CVE Brief Security Intelligence

The Easy Elements for Elementor – Addons & Website Templates plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1

A heap buffer overflow vulnerability exists in the Chromecast component of Google Chrome on Android, Linux, and ChromeOS, potentially allowing for memory corruption.

The Open ISES Tickets integration within Google services contains a vulnerability in versions prior to 3, which may expose sensitive information or permit unauthorized actions.

An origin validation error vulnerability in the Trend Micro Apex One (mac) agent iCore service could allow a local attacker to escalate privileges on affected installations

A type confusion vulnerability in the GFX component of Google Chrome on Linux and ChromeOS prior to version 148 may lead to unexpected application behavior.

Yii 2 is a PHP application framework

The WP ERP Pro plugin for WordPress is vulnerable to SQL Injection via the 'search_key' parameter in all versions up to, and including, 1

A vulnerability in LiteLLM prior to version 1 allows for potential unauthorized actions or information disclosure within the platform.

The Cost of Goods by PixelYourSite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'csvdata[0][cost_of_goods_value]' parameter in versions up to, and including, 1

A potential security vulnerability has been identified in the HP Linux Imaging and Printing Software

Dell PowerFlex Manager, version(s) <=4

In Splunk Enterprise versions below 10

Open ISES Tickets before 3

Open ISES Tickets before 3

Open ISES Tickets before 3

Open ISES Tickets before 3

Zohocorp ManageEngine ADSelfService Plus version before 6525, DataSecurity Plus before 6264 and RecoveryManager Plus before 6313 are vulnerable to Authenticated Remote code execution in the agent machines due to the bug in the 3rd party dependency

Multiple flaws have been identified in `named` related to the handling of DNS messages whose CLASS is not Internet (`IN`) — for example, `CHAOS` or `HESIOD`, or DNS messages that specify meta-classes (`ANY` or `NONE`) in the question section

Buffer Overflow vulnerability in EPSON L14150 FL27PB allows a remote attacker to execute arbitrary code via the RAW Printing Service (JetDirect) on TCP port 9100

Open ISES Tickets before 3

Open ISES Tickets before 3

BIND servers that are configured to use TKEY-based authentication via GSS-API tokens are vulnerable to excessive memory consumption when receiving and processing maliciously-constructed packets

The ConnectWise Automate™ Agent does not fully verify the authenticity of components obtained during plugin loading and self-update operations

A use-after-free vulnerability exists within the DNS-over-HTTPS implementation

Improper input validation, Unrestricted upload of file with dangerous type vulnerability in Gmission Web Fax allows Remote Code Inclusion

ptrace(PT_SC_REMOTE) failed to properly validate parameters for the syscall(2) and __syscall(2) meta-system calls

A link following vulnerability in the Trend Micro Apex One scan engine could allow a local attacker to escalate privileges on affected installations

An origin validation error vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected installations

A time-of-check time-of-use vulnerability in the Trend Micro Apex One (mac) agent cache mechanism could allow a local attacker to escalate privileges on affected installations

An origin validation error vulnerability in the Trend Micro Apex One (mac) agent self-protection mechanism could allow a local attacker to escalate privileges on affected installations

MediaArea MediaInfoLib LXF element parsing heap-based buffer overflow vulnerability

libcasper(3) communicates with helper processes via UNIX domain sockets, and uses the select(2) system call to wait for data to become available

IINA before 1

LiteLLM prior to 1

An authentication bypass vulnerability in Netatalk 2

Mattermost versions 11

The setcred(2) system call is only available to privileged users

A file descriptor can be closed while a thread is blocked in a poll(2) or select(2) call waiting for that descriptor

An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations

An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations

An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations

An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations

An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations

An origin validation vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations

A time-of-check time-of-use vulnerability in the Apex One/SEP agent could allow a local attacker to escalate privileges on affected installations

A malicious actor with access to the network and low privileges could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the underlying system that could be manipulated to obtain sensitive information

A flaw was found in 389-ds-base

Undefined behavior may result due to a race condition leading to a use-after-free violation

Crypt::SaltedHash versions through 0

nimiq-blockchain provides persistent block storage for Nimiq's Rust implementation

An out-of-bounds write due to improper null termination in convert_charset() in Netatalk 2

Netatalk 2

A logic error involving bitwise OR operations in Netatalk 3

An integer underflow in dsi_writeinit() in Netatalk 1

A missing output length bounds check in pull_charset_flags() in Netatalk 2

Insufficient Validation of Autoprimary SOA Queries

When bsdinstall or bsdconfig are prompted to scan for nearby Wi-Fi networks, they build up a list of network names and use bsddialog(1) to prompt the user to select a network

Authorization bypass through User-Controlled key vulnerability in PosCube Hardware Software and Consulting Ltd

Authen::TOTP versions before 0

Netatalk 1

Incorrect Privilege Assignment vulnerability in Mesalvo Meona Client Launcher Component, Mesalvo Meona Server Component enables the export  of user data, including cleartext passwords, via the SQL editor

An out-of-bounds read in ASP session ID handling in Netatalk 1

Multiple heap out-of-bounds reads in the Spotlight RPC unmarshalling code in Netatalk 3

Exposure of private personal information to an unauthorized actor, Insufficiently Protected Credentials vulnerability in Digital Operations Services Inc