CVE-2023-5117

Removed by vendor...

PT-2024-34466 · Unknown · Simplcommerce

Name of the Vulnerable Software and Affected Versions: SimplCommerce version 230310c8d7a0408569b292c5a805c459d47a1d8f Description: An improper access control issue exists, allowing users to submit reviews without verifying if they have purchased the product. This issue affects the review system,...

CVE-2024-47040 Use After Free in the android.hardware.radio.sap.ISap/slot2 service

There is a possible UAF due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

GFI Archiver 安全漏洞

GFI Archiver is an e-mail archiving software from GFI, Inc. for protecting, storing and retrieving your electronic communications. A security vulnerability exists in GFI Archiver that stems from the use of a vulnerable version of the Telerik Web UI by the product installer, which allows a remote...

CVE-2024-48843: Allocation of Resources Without Limits or Throttling

Denial of Service vulnerabilities where found providing a potiential for device service disruptions. Affected products: ABB ASPECT - Enterprise v3.08.02; NEXUS Series v3.08.02; MATRIX Series v3.08.02...

BELL-CVE-2024-53861 CVE-2024-53861 does not affect BellSoft software

Bulletin has no description...

PT-2024-37418

Name of the Vulnerable Software and Affected Versions: LXD versions 4.0 through 5.21.1 Description: A security issue was discovered in LXD's PKI mode, where a client's certificate could be used to bypass authentication if the certificate is present in the trust store, even if it is not signed by ...

FCNT 访问控制错误漏洞

FCNT is a cell phone service from FCNT. FCNT suffers from an access control error vulnerability that originates under certain conditions when an attacker can directly manipulate the device with the user's unlocked screen, exposing the settings page of a provided security feature and/or changing...

Security Bulletin: Financial Transaction Manager v4 is impacted by multiple vulnerabilities in IBM Java SE

Summary Multiple vulnerabilities were addressed in Financial Transaction Manager v4.0.6.0 iFix4 Vulnerability Details CVEID:CVE-2024-21147 DESCRIPTION: An unspecified vulnerability in Java SE related to the VM component could allow a remote attacker to cause high confidentiality, high integrity...

DEBIAN-CVE-2024-42329

The webdriver for the Browser object expects an error object to be initialized when the webdriversessionquery function fails. But this function can fail for various reasons without an error description and then the wd-error will be NULL and trying to read from it will result in a crash...

CVE-2024-47248

The Apache NimBLE Bluetooth 5.4 stack (host and controller) is vulnerable to a Classic Buffer Overflow (CWE-120) in versions through 1.7.0 . The root cause is a buffer copy operation that fails to check the input size, which can be triggered by a specially crafted MESH message when a non-default ...

CVE-2024-33610

CVE-2024-33610 affects Sharp Multifunction Printers. Pre-authentication exposure allows listing of session cookies via both sessionlist.html (no authentication) and related admin page artifacts, enabling potential session hijacking or unauthorized access. The Nuclei template notes a backdoor-like...

CVE-2024-37044 QTS, QuTS hero

A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to execute code. We have already fixed the vulnerability in the followin...

CVE-2018-9474

In writeToParcel of MediaPlayer.java, there is a possible serialization/deserialization mismatch due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2024-52581: Allocation of Resources Without Limits or Throttling

Litestar is an Asynchronous Server Gateway Interface ASGI framework. Prior to version 2.13.0, the multipart form parser shipped with litestar expects the entire request body as a single byte string and there is no default limit for the total size of the request body. This allows an attacker to...

CVE-2024-52917: Allocation of Resources Without Limits or Throttling

Bitcoin Core before 22.0 has a miniupnp infinite loop in which it allocates memory on the basis of random data received over the network, e.g., large M-SEARCH replies from a fake UPnP device...

CVE-2024-52913: Allocation of Resources Without Limits or Throttling

In Bitcoin Core before 0.21.0, an attacker could prevent a node from seeing a specific unconfirmed transaction, because transaction re-requests are mishandled...

PT-2024-10022

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 4.19.325, 6.11.11, and 6.12.2 Description The issue is related to a missing range check in the bitmap ip uadt function within the Linux kernel's netfilter module. This occurs when tbIPSET ATTR IP TO is not presen...

CVE-2024-50955: Allocation of Resources Without Limits or Throttling

An issue in how XINJE XD5E-24R and XL5E-16T v3.5.3b handles TCP protocol messages allows attackers to cause a Denial of Service DoS via a crafted TCP message...

kernel: drivers: base: Free devm resources when unregistering a device

A resource management issue was found in the Linux kernel's driver core regarding device-managed devm resource cleanup. When devices without buses or drivers are unregistered, their managed resources aren't properly freed because devresreleaseall is only called for devices that have been probed...