Archive
11 February 2024
Vulnerabilities first published on this day (UTC), newest first.
21 results · Feed
-
Low 3.1
KDE Plasma Workspace Theme File eventpluginsmanager.cpp enabledPlugins path traversal
A vulnerability, which was classified as problematic, was found in KDE Plasma Workspace up to 5.93.0. This affects the function EventPluginsManager::enabledPlugins of the file components/calendar/eventpluginsmanager.cpp of the component Theme File Handler. Th…
-
Medium 5.5
Kernel: stack overflow problem in open vswitch kernel module leading to dos
A vulnerability was reported in the Open vSwitch sub-component in the Linux Kernel. The flaw occurs when a recursive operation of code push recursively calls into the code block. The OVS module does not validate the stack depth, pushing too many frames and ca…
-
Unscored —
`generational-arena` is unmaintained
The `generational-arena` crate's repository has been archived and is no longer maintained. ## Alternatives - [slotmap](https://crates.io/crates/slotmap)
-
Medium 6.5
DoS attack when broadcasting billboard messages
Allocation of Resources Without Limits or Throttling vulnerability in Badge leading to a denial of service attack.Team Hacker Hotel Badge 2024 on risc-v (billboard modules) allows Flooding.This issue affects Hacker Hotel Badge 2024: from 0.1.0 through 0.1.3.
-
Medium 5.0
DeepFaceLab main.py apply_xseg deserialization
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in DeepFaceLab pretrained DF.wf.288res.384.92.72.22 and classified as problematic. This issue affects the function apply_xseg of the file main.py. The manipulation leads to deserialization. The attack …
-
Medium 4.3
Netgear R7000 Web Management Interface debuginfo.htm information disclosure
A vulnerability was found in Netgear R7000 1.0.11.136_10.2.120 and classified as problematic. Affected by this issue is some unknown functionality of the file /debuginfo.htm of the component Web Management Interface. The manipulation leads to information disc…
-
Medium 4.3
Netgear R7000 Web Management Interface currentsetting.htm information disclosure
A vulnerability has been found in Netgear R7000 1.0.11.136_10.2.120 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /currentsetting.htm of the component Web Management Interface. The manipulation leads to …
-
Unscored —
In OpenDDS through 3.27, there is a segmentation fault for a DataWriter with a large value of resource_limits.max_sampl…
-
High 7.5
Denial of Service in Connect2id Nimbus JOSE+JWT
In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service (resource consumption) via a large JWE p2c header value (aka iteration count) for the PasswordBasedDecrypter (PBKDF2) component.
-
Medium 6.5CVE-2024-23724 Public exploit
Ghost has possible Cross-site Scripting issue
Ghost through 5.76.0 allows stored XSS, and resultant privilege escalation in which a contributor can take over any account, via an SVG profile picture that contains JavaScript code to interact with the API on localhost TCP port 3001. NOTE: The discoverer rep…
-
High 8.8
flusity-CMS v2.33 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /core/tools/delete_me…
-
High 7.1
diffoscope Path Traversal vulnerability
diffoscope before 256 allows directory traversal via an embedded filename in a GPG file. Contents of any file, such as ../.ssh/id_rsa, may be disclosed to an attacker. This occurs because the value of the gpg --use-embedded-filenames option is trusted.
-
Critical 9.1
Samly access control vulnerability
In the Samly package before 1.4.0 for Elixir, Samly.State.Store.get_assertion/3 can return an expired session, which interferes with access control because Samly.AuthHandler uses a cached session and does not replace it, even after expiry.
-
High 7.5
ExpressVPN before 12.73.0 on Windows, when split tunneling is used, sends DNS requests according to the Windows configu…
-
High 8.8
flusity-CMS v2.33 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /core/tools/add_trans…
-
Critical 9.1
In Rhonabwy through 1.1.13, HMAC signature verification uses a strcmp function that is vulnerable to side-channel attac…
-
High 8.6
yyjson has a Double Free vulnerability
yyjson through 0.8.0 has a double free, leading to remote code execution in some cases, because the pool_free function lacks loop checks. (pool_free is part of the pool series allocator, along with pool_malloc and pool_realloc.)
-
Medium 6.1
Glewlwyd SSO server 2.x through 2.7.6 allows open redirection via redirect_uri.
-
High 8.8
flusity-CMS v2.33 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /core/tools/update_me…
-
Medium 6.1
http-swagger before 1.2.6 allows XSS via PUT requests, because a file that has been uploaded (via httpSwagger.WrapHandl…
-
Critical 9.8
qanything_kernel/connector/database/mysql/mysql_client.py in qanything.ai QAnything before 1.2.0 allows SQL Injection.