Archive
10 June 2024
Vulnerabilities first published on this day (UTC), newest first.
149 results · Feed
-
Low 2.7
SQL Injection in Harbor scan log API
SQL-Injection in Harbor allows priviledge users to leak the task IDs
-
Medium 4.3
Harbor Open Redirect URL
Open Redirect in Harbor <=v2.8.4, <=v2.9.2, and <=v2.10.0 may redirect a user to a malicious site.
-
Medium 6.8
HP PC BIOS May 2024 Security Updates for Potential Stack Buffer Overflows
Potential vulnerabilities have been identified in the system BIOS for certain HP PC products, which might allow escalation of privileges and code execution. HP is releasing firmware updates to mitigate the potential vulnerabilities.
-
Medium 6.8
HP PC BIOS May 2024 Security Updates for Potential Stack Buffer Overflows
Potential vulnerabilities have been identified in the system BIOS for certain HP PC products which may allow escalation of privileges and code execution. HP is releasing firmware updates to mitigate the potential vulnerabilities.
-
High 7.5
Apache Allura: sensitive information exposure via DNS rebinding
Import functionality is vulnerable to DNS rebinding attacks between verification and processing of the URL. Project administrators can run these imports, which could cause Allura to read from internal services and expose them. This issue affects Apache Allur…
-
Medium 5.3
@jmondi/url-to-png arbitrary file read via Playwright's screenshot feature exploiting file wrapper
@jmondi/url-to-png is a self-hosted URL to PNG utility. Versions prior to 2.0.3 are vulnerable to arbitrary file read if a threat actor uses the Playright's screenshot feature to exploit the file wrapper. Version 2.0.3 mitigates this issue by requiring input …
-
Medium 5.3
@grpc/grpc-js can allocate memory for incoming messages well above configured limits
@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to versions 1.10.9, 1.9.15, and 1.8.22, there are two separate code paths in which memory can be allocated per message in excess of the `grpc.max_receive_…
-
High 8.9
ghtml Cross-Site Scripting (XSS) vulnerability
ghtml is software that uses tagged templates for template engine functionality. It is possible to introduce user-controlled JavaScript code and trigger a Cross-Site Scripting (XSS) vulnerability in some cases. Version 2.0.0 introduces changes to mitigate this…
-
High 8.8CVE-2024-35242 Public exploit
Composer vulnerable to command injection via malicious git/hg branch names
Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `composer install` command running inside a git/hg repository which has specially crafted branch names can lead to command injection. This requires cloning unt…
-
High 7.8
An improper access control vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on…
-
Medium 5.3
Trend Micro VPN Proxy One Pro, version 5.8.1012 and below is vulnerable to an arbitrary file overwrite or create attack…
-
Medium 5.4
A cross-site scripting (XSS) vulnerability in Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 could al…
-
High 7.8
A link following vulnerability in Trend Micro Deep Security 20.x agents below build 20.0.1-3180 could allow a local att…
-
Medium 4.7
A security agent link following vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local att…
-
Medium 6.1
A link following vulnerability in the Trend Micro Apex One and Apex One as a Service Damage Cleanup Engine could allow …
-
High 7.8
A security agent link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileg…
-
High 7.8
A Time-of-Check Time-Of-Use vulnerability in the Trend Micro Apex One and Apex One as a Service agent could allow a loc…
-
High 7.8
An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate …
-
High 7.8
An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate …
-
High 8.8
Composer vulnerable to command injection via malicious git branch name
Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `status`, `reinstall` and `remove` commands with packages installed from source via git containing specially crafted branch names in the repository can be used…
-
High 7.8
Trend Micro Security 17.x (Consumer) is vulnerable to a Privilege Escalation vulnerability that could allow a local att…
-
Medium 4.3
SuiteCRM-Core Host Header Injection in /legacy
SuiteCRM is an open-source Customer Relationship Management (CRM) software application. A vulnerability in versions prior to 8.6.1 allows for Host Header Injection when directly accessing the `/legacy` route. Version 8.6.1 contains a patch for the issue.
-
Medium 6.5
This issue was addressed through improved state management. This issue is fixed in Safari 17.5, iOS 17.5 and iPadOS 17.…
-
High 7.5
The issue was addressed with improved bounds checks. This issue is fixed in Safari 17.5, iOS 17.5 and iPadOS 17.5, macO…
-
Medium 5.5
This issue was addressed with improved environment sanitization. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, i…
-
Medium 4.3
The issue was addressed with improved checks. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS …
-
Critical 9.1
The issue was addressed with improved checks. This issue is fixed in iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS …
-
Medium 6.5
This issue was addressed with improvements to the noise injection algorithm. This issue is fixed in Safari 17.5, iOS 17…
-
Medium 6.3
This issue was addressed with improved validation of symlinks. This issue is fixed in macOS Monterey 12.7.5, macOS Sono…
-
High 7.1
An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 17.5 and iPadOS 1…
-
High 7.5
An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in iOS 16.7.8 and iPadOS…
-
High 7.1
This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5…
-
High 7.8
The issue was addressed with improved checks. This issue is fixed in iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, visio…
-
High 7.5
The issue was addressed with improved memory handling. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8…
-
High 8.4
The issue was addressed with improved checks. This issue is fixed in iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS …
-
High 7.5
The issue was addressed with improved memory handling. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 an…
-
High 7.8
The issue was addressed with improved checks. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS …
-
Low 2.4
This issue was addressed through improved state management. This issue is fixed in watchOS 10.5. A person with physical…
-
High 7.8
An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8…
-
Medium 6.5
The issue was addressed by adding additional logic. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8, i…