allows a attacker to exploit the protected information.

The vulnerability of the Forklift Controller component in the Red Hat Migration Toolkit for Virtualization stems from deficiencies in the authentication process. Exploiting this vulnerability can allow an attacker, operating remotely, to compromise protected information...

The vulnerability of the Citrix Workspace App for Windows lies in its insufficient resource control during its existence. This allows attackers to increase their privileges.

The vulnerability of the Citrix Workspace App for Windows relates to insufficient resource control during its existence. Exploiting this vulnerability can allow attackers to enhance their privileges...

The vulnerability of the ClamD service in the ClamAV antivirus software package allows a hacker to compromise system files or cause service failures.

The vulnerability of the ClamD service in the ClamAV antivirus software package is related to insufficient checking of unusual or exceptional states. Exploiting this vulnerability can allow an attacker to compromise system files or cause service failures...

The vulnerability of the Microsoft OneNote software for the Mac OS allows a hacker to circumvent existing security restrictions.

The vulnerability of the Microsoft OneNote note-taking software for the Mac OS is related to improper verification of the cryptographic signature. Exploiting this vulnerability could allow an attacker to circumvent existing security restrictions by introducing malicious libraries...

TDuckPro 授权问题漏洞

TDuckCloud TDuckPro is an out-of-the-box data collection tool from TDuckCloud that supports data collection, questionnaires, appointment enrollment, workflow approvals, form collections, public inquiries, OCR image recognition, and other high-level features. An authorization issue vulnerability...

The vulnerability of the Kibana data visualization service, related to deficiencies in the deserialization mechanism, allows attackers to execute arbitrary code.

The vulnerability of the Kibana data visualization service is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows an attacker to execute arbitrary code using a specially created YAML document...

Lenovo XClarity Controller (XCC) Vulnerabilities - Lenovo Support US

No description provided...

Expired OTP Usage

Keycloak is vulnerable to Expired OTP Usage. The vulnerability is due to OTP codes generated by FreeOTP remaining valid for an additional 30 seconds beyond their expiration time, increasing the attack window and surface by allowing two OTPs to be valid simultaneously...

PT-2024-6257 · Microsoft · Windows +2

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified DHCP Server Service affected versions not specified Remote Desktop Licensing Service affected versions not specified Description: The issue is related to a denial-of-service vulnerability that can be...

Ivanti EPM 安全漏洞

Ivanti EPM is a one-stop shop for managing user profiles and all client devices from Ivanti USA. A security vulnerability exists in Ivanti EPM that stems from a weak authentication issue contained in the patch management. An authenticated remote attacker could exploit the vulnerability to gain...

The vulnerability of the Git-based software platform for collaborative code development on GitLab stems from deficiencies in the authentication process, which allows unauthorized users to gain unauthorized access to protected information.

The vulnerability of the Git-based software platform for collaborative code development on GitLab is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...

CVE-2024-42343

Loway - CWE-204: Observable Response Discrepancy...

IBM Maximo Application Suite 加密问题漏洞

IBM Maximo Application Suite is a single platform for intelligent asset management, monitoring, maintenance, computer vision, security and reliability from International Business Machines IBM. An encryption issue vulnerability exists in IBM Maximo Application Suite versions 8.10, 8.11, and 9.0,...