Archive
16 September 2024
Vulnerabilities first published on this day (UTC), newest first.
164 results · Feed
-
Medium 6.1
This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15, macOS Sonoma 14.7,…
-
Medium 5.5
The issue was addressed with additional code-signing restrictions. This issue is fixed in macOS Sequoia 15, macOS Sonom…
-
Critical 10.0
A logic issue was addressed with improved file handling. This issue is fixed in macOS Sequoia 15. An app may be able to…
-
Medium 5.3
An authentication issue was addressed with improved state management. This issue is fixed in Safari 18, iOS 18 and iPad…
-
Medium 5.5
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Sequoi…
-
Medium 6.1
A privacy issue was addressed with improved handling of files. This issue is fixed in iOS 18 and iPadOS 18, macOS Sequo…
-
High 7.5
The issue was addressed with improved checks. This issue is fixed in macOS Sequoia 15. A logic issue existed where a pr…
-
Medium 5.5
The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15. An app may be able to c…
-
Medium 5.5
This issue was addressed with improved validation of symlinks. This issue is fixed in iOS 18 and iPadOS 18, macOS Sequo…
-
Medium 5.3
This issue was addressed through improved state management. This issue is fixed in iOS 17.7 and iPadOS 17.7, iOS 18 and…
-
Low 3.3
This issue was addressed with improved data protection. This issue is fixed in iOS 18 and iPadOS 18. An app may be able…
-
Medium 5.5
A privacy issue was addressed by moving sensitive data to a more secure location. This issue is fixed in iOS 18 and iPa…
-
Medium 6.4
URL Redirection to Untrusted Site ('Open Redirect') in GitLab
An issue has been discovered in GitLab EE affecting all versions starting from 11.1 before 17.1.7, 17.2 before 17.2.5, and 17.3 before 17.3.2. Under certain conditions an open redirect vulnerability could allow for an account takeover by breaking the OAuth fl…
-
Low 3.1
Authorization Bypass Through User-Controlled Key in GitLab
An issue was discovered in GitLab CE/EE affecting all versions starting from 16.7 prior to 17.1.7, 17.2 prior to 17.2.5, and 17.3 prior to 17.3.2, where group runners information was disclosed to unauthorised group members.
-
Medium 5.3
-
Medium 6.7
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Prote…
-
Medium 6.5
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Prote…
-
Medium 5.0
Multiple mXSS found in snappymail HTML parser
Snappymail is an open source web-based email client. SnappyMail uses the `cleanHtml()` function to cleanup HTML and CSS in emails. Research discovered that the function has a few bugs which cause an mXSS exploit. Because the function allowed too many (invalid…
-
Medium 5.4
Cross-site scripting (XSS) in the decidim admin panel with QuillJS WYSWYG editor
decidim is a Free Open-Source participatory democracy, citizen participation and open government for cities and organizations. The WYSWYG editor QuillJS is subject to potential XSS attach in case the attacker manages to modify the HTML before being uploaded t…
-
Medium 6.8
Cross-site scripting (XSS) in the decidim admin activity log
decidim is a Free Open-Source participatory democracy, citizen participation and open government for cities and organizations. The admin panel is subject to potential Cross-site scripting (XSS) attach in case an admin assigns a valuator to a proposal, or does…
-
High 7.3
Javascript Injection in Vending Info/Buyers Info Module in FluxCP
FluxCP is a web-based Control Panel for rAthena servers written in PHP. A javascript injection is possible via venders/buyers list pages and shop names, that are currently not sanitized. This allows executing arbitrary javascript code on the user's browser ju…
-
High 7.3
Tampering by prototype polution in DOMPurify
DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It has been discovered that malicious HTML using special nesting techniques can bypass the depth checking added to DOMPurify in recent releases. It was also possible to…
-
Medium 4.6
Concrete CMS version 9.0.0 to 9.3.3 and below 8.5.19 are vulnerable to Stored XSS in the "Next&Previous Nav" block
Concrete CMS versions 9.0.0 to 9.3.3 and below 8.5.19 are vulnerable to Stored XSS in the "Next&Previous Nav" block. A rogue administrator could add a malicious payload by executing it in the browsers of targeted users. The Concrete CMS Security Team gave thi…
-
Low —
lexical-core has multiple soundness issues
`RUSTSEC-2024-0377` contains multiple soundness issues: 1. [Bytes::read() allows creating instances of types with invalid bit patterns](https://github.com/Alexhuszagh/rust-lexical/issues/102) 1. [BytesIter::read() advances iterators out of bounds](https://git…
-
Medium 5.3
Observable discrepancy in RAPL interface for some Intel(R) Processors may allow a privileged user to potentially enable…
-
Medium 5.3
Improper finite state machines (FSMs) in hardware logic in some Intel(R) Processors may allow an privileged user to pot…
-
Low 2.5
Out-of-bounds read in UEFI firmware for some Intel(R) Processors may allow a privileged user to potentially enable deni…
-
Medium 5.3
Improper conditions check in some Intel(R) Processors with Intel(R) SGX may allow a privileged user to potentially enab…
-
Medium 6.1
Out-of-bounds write in UEFI firmware for some Intel(R) Processors may allow a privileged user to potentially enable esc…
-
Medium 6.1
NULL pointer dereference in the UEFI firmware for some Intel(R) Processors may allow a privileged user to potentially e…
-
High 7.5
A race condition in UEFI firmware for some Intel(R) processors may allow a privileged user to potentially enable escala…
-
High 7.2
Improper input validation in UEFI firmware for some Intel(R) Processors may allow a privileged user to enable informati…
-
High 7.5
Improper input validation in UEFI firmware error handler for some Intel(R) Processors may allow a privileged user to po…
-
High 8.2
Untrusted pointer dereference in UEFI firmware for some Intel(R) reference processors may allow a privileged user to po…
-
High 7.5
Improper access control in UEFI firmware for some Intel(R) Processors may allow a privileged user to potentially enable…
-
High 7.5
Improper input validation in UEFI firmware for some Intel(R) Processors may allow a privileged user to potentially enab…
-
Low 3.3
Improper access control in Intel(R) RAID Web Console all versions may allow an authenticated user to potentially enable…
-
High 7.9
Race condition in Seamless Firmware Updates for some Intel(R) reference platforms may allow a privileged user to potent…
-
Medium 4.6
Improper access control in Intel(R) RAID Web Console all versions may allow an authenticated user to potentially enable…
-
Low 3.5
Improper access control in Intel(R) RAID Web Console software all versions may allow an authenticated user to potential…