CVE-2024-32883

MCUboot is affected by an issue where unprotected TLV entries can be injected into a signed image, because the protected/unprotected TLV distinction is not enforced. This can allow an attacker to influence dependency indications or boot records, potentially causing a processed image to be rejecte...

CVE-2024-32883 MCUboot Injection attack of unprotected TLV values

MCUboot is a secure bootloader for 32-bits microcontrollers. MCUboot uses a TLV tag-length-value structure to represent the meta data associated with an image. The TLVs themselves are divided into two sections, a protected and an unprotected section. The protected TLV entries are included as part...

CVE-2024-32883 MCUboot Injection attack of unprotected TLV values

MCUboot is a secure bootloader for 32-bits microcontrollers. MCUboot uses a TLV tag-length-value structure to represent the meta data associated with an image. The TLVs themselves are divided into two sections, a protected and an unprotected section. The protected TLV entries are included as part...

PT-2024-19510 · Setor Informatica · Setor Informatica Sistema Inteligente Para Laboratorios

Name of the Vulnerable Software and Affected Versions: Setor Informatica Sistema Inteligente para Laboratorios S.I.L. version 388 Description: The issue is related to a remote code execution RCE vulnerability. It can be triggered via a crafted POST request to the hprinter parameter...

PT-2024-29942

Name of the Vulnerable Software and Affected Versions Tenda W9 version 1.0.0.74456 Description A critical vulnerability has been found in the function formwrlSSIDset of the file /goform/wifiSSIDset. The manipulation of the argument ssidIndex leads to a stack-based buffer overflow. It is possible ...

PT-2024-19509 · Setor Informatica · Setor Informatica Sistema Inteligente Para Laboratorios

Name of the Vulnerable Software and Affected Versions: Setor Informatica Sistema Inteligente para Laboratorios S.I.L. version 388 Description: The issue is related to a remote code execution RCE vulnerability. It can be triggered via a crafted POST request using the hmsg parameter. Recommendation...

SUSE CVE-2024-32879

Python Social Auth is a social authentication/registration mechanism. Prior to version 5.4.1, due to default case-insensitive collation in MySQL or MariaDB databases, third-party authentication user IDs are not case-sensitive and could cause different IDs to match. This issue has been addressed b...

CVE-2024-28241

The GLPI Agent is a generic management agent. Prior to version 1.7.2, a local user can modify GLPI-Agent code or used DLLs to modify agent logic and even gain higher privileges. Users should upgrade to GLPI-Agent 1.7.2 to receive a patch. As a workaround, use the default installation folder which...

CVE-2024-28240

The GLPI Agent is a generic management agent. A vulnerability that only affects GLPI-Agent installed on windows via MSI packaging can allow a local user to cause denial of agent service by replacing GLPI server url with a wrong url or disabling the service. Additionally, in the case the Deploy ta...

CVE-2024-28241

The GLPI Agent is a generic management agent. Prior to version 1.7.2, a local user can modify GLPI-Agent code or used DLLs to modify agent logic and even gain higher privileges. Users should upgrade to GLPI-Agent 1.7.2 to receive a patch. As a workaround, use the default installation folder which...

CVE-2024-28241 GlPI-Agent MSI package installation doesn't update folder security profile when using non default installation folder

The GLPI Agent is a generic management agent. Prior to version 1.7.2, a local user can modify GLPI-Agent code or used DLLs to modify agent logic and even gain higher privileges. Users should upgrade to GLPI-Agent 1.7.2 to receive a patch. As a workaround, use the default installation folder which...

CVE-2024-28240 GLPI-Agent's MSI package installation permits local users to change Agent configuration

The GLPI Agent is a generic management agent. A vulnerability that only affects GLPI-Agent installed on windows via MSI packaging can allow a local user to cause denial of agent service by replacing GLPI server url with a wrong url or disabling the service. Additionally, in the case the Deploy ta...

CVE-2024-28240

GLPI-Agent (Windows MSI install) is affected by CVE-2024-28240. A local user can cause denial of service by replacing the GLPI server URL or disabling the agent service, and if the Deploy task is installed, can trigger privilege escalation by configuring a malicious server with its own deploy tas...

PT-2024-4001 · Portainer +1 · Portainer +1

Name of the Vulnerable Software and Affected Versions: Portainer versions prior to 2.20.0 Description: The issue is related to the use of open redirects in the Portainer container management platform. This could allow an attacker to redirect a user to an arbitrary site. The problem is associated...

PT-2024-4812 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: GLPI-Agent versions prior to 1.7.2 Description: A vulnerability in the GLPI-Agent, specifically affecting installations on Windows via MSI packaging, allows a local user to cause a denial of service by replacing the GLPI server URL with an...

PT-2024-24742 · Vyper · Vyper

Name of the Vulnerable Software and Affected Versions: Vyper versions 0.3.10 and prior Description: The issue arises from using the sqrt builtin in Vyper, which can result in a double eval vulnerability when the argument has side-effects. This occurs because the build IR function of the sqrt...

PT-2024-29496

Name of the Vulnerable Software and Affected Versions Tenda 4G300 version 1.01.42 Description A critical issue was found, affecting the function sub 422AA4. The manipulation of the argument year/month/day/hour/minute/second leads to a stack-based buffer overflow. This issue can be exploited...

PT-2024-29521 · Tenda · Tenda 4G300

Name of the Vulnerable Software and Affected Versions: Tenda 4G300 version 1.01.42 Description: A critical issue affects the function sub 429A30. The manipulation of the argument list1 leads to a stack-based buffer overflow. The attack may be initiated remotely. The vendor was contacted about thi...

PT-2024-22356 · Unknown +1 · Glpi Agent +1

Name of the Vulnerable Software and Affected Versions: GLPI Agent versions prior to 1.7.2 Description: A local user can modify the GLPI-Agent code or used DLLs to modify agent logic and potentially gain higher privileges. Recommendations: For versions prior to 1.7.2, upgrade to GLPI-Agent 1.7.2 t...

PT-2024-5123 · Tenda · Tenda W30E

Name of the Vulnerable Software and Affected Versions: Tenda W30E versions 1.0 through 1.0.1.25 Description: A critical issue has been found in the function fromWizardHandle of the file /goform/WizardHandle, which is related to a stack-based buffer overflow. The manipulation of the argument PPW c...