Archive
10 June 2024
Vulnerabilities first published on this day (UTC), newest first.
55 results · Clear filters · Feed
-
High 7.5
Apache Allura: sensitive information exposure via DNS rebinding
Import functionality is vulnerable to DNS rebinding attacks between verification and processing of the URL. Project administrators can run these imports, which could cause Allura to read from internal services and expose them. This issue affects Apache Allur…
-
High 8.9
ghtml Cross-Site Scripting (XSS) vulnerability
ghtml is software that uses tagged templates for template engine functionality. It is possible to introduce user-controlled JavaScript code and trigger a Cross-Site Scripting (XSS) vulnerability in some cases. Version 2.0.0 introduces changes to mitigate this…
-
High 8.8CVE-2024-35242 Public exploit
Composer vulnerable to command injection via malicious git/hg branch names
Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `composer install` command running inside a git/hg repository which has specially crafted branch names can lead to command injection. This requires cloning unt…
-
High 7.8
An improper access control vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on…
-
High 7.8
A link following vulnerability in Trend Micro Deep Security 20.x agents below build 20.0.1-3180 could allow a local att…
-
High 7.8
A security agent link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileg…
-
High 7.8
A Time-of-Check Time-Of-Use vulnerability in the Trend Micro Apex One and Apex One as a Service agent could allow a loc…
-
High 7.8
An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate …
-
High 7.8
An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate …
-
High 8.8
Composer vulnerable to command injection via malicious git branch name
Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the `status`, `reinstall` and `remove` commands with packages installed from source via git containing specially crafted branch names in the repository can be used…
-
High 7.8
Trend Micro Security 17.x (Consumer) is vulnerable to a Privilege Escalation vulnerability that could allow a local att…
-
High 7.5
The issue was addressed with improved bounds checks. This issue is fixed in Safari 17.5, iOS 17.5 and iPadOS 17.5, macO…
-
High 7.1
An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in iOS 17.5 and iPadOS 1…
-
High 7.5
An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in iOS 16.7.8 and iPadOS…
-
High 7.1
This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5…
-
High 7.8
The issue was addressed with improved checks. This issue is fixed in iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, visio…
-
High 7.5
The issue was addressed with improved memory handling. This issue is fixed in Safari 17.5, iOS 16.7.8 and iPadOS 16.7.8…
-
High 8.4
The issue was addressed with improved checks. This issue is fixed in iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS …
-
High 7.5
The issue was addressed with improved memory handling. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 an…
-
High 7.8
The issue was addressed with improved checks. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS …
-
High 7.8
An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8…
-
High 8.8
The issue was addressed with improved checks. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS …
-
High 7.5
The issue was addressed with improved memory handling. This issue is fixed in Safari 17.5, iOS 17.5 and iPadOS 17.5, ma…
-
High 7.5
A logic issue was addressed with improved file handling. This issue is fixed in visionOS 1.2. Processing web content ma…
-
High 7.0
The issue was addressed with improved memory handling. This issue is fixed in iOS 17.5 and iPadOS 17.5, tvOS 17.5, visi…
-
High 7.4
This issue was addressed with improved permissions checking. This issue is fixed in iOS 17.5 and iPadOS 17.5, macOS Son…
-
High 7.5
An integer overflow was addressed with improved input validation. This issue is fixed in Safari 17.5, iOS 16.7.8 and iP…
-
High 8.6
SuiteCRM authenticated RCE using connectors
SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.14.4 and 8.6.1, a vulnerability in connectors allows an authenticated user to perform a remote code execution attack. Versions 7.14.4 and 8.6.1 contain…
-
High 8.6CVE-2024-36416 Public exploit
SuiteCRM v4 API Excessive log data DOS
SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.14.4 and 8.6.1, a deprecated v4 API example with no log rotation allows denial of service by logging excessive data. Versions 7.14.4 and 8.6.1 contain …
-
High 7.7
SuiteCRM authenticated Server-Side Request Forgery
SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.14.4 and 8.6.1, a vulnerability in the connectors file verification allows for a server-side request forgery attack. Versions 7.14.4 and 8.6.1 contain …
-
High 8.9
SuiteCRM authenticated Reflected Cross-Site Scripting
SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.14.4 and 8.6.1, a vulnerability in the import module error view allows for a cross-site scripting attack. Versions 7.14.4 and 8.6.1 contain a fix for t…
-
High 7.1
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Monterey 12.5. Processi…
-
High 8.6
An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Ventura 13. An app may…
-
High 8.1
A memory corruption issue was addressed with improved validation. This issue is fixed in macOS Monterey 12.5. Processin…
-
High 8.6
The issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.7.4, macOS Sonoma 14.4, macOS Ve…
-
High 7.5
go-grpc-compression has a zstd decompression bombing vulnerability
### Impact A malicious user could cause a denial of service (DoS) when using a specially crafted gRPC request. The decompression mechanism for zstd did not respect the limits imposed by gRPC, allowing rapid memory usage increases. Versions v1.1.4 through to v…
-
High 7.8
Fuji Electric Monitouch V-SFT Type Confusion
Fuji Electric Monitouch V-SFT is vulnerable to a type confusion, which could cause a crash or code execution.
-
High 7.5
WordPress Ovic Importer plugin <= 1.6.3 - Arbitrary File Download vulnerability
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Ovic Team Ovic Importer allows Path Traversal.This issue affects Ovic Importer: from n/a through 1.6.3.
-
High 7.5
WordPress Strategery Migrations plugin <= 1.0 - Arbitrary File Deletion vulnerability
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Gabriel Somoza / Joseph Fitzgibbons Strategery Migrations allows Path Traversal, File Manipulation.This issue affects Strategery Migrations: from n/a through 1.0.
-
High 8.6
WordPress Upunzipper plugin <= 1.0.0 - Arbitrary File Deletion vulnerability
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Ravidhu Dissanayake Upunzipper allows Path Traversal, File Manipulation.This issue affects Upunzipper: from n/a through 1.0.0.