CVE Vulnerability Catalog

Podatność CVE-2024-11404 dotyczy django Filer, umożliwiając nieograniczone przesyłanie plików o niebezpiecznych typach oraz niewłaściwe neutralizowanie tagów HTML związanych z skryptami, co prowadzi do podatności na XSS. Problem ten występuje w wersjach od 3 do przed 3.3.

The mediapool feature in Redaxo Core CMS version 5.17.1 is vulnerable to Cross-Site Scripting (XSS). A remote attacker can exploit this vulnerability to escalate privileges within the system.

In the Linux kernel, the enetc driver has a null pointer dereference vulnerability. The issue occurs when enetc_pf_set_vf_mac() is called before vf_state memory is allocated, leading to a system crash.

Podatność CVE-2024-11319 dotyczy niewłaściwej neutralizacji danych wejściowych podczas generowania stron internetowych w django CMS, co pozwala na ataki typu Cross-Site Scripting (XSS). Problem ten występuje w wersjach django-cms: 3.11.7, 3.11.8, 4.1.2 oraz 4.1.3.

A vulnerability in the OAuth-server causes OAuth2 client secrets to be logged when the log level is set to Debug or higher for OIDC/GitHub/GitLab/Google login options.

A vulnerability in UltiMaker Cura versions 4.41, 5.8.1 and earlier allows a local attacker to execute arbitrary code via the Inter-process communication (IPC) mechanism between the Cura application and CuraEngine processes, localhost network stack, printing settings, and G-code processing and transmission components, as well as Ultimaker 3D Printers.

A vulnerability in kodbox version 1.52.04 and earlier allows a remote attacker to obtain sensitive information via the captcha feature in the password reset function.

W podatności CVE-2024-9477 występuje niewłaściwa neutralizacja danych wejściowych podczas generowania stron internetowych w oprogramowaniu AirTies Air4443, co umożliwia ataki typu Cross-Site Scripting (XSS). Problem ten dotyczy oprogramowania Air4443 do 14 października 2024 roku.

In mutt and neomutt, PGP encryption does not use the --hidden-recipient mode which may leak the Bcc email header field by inferring from the recipients info.

In mutt and neomutt the In-Reply-To email header field is not protected by cryptographic signing which allows an attacker to reuse an unencrypted but signed email message to impersonate the original sender.

In neomutt and mutt, the To and Cc email headers are not validated by cryptographic signing which allows an attacker that intercepts a message to change their value and include himself as a one of the recipients to compromise message confidentiality.

A flaw in Ansible-Core allows attackers to bypass unsafe content protections using the hostvars object to reference and execute templated content, leading to arbitrary code execution.

A vulnerability in CloudPanel versions 2.0.0 through 2.4.2 allows low-privilege users to bypass access controls and gain unauthorized access to sensitive configuration files and administrative functionality.

An incorrect access control issue in the HomeServe Home Repair Android app version 3.3.4 allows a physically proximate attacker to escalate privileges via the fingerprint authentication function.

A vulnerability in the Bluetooth Low Energy implementation of Realtek RTL8762E BLE SDK version 1.4.0 allows an attacker to cause a Denial of Service (DoS) by sending a crafted ll_terminate_ind packet.

In 1C-Bitrix Bitrix24 version 23.300.100, a vulnerability was found due to insufficiently protected credentials in DAV server settings. A remote administrator can read Exchange account passwords via an HTTP GET request.

In 1C-Bitrix Bitrix24 version 23.300.100, a vulnerability was found due to insufficiently protected credentials in SMTP server settings. A remote administrator can read SMTP account passwords via an HTTP GET request.

Insufficiently protected credentials in AD/LDAP server settings in 1C-Bitrix Bitrix24 23.300.100 allow remote administrators to send AD/LDAP administrators account passwords to an arbitrary server via HTTP POST request.

In 1C-Bitrix Bitrix24 version 23.300.100, a vulnerability was found due to insufficiently protected credentials in DAV server settings. A remote administrator can read proxy-server account passwords via an HTTP GET request.

In 1C-Bitrix Bitrix24 version 23.300.100, a vulnerability was found due to insufficiently protected credentials in SMTP server settings. A remote administrator can send SMTP account passwords to an arbitrary server via an HTTP POST request.