Archive
6 February 2024
Vulnerabilities first published on this day (UTC), newest first.
156 results · Feed
-
High 7.2
A post authentication command injection vulnerability exists when setting up the PPTP global configuration of Tp-Link E…
-
High 7.2
A post authentication command injection vulnerability exists when configuring the web group member of Tp-Link ER7206 Om…
-
High 7.2
A post authentication command execution vulnerability exists in the web filtering functionality of Tp-Link ER7206 Omada…
-
Medium 6.2
IBM UrbanCode Deploy information disclosure
IBM UrbanCode Deploy (UCD) 7.0 through 7.0.5.19, 7.1 through 7.1.2.15, 7.2 through 7.2.3.8, 7.3 through 7.3.2.3, and IBM UrbanCode Deploy (UCD) - IBM DevOps Deploy 8.0.0.0 could disclose sensitive user information when installing the Windows agent. IBM X-Forc…
-
Medium 5.3
IBM PowerVM Hypervisor information disclosure
IBM PowerVM Hypervisor FW950.00 through FW950.90, FW1020.00 through FW1020.40, and FW1030.00 through FW1030.30 could allow a system administrator to obtain sensitive partition information. IBM X-Force ID: 269695.
-
High 8.0
SQL Injection Remote Code Execution Vulnerability
SQL Injection Remote Code Execution Vulnerability was found using a create statement in the SolarWinds Platform. This vulnerability requires user authentication to be exploited.
-
Medium 5.5
Tongda OA 2017 delete.php sql injection
A vulnerability classified as critical has been found in Tongda OA 2017 up to 11.10. Affected is an unknown function of the file /general/email/outbox/delete.php. The manipulation of the argument DELETE_STR leads to sql injection. The exploit has been disclos…
-
High 8.0
SQL Injection Remote Code Execution Vulnerability
SQL Injection Remote Code Execution Vulnerability was found using an update statement in the SolarWinds Platform. This vulnerability requires user authentication to be exploited
-
Medium 5.3
Tuleap's content of artifacts might be readable by unauthorized users
Tuleap is an Open Source Suite to improve management of software developments and collaboration. Some users might get access to restricted information when a process validates the permissions of multiple users (e.g. mail notifications). This issue has been pa…
-
Critical 9.9
A cross-site scripting (XSS) vulnerability in all versions of the web server component of Allegro AI’s ClearML platform…
-
Critical 9.6
A cross-site request forgery (CSRF) vulnerability in all versions up to 1.14.1 of the api server component of Allegro A…
-
Critical 9.8
Lack of authentication in all versions of the fileserver component of Allegro AI’s ClearML platform allows a remote att…
-
High 8.0
Allegro AI ClearML path traversal vulnerability
A path traversal vulnerability in versions 1.4.0 to 1.14.1 of the client SDK of Allegro AI’s ClearML platform enables a maliciously uploaded dataset to write local or remote files to an arbitrary location on an end user’s system when interacted with.
-
High 8.0CVE-2024-24590 Public exploit
Allegro AI ClearML vulnerable to deserialization of untrusted data
Deserialization of untrusted data can occur in versions 0.17.0 to 1.14.2 of the client SDK of Allegro AI’s ClearML platform, enabling a maliciously uploaded artifact to run arbitrary code on an end user’s system when interacted with.
-
Medium 5.5
Indent: heap-based buffer overflow in set_buf_break()
A flaw was found in indent, a program for formatting C code. This issue may allow an attacker to trick a user into processing a specially crafted file to trigger a heap-based buffer overflow, causing the application to crash.
-
Medium 5.0
Ansible-core: possible information leak in tasks that ignore ansible_no_log configuration
An information disclosure flaw was found in ansible-core due to a failure to respect the ANSIBLE_NO_LOG configuration in some scenarios. Information is still included in the output in certain tasks, such as loop items. Depending on the task, this issue may in…
-
High 8.5CVE-2024-23673 Public exploit
Apache Sling Servlets Resolver: Malicious code execution via path traversal
Malicious code execution via path traversal in Apache Software Foundation Apache Sling Servlets Resolver.This issue affects all version of Apache Sling Servlets Resolver before 2.11.0. However, whether a system is vulnerable to this attack depends on the exac…
-
Medium 5.3
In JetBrains Toolbox App before 2.2 a DoS attack was possible via a malicious SVG image
-
Medium 5.3CVE-2024-24942 EPSS 32%
In JetBrains TeamCity before 2023.11.3 path traversal allowed reading data within JAR archives
-
Critical 9.8
In JetBrains TeamCity before 2023.11.3 authentication bypass leading to RCE was possible
-
Medium 6.1
In JetBrains IntelliJ IDEA before 2023.3.3 a plugin for JetBrains Space was able to send an authentication token to an …
-
Low 2.8
In JetBrains IntelliJ IDEA before 2023.3.3 path traversal was possible when unpacking archives
-
Low 3.3
In JetBrains Rider before 2023.3.3 logging of environment variables containing secret values was possible
-
Medium 5.3
In JetBrains TeamCity before 2023.11.2 limited directory traversal was possible in the Kotlin DSL documentation
-
Medium 4.6
In JetBrains TeamCity before 2023.11.2 stored XSS via agent distribution was possible
-
Medium 4.3
In JetBrains TeamCity before 2023.11.2 access control at the S3 Artifact Storage plugin endpoint was missed
-
Medium 6.8
Eap-galleon: custom provisioning creates unsecured http-invoker
An improper initialization vulnerability was found in Galleon. When using Galleon to provision custom EAP or EAP-XP servers, the servers are created unsecured. This issue could allow an attacker to access remote HTTP services available from the server.
-
Medium 5.5CVE-2024-0684 Public exploit
Coreutils: heap overflow in split --line-bytes with very long lines
A flaw was found in the GNU coreutils "split" program. A heap overflow with user-controlled data of multiple hundred bytes in length could occur in the line_bytes_split() function, potentially leading to an application crash and denial of service.
-
Medium 6.7
Dell Encryption, Dell Endpoint Security Suite Enterprise, and Dell Security Management Server versions prior to 11.9.0 …
-
Medium 6.3
DUP framework version 4.9.4.36 and prior contains insecure operation on Windows junction/Mount point vulnerability. A l…
-
Medium 6.6
Dell Display Manager application, version 2.1.1.17 and prior, contain an insecure operation on windows junction/mount p…
-
High 7.3
Dell Display Manager application, version 2.1.1.17, contains a vulnerability that low privilege user can execute malici…
-
Medium 6.7
Dell BIOS contains a Signed to Unsigned Conversion Error vulnerability. A local authenticated malicious user with admin…
-
Medium 4.7
Dell Command | Monitor, versions prior to 10.9, contain an arbitrary folder deletion vulnerability. A locally authentic…
-
High 7.8
Dell Power Manager, versions prior to 3.14, contain an Improper Authorization vulnerability in DPM service. A low privi…
-
High 7.5
Buffer Over-read in WLAN Firmware
Transient DOS while parse fils IE with length equal to 1.
-
High 8.4
Improper Validation of Array Index in Display
Memory corruption when negative display IDs are sent as input while processing DISPLAYESCAPE event trigger.
-
High 8.6
Use of Out-of-range Pointer Offset in WLAN HOST
Memory corruption while validating the TID to Link Mapping action request frame, when a station connects to an access point.
-
High 7.5
Buffer Over-read in WLAN Firmware
Transient DOS in WLAN Firmware when the length of received beacon is less than length of ieee802.11 beacon frame.
-
High 8.4
Untrusted Pointer Dereference in Display
Memory corruption while reading ACPI config through the user mode app.