Archive
14 August 2024
Vulnerabilities first published on this day (UTC), newest first.
7 results · Clear filters · Feed
-
Critical 9.3
GitHub Actions Script Injection in `ultralytics/actions`
### Summary The Ultralytics action available at https://github.com/marketplace/actions/ultralytics-actions is vulnerable to GitHub Actions script injection. If anyone uses the action within a workflow that runs on the `pull_request_target` trigger, then an at…
-
Critical 9.8
Command Injection in sequenceserver
SequenceServer lets you rapidly set up a BLAST+ server with an intuitive user interface for personal or group use. Several HTTP endpoints did not properly sanitize user input and/or query parameters. This could be exploited to inject and run unwanted shell co…
-
Critical 9.0
Adobe Commerce | Unrestricted Upload of File with Dangerous Type (CWE-434)
Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution by an attacker. An attacker could exploit this vulnerabil…
-
Critical 9.8
SECOM Dr.ID Attendance system - Unrestricted File Upload
Dr.ID Access Control System from SECOM does not properly validate a specific page parameter, allowing unauthenticated remote attackers to inject SQL commands to read, modify, and delete database contents.
-
Critical 9.8
SECOM Dr.ID Access control system - SQL injection
Dr.ID Access Control System from SECOM does not properly validate a specific page parameter, allowing unauthenticated remote attackers to inject SQL commands to read, modify, and delete database contents.
-
Critical 9.8
In venc, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of …
-
Critical 9.8
In Modem, there is a possible memory corruption due to a missing bounds check. This could lead to remote code execution…