Archive
14 March 2024
Vulnerabilities first published on this day (UTC), newest first.
69 results · Feed
-
Critical 9.8
Integer Overflow or Wraparound vulnerability in Mitsubishi Electric Corporation MELSEC-Q Series and MELSEC-L Series CPU…
-
Critical 9.8
Incorrect Pointer Scaling vulnerability in Mitsubishi Electric Corporation MELSEC-Q Series and MELSEC-L Series CPU modu…
-
Medium 5.5
Zemana AntiLogger v2.74.204.664 - Arbitrary Process Termination
Zemana AntiLogger v2.74.204.664 is vulnerable to an Arbitrary Process Termination vulnerability by triggering the 0x80002048 IOCTL code of the zam64.sys and zamguard64.sys drivers.
-
Low 3.9
Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
-
Medium 4.7
Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
-
Medium 6.4
LA-Studio Element Kit for Elementor <= 1.3.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
The LA-Studio Element Kit for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the LinkWrapper attribute found in several widgets in all versions up to, and including, 1.3.7.4 due to insufficient input sanitization and output es…
-
High 8.0
Cleartext Transmission of Sensitive Information in Softing edgeConnector and edgeAggregator
The affected product is vulnerable to a cleartext transmission of sensitive information vulnerability, which may allow an attacker to capture packets to craft their own requests.
-
Medium 6.4
oik <= 4.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The oik plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes such as bw_contact_button and bw_button shortcodes in all versions up to, and including, 4.10.0 due to insufficient input sanitization and output escaping on…
-
High 7.2
Plv8 Deferred Trigger Privilege Escalation
A user who can create objects in a database with plv8 3.2.1 installed is able to cause deferred triggers to execute as the Superuser during autovacuum.
-
Medium 5.4
Security headers not set in vantage6-UI
vantage6-UI is the official user interface for the vantage6 server. In affected versions a number of security headers are not set. This issue has been addressed in commit `68dfa6614` which is expected to be included in future releases. Users are advised to up…
-
Medium 4.2
CORS settings overly permissive in vantage6
vantage6 is an open source framework built to enable, manage and deploy privacy enhancing technologies like Federated Learning and Multi-Party Computation. The vantage6 server has no restrictions on CORS settings. It should be possible for people to set the a…
-
Medium 5.3
Username timing attack on recover password/MFA token in vantage6
vantage6 is an open source framework built to enable, manage and deploy privacy enhancing technologies like Federated Learning and Multi-Party Computation. Much like GHSA-45gq-q4xh-cp53, it is possible to find which usernames exist in vantage6 by calling the …
-
High 8.4
IBM i privilege escalation
Db2 for IBM i 7.2, 7.3, 7.4, and 7.5 infrastructure could allow a local user to gain elevated privileges due to an unqualified library call. A malicious actor could cause user-controlled code to run with administrator privilege. IBM X-Force ID: 280203.
-
Medium 4.5
IBM Integration Bus for z/OS cross-site request forgery
IBM Integration Bus for z/OS 10.1 through 10.1.0.3 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 284564.
-
High 7.3
Privilege Escalation Abusing installer in SupportApp
Support App is an opensource application specialized in managing Apple devices. It's possible to abuse a vulnerability inside the postinstall installer script to make the installer execute arbitrary code as root. The cause of the vulnerability is the fact tha…
-
High 8.2
IBM Maximo Application Suite XML external entity injection
IBM Maximo Application Suite 7.6.1.3 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 28456…
-
High 7.8
A logic issue was addressed with improved checks. This issue is fixed in iTunes 12.13.1 for Windows. A local attacker m…
-
High 8.1
Arbitrary method invocation turbo_boost-commands
turbo_boost-commands is a set of commands to help you build robust reactive applications with Rails & Hotwire. TurboBoost Commands has existing protections in place to guarantee that only public methods on Command classes can be invoked; however, the existing…
-
Medium 6.5
Proxy-Authorization header kept across hosts in follow-redirects
follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. In affected versions follow-redirects only clears authorization header during cross-domain redirect, but keep the proxy-authent…
-
Medium 6.5
Information exposure through microarchitectural state after transient execution from some register files for some Intel…
-
Medium 6.7
Improper input validation in the Intel(R) CSME installer software before version 2328.5.5.0 may allow an authenticated …
-
Low 3.3
Insertion of sensitive information into log file for some Intel(R) Local Manageability Service software before version …
-
Medium 6.7
Incorrect default permissions in some Intel(R) CSME installer software before version 2328.5.5.0 may allow an authentic…
-
Medium 6.8
Uncontrolled resource consumption for some Intel(R) SPS firmware versions may allow a privileged user to potentially en…
-
High 7.2
Race condition in BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalati…
-
Medium 6.5
Protection mechanism failure of bus lock regulator for some Intel(R) Processors may allow an unauthenticated user to po…
-
Medium 6.1
Protection mechanism failure in some 3rd and 4th Generation Intel(R) Xeon(R) Processors when using Intel(R) SGX or Inte…
-
Medium 5.5
Non-transparent sharing of return predictor targets between contexts in some Intel(R) Processors may allow an authorize…
-
High 7.2
On-chip debug and test interface with improper access control in some 4th Generation Intel(R) Xeon(R) Processors when u…
-
Medium 5.3
Incorrect calculation in microcode keying mechanism for some Intel(R) Xeon(R) D Processors with Intel(R) SGX may allow …
-
High 7.7
Pega Platform from 6.x to 8.8.4 is affected by an XXE issue with PDF Generation.
-
Medium 6.5
Path traversal in GoAnywhere MFT 7.4.1 and Earlier
A path traversal vulnerability exists in GoAnywhere MFT prior to 7.4.2 which allows attackers to circumvent endpoint-specific permission checks in the GoAnywhere Admin and Web Clients.
-
High 7.7
Insufficient session timeout vulnerability in Sagemcom router
Insufficient session timeout vulnerability in the FAST3686 V2 Vodafone router from Sagemcom. This vulnerability could allow a local attacker to access the administration panel without requiring login credentials. This vulnerability is possible because the 'Lo…
-
Medium 5.5
A malicious insider exploiting this vulnerability can circumvent existing security controls put in place by the organiz…
-
Medium 5.5
A malicious insider can uninstall Skyhigh Client Proxy without a valid uninstall password.
-
Medium 5.5CVE-2024-0311 Public exploit
A malicious insider can bypass the existing policy of Skyhigh Client Proxy without a valid release code.
-
High 8.1
Apache Airflow: Ignored Airflow Permissions
Apache Airflow, versions 2.8.0 through 2.8.2, has a vulnerability that allows an authenticated user with limited permissions to access resources such as variables, connections, etc from the UI which they do not have permission to access. Users of Apache Airf…
-
Medium 6.5
WordPress Livemesh Addons for Elementor Plugin <= 8.3.5 is vulnerable to Cross Site Scripting (XSS)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Livemesh Elementor Addons by Livemesh allows Stored XSS.This issue affects Elementor Addons by Livemesh: from n/a through 8.3.5.
-
Medium 4.9
An improper Limitation of a Pathname to a Restricted Directory (Path Traversal) vulnerability in SonicWall Email Securi…
-
High 8.3
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in the SonicOS SSLVPN portal allow…