Archive
November 2024
Vulnerabilities first published in this month (UTC), newest first.
4,074 results · Feed
-
Medium 5.3
Exposure of Sensitive System Information to an Unauthorized Control Sphere in GitLab
An issue has been discovered in GitLab EE affecting all versions starting from 17.3 before 17.3.7, all versions starting from 17.4 before 17.4.4, all versions starting from 17.5 before 17.5.2 in which an unauthenticated user may be able to read some informati…
-
Critical 9.8
Easy Folder Listing Pro deserialization vulnerability
Valor Apps Easy Folder Listing Pro has a deserialization vulnerability that allows an unauthenticated, remote attacker to execute arbitrary code with the privileges of the Joomla! application. Fixed in versions 3.8 and 4.5.
-
High 7.4
Cri-o: checkpoint restore can be triggered from different namespaces
A vulnerability was found in CRI-O, where it can be requested to take a checkpoint archive of a container and later be asked to restore it. When it does that restoration, it attempts to restore the mounts from the restore archive instead of the pod request. A…
-
Low 2.0
Password Policy Bypass Vulnerability in Fides Webserver
Fides is an open-source privacy engineering platform. The user invite acceptance API endpoint lacks server-side password policy enforcement, allowing users to set arbitrarily weak passwords by bypassing client-side validation. While the UI enforces password c…
-
Medium 5.5
Vulnerability with bundle verification in sigstore-java
sigstore-java is a sigstore java client for interacting with sigstore infrastructure. sigstore-java has insufficient verification for a situation where a validly-signed but "mismatched" bundle is presented as proof of inclusion into a transparency log. This b…
-
Medium 4.3
Inefficient Algorithmic Complexity in GitLab
A denial of service (DoS) condition was discovered in GitLab CE/EE affecting all versions from 13.2.4 before 17.4.5, 17.5 before 17.5.3, and 17.6 before 17.6.1. By leveraging this vulnerability an attacker could create a DoS condition by sending crafted API c…
-
Medium 6.5
Incorrect Authorization in GitLab
An issue was discovered in GitLab CE/EE affecting all versions from 16.9.8 before 17.4.5, 17.5 before 17.5.3, and 17.6 before 17.6.1. Certain API endpoints could potentially allow unauthorized access to sensitive data due to overly broad application of token …
-
Medium 6.3
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in labsai/eddi
E.D.D.I (Enhanced Dialog Driven Interface) is a middleware to connect and manage LLM API bots. A path traversal vulnerability exists in the backup export functionality of EDDI, as implemented in `RestExportService.java`. This vulnerability allows an attacker …
-
High 8.2
Missing Authorization in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions from 8.12 before 17.4.5, 17.5 before 17.5.3, and 17.6 before 17.6.1. This issue allows an attacker with access to a victim's Personal Access Token (PAT) to escalate privileges.
-
Medium 5.3
Inefficient Algorithmic Complexity in GitLab
An issue was discovered in GitLab CE/EE affecting all versions starting from 15.6 prior to 17.4.5, starting from 17.5 prior to 17.5.3, starting from 17.6 prior to 17.6.1 which could cause Denial of Service via integrating a malicious harbor registry.
-
Medium 6.5
Inefficient Algorithmic Complexity in GitLab
A Denial of Service (DoS) issue has been discovered in GitLab CE/EE affecting all versions prior to 12.6 prior to 17.4.5, 17.5 prior to 17.5.3, and 17.6 prior to 17.6.1. An attacker could cause a denial of service with a crafted cargo.toml file.
-
Medium 4.2
Insufficient Session Expiration in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions from 16.11 before 17.4.5, 17.5 before 17.5.3, and 17.6 before 17.6.1. Long-lived connections could potentially bypass authentication controls, allowing unauthorized access to streaming result…
-
High 8.1CVE-2024-32965 EPSS 26%
ssrf vulnerability in lobe-chat
Lobe Chat is an open-source, AI chat framework. Versions of lobe-chat prior to 1.19.13 have an unauthorized ssrf vulnerability. An attacker can construct malicious requests to cause SSRF without logging in, attack intranet services, and leak sensitive informa…
-
Medium 6.1
Sugar Calendar (Lite) <= 3.3.0 - Reflected Cross-Site Scripting
The Sugar Calendar – Simple Event Management plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of add_query_arg & remove_query_arg without appropriate escaping on the URL in all versions up to, and including, 3.3.0. This make…
-
Medium 6.9
Denial of Service through Data corruption in gRPC-C++
There exists a denial of service through Data corruption in gRPC-C++ - gRPC-C++ servers with transmit zero copy enabled through the channel arg GRPC_ARG_TCP_TX_ZEROCOPY_ENABLED can experience data corruption issues. The data sent by the application may be cor…
-
Medium 5.5
Tuned: improper sanitization of `instance_name` parameter of the `instance_create()` method
A log spoofing flaw was found in the Tuned package due to improper sanitization of some API arguments. This flaw allows an attacker to pass a controlled sequence of characters; newlines can be inserted into the log. Instead of the 'evil' the attacker could mi…
-
High 7.8
Tuned: `script_pre` and `script_post` options allow to pass arbitrary scripts executed by root
A script injection vulnerability was identified in the Tuned package. The `instance_create()` D-Bus function can be called by locally logged-in users without authentication. This flaw allows a local non-privileged user to execute a D-Bus call with `script_pre…
-
Medium 6.5
The implementation of atob in "Zabbix JS" allows to create a string with arbitrary content and use it to access interna…
-
Low 2.2
Value of sysmap_element_url can be de-synchronized causing the map element to crash when new URLs is added
When a URL is added to the map element, it is recorded in the database with sequential IDs. Upon adding a new URL, the system retrieves the last sysmapelementurlid value and increments it by one. However, an issue arises when a user manually changes the sysma…
-
Medium 6.4
Elementor Website Builder – More than Just a Page Builder <= 3.25.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter of the Icon widget in all versions up to, and including, 3.25.7 due to insufficient input sanitization and …
-
High 7.2
Total Upkeep <= 1.16.6 - Authenticated (Administrator+) Remote Code Execution via Backup Settings
The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.16.6 via the cron_interval parameter. This is due to missing input validation and…
-
High 8.4
Buffer Over-read in IPA
An unsigned integer underflow vulnerability in IPA driver result into a buffer over-read while reading NAT entry using debugfs command 'cat /sys/kernel/debug/ipa/ip4_nat'
-
High 7.8
Use After Free in Video
Crafted Binder Request Causes Heap UAF in MediaServer
-
High 8.4
Information Exposure in Kernel
Information disclosure possible while audio playback.
-
High 8.4
Information Exposure in Camera Driver
Information disclosure due to uninitialized variable.
-
High 7.8
Improper Access Control in Core.
QSEE will randomly experience a fatal error during execution due to speculative instruction fetches from device memory. Device memory is not valid executable memory.
-
Medium 5.4
Accessing a non-secure HTTP site that uses a non-existent port may cause the SSL padlock icon in the location URL bar t…
-
Medium 5.4
Under certain circumstances, navigating to a webpage would result in the address missing from the location URL bar, mak…
-
Medium 6.5
Missing thread synchronization primitives could have led to a data race on members of the PlaybackParams structure. Thi…
-
High 8.8
Memory safety bugs present in Firefox 132, Firefox ESR 128.4, and Thunderbird 128.4. Some of these bugs showed evidence…
-
Critical 9.1
`NSC_DeriveKey` inadvertently assumed that the `phKey` parameter is always non-NULL. When it was passed as NULL, a segm…
-
Medium 6.5
A null pointer dereference may have inadvertently occurred in `pk12util`, and specifically in the `SEC_ASN1DecodeItem_U…
-
Critical 9.8
A flaw in handling fullscreen transitions may have inadvertently caused the application to become stuck in fullscreen m…
-
High 8.8
When handling keypress events, an attacker may have been able to trick a user into bypassing the "Open Executable File?…
-
Critical 9.8
A double-free issue could have occurred in `sec_pkcs7_decoder_start_decrypt()` when handling an error path. Under speci…
-
Medium 5.4
The application failed to account for exceptions thrown by the `loadManifestFromFile` method during add-on signature ve…
-
Medium 5.4
A crafted URL containing Arabic script and whitespace characters could have hidden the true origin of the page, resulti…
-
Medium 5.7
On Android, Firefox may have inadvertently allowed viewing saved passwords without the required device PIN authenticati…
-
Medium 6.1
Enhanced Tracking Protection's Strict mode may have inadvertently allowed a CSP `frame-src` bypass and DOM-based XSS th…
-
Critical 9.8
The executable file warning was not presented when downloading .library-ms files. *Note: This issue only affected Windo…