Archive
10 June 2024
Vulnerabilities first published on this day (UTC), newest first.
149 results · Feed
-
High 8.8
The issue was addressed with improved checks. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS …
-
Medium 4.6
An authentication issue was addressed with improved state management. This issue is fixed in iOS 16.7.8 and iPadOS 16.7…
-
Low 3.3
This issue was addressed with additional entitlement checks. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, macOS…
-
Medium 5.9CVE-2024-27815 Public exploit
An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in iOS 17.5 and iPadOS 1…
-
Low 2.4
The issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 17.5 and iPadOS 1…
-
High 7.5
The issue was addressed with improved memory handling. This issue is fixed in Safari 17.5, iOS 17.5 and iPadOS 17.5, ma…
-
Critical 9.1
The issue was addressed with improved checks. This issue is fixed in iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS …
-
Low 3.3
A privacy issue was addressed with improved handling of temporary files. This issue is fixed in iOS 17.5 and iPadOS 17.…
-
High 7.5
A logic issue was addressed with improved file handling. This issue is fixed in visionOS 1.2. Processing web content ma…
-
High 7.0
The issue was addressed with improved memory handling. This issue is fixed in iOS 17.5 and iPadOS 17.5, tvOS 17.5, visi…
-
Medium 5.5
An issue was addressed with improved validation of environment variables. This issue is fixed in iOS 16.7.8 and iPadOS …
-
Medium 5.5
The issue was addressed with improved checks. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS …
-
High 7.4
This issue was addressed with improved permissions checking. This issue is fixed in iOS 17.5 and iPadOS 17.5, macOS Son…
-
Critical 9.1
The issue was addressed with improved checks. This issue is fixed in Safari 17.5, macOS Sonoma 14.5, visionOS 1.2. A we…
-
High 7.5
An integer overflow was addressed with improved input validation. This issue is fixed in Safari 17.5, iOS 16.7.8 and iP…
-
High 8.6
SuiteCRM authenticated RCE using connectors
SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.14.4 and 8.6.1, a vulnerability in connectors allows an authenticated user to perform a remote code execution attack. Versions 7.14.4 and 8.6.1 contain…
-
High 8.6CVE-2024-36416 Public exploit
SuiteCRM v4 API Excessive log data DOS
SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.14.4 and 8.6.1, a deprecated v4 API example with no log rotation allows denial of service by logging excessive data. Versions 7.14.4 and 8.6.1 contain …
-
Medium 5.7
SuiteCRM Stored XSS Vulnerability Allows Code Execution via Malicious iFrame
SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.14.4 and 8.6.1, an unverified IFrame can be added some some inputs, which could allow for a cross-site scripting attack. Versions 7.14.4 and 8.6.1 cont…
-
Critical 9.1
SuiteCRM Improper Control of Filename for Include Statement in PHP and Unrestricted Upload of File with Dangerous content leads to authenticated remote code execution
SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.14.4 and 8.6.1, a vulnerability in uploaded file verification in products allows for remote code execution. Versions 7.14.4 and 8.6.1 contain a fix for…
-
Medium 5.9
GoRouter Denial of Service Attack
Improper handling of requests in Routing Release > v0.273.0 and <= v0.297.0 allows an unauthenticated attacker to degrade the service availability of the Cloud Foundry deployment if performed at scale.
-
High 7.7
SuiteCRM authenticated Server-Side Request Forgery
SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.14.4 and 8.6.1, a vulnerability in the connectors file verification allows for a server-side request forgery attack. Versions 7.14.4 and 8.6.1 contain …
-
High 8.9
SuiteCRM authenticated Reflected Cross-Site Scripting
SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.14.4 and 8.6.1, a vulnerability in the import module error view allows for a cross-site scripting attack. Versions 7.14.4 and 8.6.1 contain a fix for t…
-
Critical 10.0CVE-2024-36412 Scanner template
SuiteCRM unauthenticated SQL Injection
SuiteCRM is an open-source Customer Relationship Management (CRM) software application. Prior to versions 7.14.4 and 8.6.1, a vulnerability in events response entry point allows for a SQL injection attack. Versions 7.14.4 and 8.6.1 contain a fix for this issu…
-
Critical 9.6
SuiteCRM authenticated SQL Injection in EmailUIAjax displayView controller
SuiteCRM is an open-source Customer Relationship Management (CRM) software application. In versions prior to 7.14.4 and 8.6.1, poor input validation allows for SQL Injection in EmailUIAjax displayView controller. Versions 7.14.4 and 8.6.1 contain a fix for th…
-
High 7.1
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Monterey 12.5. Processi…
-
Medium 5.5
The issue was addressed with improved restriction of data container access. This issue is fixed in macOS Ventura 13.6.5…
-
Medium 5.3
An information disclosure issue was addressed by removing the vulnerable code. This issue is fixed in macOS Monterey 12…
-
High 8.6
An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Ventura 13. An app may…
-
High 8.1
A memory corruption issue was addressed with improved validation. This issue is fixed in macOS Monterey 12.5. Processin…
-
Medium 5.5
This issue was addressed by adding an additional prompt for user consent. This issue is fixed in macOS Sonoma 14.4. An …
-
High 8.6
The issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.7.4, macOS Sonoma 14.4, macOS Ve…
-
Medium —
Moby (Docker Engine) is vulnerable to Ambiguous OCI manifest parsing
### Impact In the OCI Distribution Specification version 1.0.0 and prior and in the OCI Image Specification version 1.0.1 and prior, manifest and index documents are ambiguous without an accompanying Content-Type HTTP header. Versions of Moby (Docker Engine) …
-
High 7.5
go-grpc-compression has a zstd decompression bombing vulnerability
### Impact A malicious user could cause a denial of service (DoS) when using a specially crafted gRPC request. The decompression mechanism for zstd did not respect the limits imposed by gRPC, allowing rapid memory usage increases. Versions v1.1.4 through to v…
-
Critical 9.6
SuiteCRM authenticated SQL Injection in EmailUIAjax messages count controller
SuiteCRM is an open-source Customer Relationship Management (CRM) software application. In versions prior to 7.14.4 and 8.6.1, poor input validation allows for SQL Injection in EmailUIAjax messages count controller. Versions 7.14.4 and 8.6.1 contain a fix for…
-
Critical 9.6
SuiteCRM authenticated SQL Injection in TreeData entrypoint
SuiteCRM is an open-source Customer Relationship Management (CRM) software application. In versions prior to 7.14.4 and 8.6.1, poor input validation allows for SQL Injection in Tree data entry point. Versions 7.14.4 and 8.6.1 contain a fix for this issue.
-
High 7.8
Fuji Electric Monitouch V-SFT Type Confusion
Fuji Electric Monitouch V-SFT is vulnerable to a type confusion, which could cause a crash or code execution.
-
Medium 5.4CVE-2024-3850 Scanner template
Uniview NVR301-04S2-P4 Cross-site Scripting
Uniview NVR301-04S2-P4 is vulnerable to reflected cross-site scripting attack (XSS). An attacker could send a user a URL that if clicked on could execute malicious JavaScript in their browser. This vulnerability also requires authentication before it can be e…
-
Critical 9.6
SuiteCRM authenticated SQL Injection in Alerts
SuiteCRM is an open-source Customer Relationship Management (CRM) software application. In versions prior to 7.14.4 and 8.6.1, poor input validation allows for SQL Injection in the `Alerts` controller. Versions 7.14.4 and 8.6.1 contain a fix for this issue.
-
High 7.5
WordPress Ovic Importer plugin <= 1.6.3 - Arbitrary File Download vulnerability
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Ovic Team Ovic Importer allows Path Traversal.This issue affects Ovic Importer: from n/a through 1.6.3.
-
Low 3.7
WordPress Under Construction / Maintenance Mode from Acurax plugin <= 2.6 - IP Bypass vulnerability
Authentication Bypass by Spoofing vulnerability in Acurax Under Construction / Maintenance Mode from Acurax allows Authentication Bypass.This issue affects Under Construction / Maintenance Mode from Acurax: from n/a through 2.6.