Archive
3 October 2024
Vulnerabilities first published on this day (UTC), newest first.
63 results · Feed
-
Medium 4.3
This issue was addressed with improved checks. This issue is fixed in iOS 18.0.1 and iPadOS 18.0.1. Audio messages in M…
-
Medium 5.5
A logic issue was addressed with improved validation. This issue is fixed in iOS 18.0.1 and iPadOS 18.0.1. A user's sav…
-
High 8.8
Delta Electronics DIAEnergie SQL Injection
Delta Electronics DIAEnergie is vulnerable to an SQL injection in the script Handler_CFG.ashx. An authenticated attacker may be able to exploit this issue to cause delay in the targeted product.
-
Critical 9.8
Delta Electronics DIAEnergie SQL Injection
Delta Electronics DIAEnergie is vulnerable to an SQL injection in the script AM_RegReport.aspx. An unauthenticated attacker may be able to exploit this issue to obtain records contained in the targeted product.
-
High 7.2
@saltcorn/plugins-loader unsanitized plugin name leads to a remote code execution (RCE) vulnerability when creating plugins using git source
### Summary When creating a new plugin using the `git` source, the user-controlled value `req.body.name` is used to build the plugin directory where the location will be cloned. The API used to execute the `git clone` command with the user-controlled data is …
-
Critical 9.1
Optigo Networks ONS-S8 Spectra Aggregation Switch Weak Authentication
The web server for ONS-S8 - Spectra Aggregation Switch includes an incomplete authentication process, which can lead to an attacker authenticating without a password.
-
Critical 9.8
Optigo Networks ONS-S8 Spectra Aggregation Switch PHP Remote File Inclusion
The web service for ONS-S8 - Spectra Aggregation Switch includes functions which do not properly validate user input, allowing an attacker to traverse directories, bypass authentication, and execute remote code.
-
High 7.2
@saltcorn/server Remote Code Execution (RCE) / SQL injection via prototype pollution by manipulating `lang` and `defstring` parameters when setting localizer strings
### Summary The endpoint `/site-structure/localizer/save-string/:lang/:defstring` accepts two parameter values: `lang` and `defstring`. These values are used in an unsafe way to set the keys and value of the `cfgStrings` object. It allows to add/modify proper…
-
Medium 4.9
@saltcorn/server arbitrary file and directory listing when accessing build mobile app results
### Summary A user with admin permission can read arbitrary file and directory names on the filesystem by calling the `admin/build-mobile-app/result?build_dir_name=` endpoint. The `build_dir_name` parameter is not properly validated and it's then used to cons…
-
Medium 4.4
@saltcorn/server arbitrary file zip read and download when downloading auto backups
### Summary A user with admin permission can read and download arbitrary zip files when downloading auto backups. The file name used to identify the zip file is not properly sanitized when passed to `res.download` API. ### Details - file: https://github.com/s…
-
Medium 4.7
Open Redirect
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Express. This vulnerability affects the use of the Express Response object. This issue impacts Express: from 3.4.5 before 4.0.0.
-
Medium 5.6
Sentry SDK Prototype Pollution gadget in JavaScript SDKs
### Impact In case a Prototype Pollution vulnerability is present in a user's application or bundled libraries, the Sentry SDK could potentially serve as a gadget to exploit that vulnerability. The exploitability depends on the specific details of the underly…
-
Critical 9.3
Missing Authentication for Critical Function vulnerability in TEM Opera Plus FM Family Transmitter
TEM Opera Plus FM Family Transmitter allows access to an unprotected endpoint that allows MPFS File System binary image upload without authentication. This file system serves as the basis for the HTTP2 web server module but is also used by the SNMP module and…
-
High 8.6
Cross-Site Request Forgery (CSRF) vulnerability in TEM Opera Plus FM Family Transmitter
The TEM Opera Plus FM Family Transmitter application interface allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to perform certain actions with administrative privil…
-
Medium 5.8
Unexpected visibility of environment variable configurations in @backstage/plugin-app-backend
Backstage is an open framework for building developer portals. Configuration supplied through APP_CONFIG_* environment variables, for example APP_CONFIG_backend_listen_port=7007, where unexpectedly ignoring the visibility defined in configuration schema. This…
-
Medium 6.3
Type-confusion vulnerability that can cause the WRSA.exe service to crash and generate a crash dump
Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in Webroot SecureAnywhere - Web Shield on Windows, ARM, 64 bit, 32 bit (wrUrl.Dll modules) allows Functionality Misuse.This issue affects SecureAnywhere - Web Shield: before 2.1.2.3.
-
Medium 6.2
Type confusion that can cause the WRSA.exe service to crash and generate a crash dump
Access of Resource Using Incompatible Type ('Type Confusion') vulnerability in Webroot SecureAnywhere - Web Shield on Windows, ARM, 64 bit, 32 bit (wrUrl.Dll modules) allows Functionality Misuse.This issue affects SecureAnywhere - Web Shield: before 2.1.2.3.
-
Medium 6.2
Unhandled exception vulnerability that can cause the WRSA.exe service to crash and generate a crash dump
Improper Check for Unusual or Exceptional Conditions vulnerability in Webroot SecureAnywhere - Web Shield on Windows, ARM, 64 bit, 32 bit (wrURL.Dll modules) allows Functionality Misuse.This issue affects SecureAnywhere - Web Shield: before 2.1.2.3.
-
Low 3.3
NVIDIA CUDA Toolkit for Windows and Linux contains a vulnerability in the nvdisam command line tool, where a user can c…
-
Low 3.3
NVIDIA CUDA Toolkit for Windows and Linux contains a vulnerability in the nvdisam command line tool, where a user can c…
-
Low 3.3
NVIDIA CUDA toolkit for Windows and Linux contains a vulnerability in the nvdisasm command line tool where an attacker …
-
Medium 5.3
Unbounded name compression could lead to Denial of Service
NLnet Labs Unbound up to and including version 1.21.0 contains a vulnerability when handling replies with very large RRsets that it needs to perform name compression for. Malicious upstreams responses with very large RRsets can cause Unbound to spend a consid…
-
High 7.5
Crafted responses can lead to a denial of service due to cache inefficiencies in the Recursor
An attacker can publish a zone containing specific Resource Record Sets. Repeatedly processing and caching results for these sets can lead to a denial of service.
-
High 8.4
An integer overflow vulnerability exists in the Compound Document Binary File format parser of v1.14.52 of the GNOME Pr…
-
High 8.4
An integer overflow vulnerability exists in the Compound Document Binary File format parser of the GNOME Project G Stru…
-
High 7.8
A privilege escalation vulnerability exists in the node update functionality of Veertu Anka Build 1.42.0. A specially c…
-
High 7.5CVE-2024-41163 EPSS 52%
A directory traversal vulnerability exists in the archive functionality of Veertu Anka Build 1.42.0. A specially crafte…
-
High 7.5
A directory traversal vulnerability exists in the log files download functionality of Veertu Anka Build 1.42.0. A speci…
-
High 7.3
Codezips Online Shopping Portal index.php sql injection
A vulnerability was found in Codezips Online Shopping Portal 1.0. It has been classified as critical. Affected is an unknown function of the file index.php. The manipulation of the argument username leads to sql injection. It is possible to launch the attack …
-
High 7.5
async-graphql vulnerable to Directive Overload
async-graphql is a GraphQL server library implemented in Rust. async-graphql before 7.0.10 does not limit the number of directives for a field. This can lead to Service Disruption, Resource Exhaustion, and User Experience Degradation. This vulnerability is fi…
-
Medium 6.1
Reflected XSS Vulnerability in Sulu Media Bundle
Sulu is a PHP content management system. This vulnerability allows an attacker to inject arbitrary HTML/JavaScript code through the media download URL in Sulu CMS. It affects the SuluMediaBundle component. The vulnerability is a Reflected Cross-Site Scripting…
-
High 7.5
Local privelage escalation via COM hijacking
The AVGUI.exe of AVG/Avast Antivirus before versions before 24.1 can allow a local attacker to escalate privileges via an COM hijack in a time-of-check to time-of-use (TOCTOU) when self protection is disabled.
-
Medium 5.1
Sulu vulnerable to XSS via uploaded SVG
Sulu is a PHP content management system. Sulu is vulnerable against XSS whereas a low privileged user with access to the “Media” section can upload an SVG file with a malicious payload. Once uploaded and accessed, the malicious javascript will be executed on …
-
Medium 6.5
Local File Inclusion
Zohocorp ManageEngine Analytics Plus versions before 5410 and Zoho Analytics On-Premise versions before 5410 are vulnerable to Path traversal.
-
Medium 4.3
Apache Commons IO: Possible denial of service attack on untrusted input to XmlStreamReader
Uncontrolled Resource Consumption vulnerability in Apache Commons IO. The org.apache.commons.io.input.XmlStreamReader class may excessively consume CPU resources when processing maliciously crafted input. This issue affects Apache Commons IO: from 2.0 before …
-
High 8.8
PAM module may allow accessing with the credentials of another user
Authd PAM module before version 0.3.5 can allow broker-managed users to impersonate any other user managed by the same broker and perform any PAM operation with it, including authenticating as them.
-
Critical 9.2
Apache Avro Java SDK: Arbitrary Code Execution when reading Avro schema (Java SDK)
Schema parsing in the Java SDK of Apache Avro 1.11.3 and previous versions allows bad actors to execute arbitrary code. Users are recommended to upgrade to version 1.11.4 or 1.12.0, which fix this issue.
-
Medium 4.3
HPE IceWall Agent products, Cross-Site Request Forgery (CSRF)
A security vulnerability in HPE IceWall Agent products could be exploited remotely to cause a Cross-Site Request Forgery (CSRF) in the login flow.
-
Medium 6.4
Deep Freeze 9.00.020.5760 - Out-of-bounds read
Deep Freeze 9.00.020.5760 is vulnerable to an out-of-bounds read vulnerability by triggering the 0x70014 IOCTL code of the FarDisk.sys driver.
-
High 7.5
Social Web Suite – Social Media Auto Post, Social Media Auto Publish <= 4.1.11 - Directory Traversal to Arbitrary File Download
The Social Web Suite – Social Media Auto Post, Social Media Auto Publish plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.1.11 via the download_log function. This makes it possible for unauthenticated attackers…