An out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to cause a denial of service.
AFFECTED_PRODUCTS:
Ivanti Endpoint Manager,
Ivanti Endpoint Manager,
Ivanti Endpoint Manager
An out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to cause a denial of service.
AFFECTED_PRODUCTS:
Ivanti Endpoint Manager,
Ivanti Endpoint Manager,
Ivanti Endpoint Manager
An out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to cause a denial of service.
AFFECTED_PRODUCTS:
Ivanti Endpoint Manager,
Ivanti Endpoint Manager,
Ivanti Endpoint Manager
An out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to cause a denial of service.
AFFECTED_PRODUCTS:
Ivanti Endpoint Manager,
Ivanti Endpoint Manager,
Ivanti Endpoint Manager
An uninitialized resource in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a local authenticated attacker to escalate their privileges.
AFFECTED_PRODUCTS:
Ivanti Endpoint Manager,
Ivanti Endpoint Manager,
Ivanti Endpoint Manager
Deserialization of untrusted data in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to achieve remote code execution. Local user interaction is required.
AFFECTED_PRODUCTS:
Ivanti Endpoint Manager,
Ivanti Endpoint Manager,
Ivanti Endpoint Manager
SQL injection in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution. This CVE addresses incomplete fixes from CVE-2024-32848.
AFFECTED_PRODUCTS:
Ivanti Endpoint Manager,
Ivanti Endpoint Manager,
Ivanti Endpoint Manager
Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.
AFFECTED_PRODUCTS:
Ivanti Endpoint Manager,
Ivanti Endpoint Manager,
Ivanti Endpoint Manager
Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.
AFFECTED_PRODUCTS:
Ivanti Endpoint Manager,
Ivanti Endpoint Manager,
Ivanti Endpoint Manager
Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.
AFFECTED_PRODUCTS:
Ivanti Endpoint Manager,
Ivanti Endpoint Manager,
Ivanti Endpoint Manager
An unbounded resource search path in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution.
AFFECTED_PRODUCTS:
Ivanti Endpoint Manager,
Ivanti Endpoint Manager
A flaw was found in rsync. This vulnerability arises from a race condition during rsync's handling of symbolic links. Rsync's default behavior when encountering symbolic links is to skip them. If an attacker replaced a regular file with a symbolic link at the right time, it was possible to bypass th...
AFFECTED_PRODUCTS:
Red Hat Red Hat Enterprise Linux 8,
Red Hat Red Hat Enterprise Linux 9,
Red Hat Red Hat Discovery 1.14
A flaw was found in rsync. When using the `--safe-links` option, the rsync client fails to properly verify if a symbolic link destination sent from the server contains another symbolic link within it. This results in a path traversal vulnerability, which may lead to arbitrary file write outside the...
AFFECTED_PRODUCTS:
Red Hat Enterprise Linux,
Red Hat Enterprise Linux,
Red Hat Enterprise Linux
... (+23)
A path traversal vulnerability exists in rsync. It stems from behavior enabled by the `--inc-recursive` option, a default-enabled option for many client options and can be enabled by the server even if not explicitly enabled by the client. When using the `--inc-recursive` option, a lack of proper sy...
AFFECTED_PRODUCTS:
Red Hat Enterprise Linux,
Red Hat Enterprise Linux,
Samba Rsync
... (+18)
A flaw was found in rsync. It could allow a server to enumerate the contents of an arbitrary file from the client's machine. This issue occurs when files are being copied from a client to a server. During this process, the rsync server will send checksums of local data to the client to compare with...
AFFECTED_PRODUCTS:
Red Hat Enterprise Linux,
Red Hat Enterprise Linux,
Red Hat Enterprise Linux
... (+9)
A flaw was found in rsync which could be triggered when rsync compares file checksums. This flaw allows an attacker to manipulate the checksum length (s2length) to cause a comparison between a checksum and uninitialized memory and leak one byte of uninitialized stack data at a time.
AFFECTED_PRODUCTS:
Red Hat Enterprise Linux,
Red Hat Enterprise Linux,
Samba Rsync
... (+57)
Cross-Site Request Forgery (CSRF), Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - DataTransfer Extension allows Cross Site Request Forgery, Cross-Site Scripting (XSS).This issue affects Mediawiki - DataTra...
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - OpenBadges Extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - OpenBadges Extension: from 1.39.X before 1.39.11, from 1.41.X before 1.4...
A vulnerability was found in SourceCodester Task Reminder System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component Maintenance Section. The manipulation of the argument System Name leads to cross site scripting. The attack can be la...
AFFECTED_PRODUCTS:
Oretnom23 Task Reminder System
A vulnerability was found in Shanghai Lingdang Information Technology Lingdang CRM up to 8.6.0.0. It has been classified as critical. Affected is an unknown function of the file /crm/weixinmp/index.php?userid=123&module=Users&usid=1&action=UsersAjax&minipro_const_type=1&related_module=Singin. The ma...
AFFECTED_PRODUCTS:
51Mis Lingdang Crm
A vulnerability was found in Shanghai Lingdang Information Technology Lingdang CRM up to 8.6.0.0 and classified as critical. This issue affects some unknown processing of the file /crm/weixinmp/index.php?userid=123&module=Users&usid=1&action=UsersAjax&minipro_const_type=1. The manipulation of the ar...
AFFECTED_PRODUCTS:
51Mis Lingdang Crm
A stored cross-site scripting (XSS) vulnerability in Arcadyan Meteor 2 CPE FG360 Firmware ETV2.10 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload.
A remote code execution (RCE) vulnerability in Arcadyan Meteor 2 CPE FG360 Firmware ETV2.10 allows attackers to execute arbitrary code via a crafted request.
IBM MQ 9.3 LTS, 9.3 CD, 9.4 LTS, and 9.4 CD web console could allow a local user to obtain sensitive information when a detailed technical error message is returned.
AFFECTED_PRODUCTS:
IBM Mq,
IBM Mq,
IBM Mq
In Apache Linkis <1.7.0, due to the lack of effective filtering
of parameters, an attacker configuring malicious Mysql JDBC parameters in the DataSource Manager Module will
allow the attacker to read arbitrary files from the Linkis server. Therefore, the parameters in the Mysql JDBC URL should be...
AFFECTED_PRODUCTS:
Apache Linkis
Path Traversal in Ivanti Avalanche before version 6.4.7 allows a remote unauthenticated attacker to bypass authentication. This CVE addresses incomplete fixes from CVE-2024-47010.
AFFECTED_PRODUCTS:
Ivanti Avalanche
Path Traversal in Ivanti Avalanche before version 6.4.7 allows a remote unauthenticated attacker to leak sensitive information. This CVE addresses incomplete fixes from CVE-2024-47011.
AFFECTED_PRODUCTS:
Ivanti Avalanche
Path Traversal in Ivanti Avalanche before version 6.4.7 allows a remote unauthenticated attacker to bypass authentication.
AFFECTED_PRODUCTS:
Ivanti Avalanche
Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.
AFFECTED_PRODUCTS:
Ivanti Endpoint Manager,
Ivanti Endpoint Manager,
Ivanti Endpoint Manager
A race condition in Ivanti Application Control Engine before version 10.14.4.0 allows a local authenticated attacker to bypass the application blocking functionality.
AFFECTED_PRODUCTS:
Ivanti Security Controls,
Ivanti Application Control,
Ivanti Application Control
... (+2)
An access control issue in the component /api/squareComment/DelectSquareById of iceCMS v2.2.0 allows unauthenticated attackers to access sensitive information.
AFFECTED_PRODUCTS:
Thecosy Icecms
An access control issue in the component /square/getAllSquare/circle of iceCMS v2.2.0 allows unauthenticated attackers to access sensitive information.
AFFECTED_PRODUCTS:
Thecosy Icecms
A vulnerability has been found in Shanghai Lingdang Information Technology Lingdang CRM up to 8.6.0.0 and classified as problematic. This vulnerability affects unknown code of the file /crm/weixinmp/index.php?userid=123&module=Users&usid=1&action=UsersAjax&minipro_const_type=1&related_module=Singin....
AFFECTED_PRODUCTS:
51Mis Lingdang Crm
A vulnerability, which was classified as critical, was found in Blog Botz for Journal Theme 1.0 on OpenCart. This affects an unknown part of the file /index.php?route=extension/module/blog_add. The manipulation of the argument image leads to unrestricted upload. It is possible to initiate the attack...
A vulnerability, which was classified as problematic, has been found in libretro RetroArch up to 1.19.1 on Windows. Affected by this issue is some unknown functionality in the library profapi.dll of the component Startup. The manipulation leads to untrusted search path. An attack has to be approache...
A vulnerability classified as problematic was found in Virtual Computer Vysual RH Solution 2024.12.1. Affected by this vulnerability is an unknown functionality of the file /index.php of the component Login Panel. The manipulation of the argument page leads to cross site scripting. The attack can be...
Improper Check for Unusual or Exceptional Conditions vulnerability in Phoenix SecureCoreā¢ for Intel Kaby Lake, Phoenix SecureCoreā¢ for Intel Coffee Lake, Phoenix SecureCoreā¢ for Intel Comet Lake, Phoenix SecureCoreā¢ for Intel Ice Lake allows Input Data Manipulation.This issue affects SecureCoreā¢ for...
AFFECTED_PRODUCTS:
Phoenixtech Securecore Technology,
Phoenixtech Securecore Technology,
Phoenixtech Securecore Technology
... (+1)
Improper Check for Unusual or Exceptional Conditions vulnerability in Phoenix SecureCoreā¢ for Intel Kaby Lake, Phoenix SecureCoreā¢ for Intel Coffee Lake, Phoenix SecureCoreā¢ for Intel Comet Lake, Phoenix SecureCoreā¢ for Intel Ice Lake allows Input Data Manipulation.This issue affects SecureCoreā¢ for...
AFFECTED_PRODUCTS:
Phoenixtech Securecore Technology,
Phoenixtech Securecore Technology,
Phoenixtech Securecore Technology
... (+1)
Sourcecodester House Rental Management system v1.0 is vulnerable to Cross Site Scripting (XSS) in rental/manage_categories.php.
AFFECTED_PRODUCTS:
Mayurik House Rental Management System
APTIOV contains a vulnerability in BIOS where an attacker may cause a TOCTOU Race Condition by local means. Successful exploitation of this vulnerability may lead to execution of arbitrary code on the target device.
AFFECTED_PRODUCTS:
Ami Aptio V
Multiple buffer overflow vulnerabilities exist in the qos.cgi qos_settings() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to stack-based buffer overflow. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A buffer over...
AFFECTED_PRODUCTS:
Wavlink Wl Wn533a8 Firmware
Multiple buffer overflow vulnerabilities exist in the qos.cgi qos_settings() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to stack-based buffer overflow. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A buffer over...
AFFECTED_PRODUCTS:
Wavlink Wl Wn533a8 Firmware
Multiple buffer overflow vulnerabilities exist in the qos.cgi qos_settings() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to stack-based buffer overflow. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A buffer over...
AFFECTED_PRODUCTS:
Wavlink Wl Wn533a8 Firmware
Multiple external config control vulnerabilities exists in the openvpn.cgi openvpn_server_setup() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger these vulnerab...
AFFECTED_PRODUCTS:
Wavlink Wl Wn533a8 Firmware
Multiple external config control vulnerabilities exists in the openvpn.cgi openvpn_server_setup() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger these vulnerab...
AFFECTED_PRODUCTS:
Wavlink Wl Wn533a8 Firmware
Multiple external config control vulnerabilities exists in the openvpn.cgi openvpn_server_setup() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger these vulnerab...
AFFECTED_PRODUCTS:
Wavlink Wl Wn533a8 Firmware
Multiple external config control vulnerabilities exist in the nas.cgi set_nas() proftpd functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to permission bypass. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A configurat...
AFFECTED_PRODUCTS:
Wavlink Wl Wn533a8 Firmware
Multiple external config control vulnerabilities exist in the nas.cgi set_nas() proftpd functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to permission bypass. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A configurat...
AFFECTED_PRODUCTS:
Wavlink Wl Wn533a8 Firmware
Multiple external config control vulnerabilities exist in the nas.cgi set_nas() proftpd functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to permission bypass. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A configurat...
AFFECTED_PRODUCTS:
Wavlink Wl Wn533a8 Firmware
Multiple external config control vulnerabilities exist in the nas.cgi set_ftp_cfg() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially crafted HTTP request can lead to permission bypass. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.A configuration...
AFFECTED_PRODUCTS:
Wavlink Wl Wn533a8 Firmware