Archive
16 September 2024
Vulnerabilities first published on this day (UTC), newest first.
90 results · Clear filters · Feed
-
Medium 6.1
This issue was addressed through improved state management. This issue is fixed in Safari 18, iOS 18 and iPadOS 18, mac…
-
Medium 5.5
A logic error was addressed with improved error handling. This issue is fixed in iOS 17.7 and iPadOS 17.7, iOS 18 and i…
-
Medium 5.5
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15. An app may be …
-
Medium 4.6
This issue was addressed through improved state management. This issue is fixed in iOS 17.7 and iPadOS 17.7, iOS 18 and…
-
Medium 6.5
The issue was addressed with improved UI. This issue is fixed in Safari 18, macOS Sequoia 15. Visiting a malicious webs…
-
Medium 4.4
This issue was addressed with improved data protection. This issue is fixed in macOS Sequoia 15. An app with root privi…
-
Medium 5.5
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15. An app may be …
-
Medium 5.5
A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 17.7 and iPadOS 17.7, iOS 18…
-
Medium 5.5
A file access issue was addressed with improved input validation. This issue is fixed in iOS 17.7 and iPadOS 17.7, iOS …
-
Medium 6.5
A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15, macOS Sonoma 1…
-
Medium 6.1
This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7,…
-
Medium 5.5
The issue was addressed with additional code-signing restrictions. This issue is fixed in macOS Sequoia 15, macOS Sonom…
-
Medium 5.3
An authentication issue was addressed with improved state management. This issue is fixed in Safari 18, iOS 18 and iPad…
-
Medium 5.5
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoi…
-
Medium 6.1
A privacy issue was addressed with improved handling of files. This issue is fixed in iOS 18 and iPadOS 18, macOS Sequo…
-
Medium 5.5
The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15. An app may be able to c…
-
Medium 5.5
This issue was addressed with improved validation of symlinks. This issue is fixed in iOS 18 and iPadOS 18, macOS Sequo…
-
Medium 5.3
This issue was addressed through improved state management. This issue is fixed in iOS 17.7 and iPadOS 17.7, iOS 18 and…
-
Medium 5.5
A privacy issue was addressed by moving sensitive data to a more secure location. This issue is fixed in iOS 18 and iPa…
-
Medium 6.4
URL Redirection to Untrusted Site ('Open Redirect') in GitLab
An issue has been discovered in GitLab EE affecting all versions starting from 11.1 before 17.1.7, 17.2 before 17.2.5, and 17.3 before 17.3.2. Under certain conditions an open redirect vulnerability could allow for an account takeover by breaking the OAuth fl…
-
Medium 5.3
-
Medium 6.7
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Prote…
-
Medium 6.5
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Prote…
-
Medium 5.0
Multiple mXSS found in snappymail HTML parser
Snappymail is an open source web-based email client. SnappyMail uses the `cleanHtml()` function to cleanup HTML and CSS in emails. Research discovered that the function has a few bugs which cause an mXSS exploit. Because the function allowed too many (invalid…
-
Medium 5.4
Cross-site scripting (XSS) in the decidim admin panel with QuillJS WYSWYG editor
decidim is a Free Open-Source participatory democracy, citizen participation and open government for cities and organizations. The WYSWYG editor QuillJS is subject to potential XSS attach in case the attacker manages to modify the HTML before being uploaded t…
-
Medium 6.8
Cross-site scripting (XSS) in the decidim admin activity log
decidim is a Free Open-Source participatory democracy, citizen participation and open government for cities and organizations. The admin panel is subject to potential Cross-site scripting (XSS) attach in case an admin assigns a valuator to a proposal, or does…
-
Medium 4.6
Concrete CMS version 9.0.0 to 9.3.3 and below 8.5.19 are vulnerable to Stored XSS in the "Next&Previous Nav" block
Concrete CMS versions 9.0.0 to 9.3.3 and below 8.5.19 are vulnerable to Stored XSS in the "Next&Previous Nav" block. A rogue administrator could add a malicious payload by executing it in the browsers of targeted users. The Concrete CMS Security Team gave thi…
-
Medium 5.3
Observable discrepancy in RAPL interface for some Intel(R) Processors may allow a privileged user to potentially enable…
-
Medium 5.3
Improper finite state machines (FSMs) in hardware logic in some Intel(R) Processors may allow an privileged user to pot…
-
Medium 5.3
Improper conditions check in some Intel(R) Processors with Intel(R) SGX may allow a privileged user to potentially enab…
-
Medium 6.1
Out-of-bounds write in UEFI firmware for some Intel(R) Processors may allow a privileged user to potentially enable esc…
-
Medium 6.1
NULL pointer dereference in the UEFI firmware for some Intel(R) Processors may allow a privileged user to potentially e…
-
Medium 4.6
Improper access control in Intel(R) RAID Web Console all versions may allow an authenticated user to potentially enable…
-
Medium 4.7
NULL pointer dereference in Intel(R) RAID Web Console software for all versions may allow an authenticated user to pote…
-
Medium 5.2
Improper input validation in some Intel(R) RAID Web Console software all versions may allow an authenticated user to po…
-
Medium 6.5
Uncaught exception in Intel(R) RAID Web Console software all versions may allow an authenticated user to potentially en…
-
Medium 6.5
Improper access control in Intel(R) RAID Web Console software for all versions may allow an authenticated user to poten…
-
Medium 6.7
Improper access control in Intel(R) RAID Web Console software for all versions may allow an authenticated user to poten…
-
Medium 6.7
Uncontrolled search path element in Intel(R) RAID Web Console software for all versions may allow an authenticated user…
-
Medium 6.3
IBM Aspera Shares session fixation
IBM Aspera Shares 1.0 through 1.10.0 PL3 does not invalidate session after a password reset which could allow an authenticated user to impersonate another user on the system.