CVE Brief Security Intelligence

Use after free in Media in Google Chrome on Windows prior to 151.

LiquidJS is vulnerable to an infinite loop via a template processing flaw, which can lead to a denial of service.

The SimpleSAMLphp SAML2 library is susceptible to improper certificate validation, potentially allowing attackers to bypass authentication or integrity checks.

Insufficient validation of untrusted input in Passwords in Google Chrome prior to 151.

A Server-side request forgery (SSRF) vulnerability in Microsoft Azure Virtual Machines allows an authenticated attacker to perform unauthorized actions and escalate privileges over a network.

The Form Maker by 10Web plugin is susceptible to second-order SQL injection, allowing authenticated users to execute unauthorized database queries.

The Events Manager WordPress plugin contains a SQL injection vulnerability allowing authenticated users with subscriber-level privileges to modify booking consent records.

The Sony XAV-9500ES is vulnerable to a buffer overflow in its RTSP implementation, which could allow remote code execution.

NoMachine contains a command injection vulnerability in the getstat function, allowing an authenticated attacker to execute arbitrary system commands.

ZenHive mpp is vulnerable to an authentication bypass via a capture-replay attack, allowing unauthenticated attackers to obtain paid resources by resubmitting on-chain transfers.

The WP Photo Album Plus plugin contains a path traversal vulnerability that permits unauthenticated attackers to delete arbitrary ZIP files on the server.

Datiphy Data Management Center contains a missing authentication vulnerability in its upload API, allowing unauthenticated attackers to perform unauthorized file operations.

A prototype pollution vulnerability in the Time Series Visual Builder plugin for OpenSearch Dashboards allows authenticated remote code execution via crafted JSON payloads.

A resource exhaustion vulnerability in the mtrudel bandit library allows unauthenticated remote attackers to cause a denial-of-service via unbounded HTTP/2 stream process pinning.

A heap-based buffer overflow vulnerability in FreeRDP allows remote, unauthenticated attackers to potentially cause a crash or execute arbitrary code.

FreeRDP contains heap-based buffer overflow and integer overflow vulnerabilities that could allow an attacker to execute arbitrary code.

A heap-based buffer overflow vulnerability in FreeRDP may allow a remote attacker to execute arbitrary code.

The Grav API Plugin contains a missing authorization vulnerability that allows authenticated users to access sensitive content.

Talebook (MyBooks) is susceptible to a missing authorization vulnerability that allows authenticated users to perform unauthorized actions.

The Algernon web server is vulnerable to improper handling of Windows Alternate Data Streams, which can lead to unauthorized information disclosure.

A race condition in the Tor networking software allows for potential security bypasses due to improper synchronization of shared resources.

A security vulnerability in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 allows a local authenticated attacker to achieve full system compromise.

An out-of-bounds write vulnerability in IBM AIX 7.2, 7.3 and PowerVM VIOS 4.1 allows an adjacent attacker to potentially execute arbitrary code or crash the system.

IBM AIX and PowerVM VIOS are susceptible to an out-of-bounds write vulnerability, which may allow an adjacent attacker to compromise system integrity and availability.

An out-of-bounds write vulnerability exists in IBM AIX and PowerVM VIOS, potentially allowing a local, authenticated attacker to gain escalated privileges or compromise the system.

IBM AIX and PowerVM VIOS are vulnerable to an out-of-bounds write, which may enable a local, authenticated attacker to achieve unauthorized control over the affected system.

IBM AIX and PowerVM VIOS are susceptible to an out-of-bounds write vulnerability, potentially allowing local attackers to execute arbitrary code with elevated privileges.

Dockge contains a path traversal vulnerability due to improper validation of stack names, which allows authenticated attackers to disclose arbitrary files and delete directories.

LangBot is affected by a command injection vulnerability that allows authenticated attackers to execute arbitrary system commands on the hosting platform.

IBM AIX and PowerVM VIOS are vulnerable to OS command injection, which can be triggered by a local authenticated attacker to execute arbitrary commands on the underlying operating system.

Genian NAC contains vulnerabilities involving improper input validation and exposure of sensitive information through data queries, allowing unauthorized access to internal data.

A vulnerability in libevent allows for an out-of-bounds read, potentially leading to application crashes or denial of service conditions.

An integer overflow vulnerability in libevent could allow remote, unauthenticated attackers to trigger a denial of service condition.

The Gameme module in ATutor 2.2.4 contains an unrestricted file upload vulnerability, allowing authenticated users to upload dangerous file types.

ATutor is vulnerable to a path traversal flaw in its ZIP extraction functionality, allowing authenticated users to manipulate file paths.

A path traversal vulnerability in n8n allows authenticated users to access or modify files outside of intended directories.

n8n is vulnerable to OS command injection, allowing authenticated users to execute arbitrary commands on the underlying system.

Netty is susceptible to an inefficient algorithmic complexity vulnerability that may allow for denial of service.

Logto is vulnerable to a path traversal attack that may allow unauthenticated attackers to access sensitive files.

Wekan is vulnerable to unrestricted file uploads, which could allow authenticated users to execute malicious code.

Akaunting 3.1.21 contains an incorrect authorization vulnerability that allows authenticated users to perform unauthorized actions.

Grav versions prior to 2.0.7 are susceptible to a code injection vulnerability that allows authenticated users to execute arbitrary code.

The J-BusinessDirectory extension for Joomla is vulnerable to resource exhaustion through improper limits on resource allocation, which can lead to denial of service conditions.

The SitemapLoader component in langchain-community versions up to 0.4.2 is vulnerable to Server-Side Request Forgery (SSRF) due to missing domain restrictions on nested sitemap entries.

Shaarli is vulnerable to a stored cross-site scripting (XSS) vulnerability, allowing an unauthenticated attacker to execute arbitrary scripts in the context of a user session.

The iCagenda extension for Joomla contains a cross-site scripting vulnerability that allows authenticated users to inject malicious scripts into web pages.

The Phoca Cart extension for Joomla is susceptible to a cross-site scripting vulnerability that enables unauthenticated attackers to execute malicious scripts via user interaction.

An OS command injection vulnerability in vsDesk allows an authenticated administrator to execute arbitrary operating system commands via insufficient input filtering.

SiYuan note-taking software is vulnerable to cross-site scripting (XSS) that can be escalated to remote code execution (RCE) via unescaped block metadata in hint popups.

SiYuan is susceptible to a Cross-site Scripting vulnerability that can lead to remote code execution.

Stigmem contains an authorization bypass vulnerability allowing authenticated users to access data across tenant boundaries.

IBM AIX 7 and PowerVM VIOS 4.1 are affected by an out-of-bounds write vulnerability that could lead to unauthorized system access or service disruption.

In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment() br_ip6_fragment() gets prevhdr, a pointer into the skb head, from ip6_find_1stfragopt(), then calls skb_checksum_help().

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Fix SPSR_EL2 restore in kvm_hyp_handle_mops() kvm_hyp_handle_mops() resets the single-step state machine as part of rewinding state for a MOPS exception by modifying vcpu_cpsr() and writing the result directly into.

In the Linux kernel, the following vulnerability has been resolved: virtio-net: fix len check in receive_big() receive_big() bounds the device-announced length by (big_packets_num_skbfrags + 1) * PAGE_SIZE.

An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.