Publikacje w kolejności czasu

Microsoft Windows MSHTML Platform contains an unspecified vulnerability that allows for a security feature bypass.

Google Chromium V8 Engine contains an unspecified out-of-bounds memory write vulnerability via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

Google Chromium Visuals contains a use-after-free vulnerability that allows a remote attacker to exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

Obejście uwierzytelnienia wskaźników w Safari umożliwia atakującemu nieautoryzowany dostęp.

Apache OFBiz contains a path traversal vulnerability that could allow for remote code execution.

Błąd uwierzytelnienia w TP-Link TL-WR841N umożliwia ujawnienie wrażliwych informacji.

Luka w serwerach webowych Cisco ASA i FTD umożliwia zdalne wywołanie awarii urządzenia.

Błąd w Cisco ASA i FTD umożliwia lokalnemu atakującemu wykonanie dowolnego kodu.

CrushFTP contains an unspecified sandbox escape vulnerability that allows a remote attacker to escape the CrushFTP virtual file system (VFS).

Apache HugeGraph-Server contains an improper access control vulnerability that could allow a remote attacker to execute arbitrary code.

Palo Alto Networks PAN-OS GlobalProtect feature contains a command injection vulnerability that allows an unauthenticated attacker to execute commands with root privileges on the firewall.

Microsoft SmartScreen Prompt contains a security feature bypass vulnerability that allows an attacker to bypass the Mark of the Web (MotW) feature. This vulnerability can be chained with CVE-2023-38831 and CVE-2024-21412 to execute a malicious file.

Android Pixel contains an information disclosure vulnerability in the fastboot firmware used to support unlocking, flashing, and locking affected devices.

Android Pixel contains a privilege escalation vulnerability that allows an attacker to interrupt a factory reset triggered by a device admin app.

D-Link DNS-320L, DNS-325, DNS-327L, and DNS-340L contains a hard-coded credential that allows an attacker to conduct authenticated command injection, leading to remote, unauthorized code execution.

D-Link DNS-320L, DNS-325, DNS-327L, and DNS-340L contain a command injection vulnerability. When combined with CVE-2024-3272, this can lead to remote, unauthorized code execution.

Microsoft .NET Framework contains an information disclosure vulnerability that exposes the ObjRef URI to an attacker, ultimately enabling remote code execution.

Adobe ColdFusion contains an improper access control vulnerability that could allow an attacker to access or modify restricted files via an internet-exposed admin panel.

Microsoft Windows Error Reporting Service contains an improper privilege management vulnerability that allows a local attacker with user permissions to gain SYSTEM privileges.

Fortinet FortiClient EMS contains a SQL injection vulnerability that allows an unauthenticated attacker to execute commands as SYSTEM via specifically crafted requests.

Korupcja pamięci w systemach Apple może umożliwić obejście ochrony pamięci jądra.

Korupcja pamięci w systemach Apple może umożliwić obejście ochrony pamięci jądra.

JetBrains TeamCity contains an authentication bypass vulnerability that allows an attacker to perform admin actions.

W TeamCity umożliwiono atak typu path traversal, co pozwala na ograniczone działania administracyjne.

Nieautoryzowani zdalni atakujący mogą uzyskać dostęp do systemu przez interfejs zarządzania LoadMaster, co umożliwia wykonanie dowolnych poleceń…