PowerPack Addons For Elementor (Free Widgets, Extensions And Templates) Security Vulnerabilities

Tuesday, July 2, 2024 Security Releases

Summary The Node.js project will release new versions of the 22.x, 20.x, 18.x releases lines on or shortly after, Tuesday, July 2, 2024 in order to address: 1 high severity issues. 2 medium severity issues. 3 low severity issues. Node.js fetch will be upgraded to undici v6.19.2 on Node.js 18.x...

CVE-2024-38532

The NXP Data Co-Processor (DCP) is a built-in hardware module for specific NXP SoCs¹ that implements a dedicated AES cryptographic engine for encryption/decryption operations. The dcp_tool reference implementation included in the repository selected the test key, regardless of its -t argument....

CVE-2024-38532

The NXP Data Co-Processor (DCP) is a built-in hardware module for specific NXP SoCs¹ that implements a dedicated AES cryptographic engine for encryption/decryption operations. The dcp_tool reference implementation included in the repository selected the test key, regardless of its -t argument....

CVE-2024-38525

dd-trace-cpp is the Datadog distributed tracing for C++. When the library fails to extract trace context due to malformed unicode, it logs the list of audited headers and their values using the nlohmann JSON library. However, due to the way the JSON library is invoked, it throws an uncaught...

CVE-2024-38525

dd-trace-cpp is the Datadog distributed tracing for C++. When the library fails to extract trace context due to malformed unicode, it logs the list of audited headers and their values using the nlohmann JSON library. However, due to the way the JSON library is invoked, it throws an uncaught...

CVE-2024-38532 TEST_KEY used in example dcp_tool reference implementation

The NXP Data Co-Processor (DCP) is a built-in hardware module for specific NXP SoCs¹ that implements a dedicated AES cryptographic engine for encryption/decryption operations. The dcp_tool reference implementation included in the repository selected the test key, regardless of its -t argument....

CVE-2024-38518

BigBlueButton is an open-source virtual classroom designed to help teachers teach and learners learn. An attacker with a valid join link to a meeting can trick BigBlueButton into generating a signed join link with additional parameters. One of those parameters may be "role=moderator", allowing an.....

CVE-2024-39302

BigBlueButton is an open-source virtual classroom designed to help teachers teach and learners learn. An attacker may be able to exploit the overly elevated file permissions in the /usr/local/bigbluebutton/core/vendor/bundle/ruby/2.7.0/gems/resque-2.6.0 directory with the goal of privilege...

CVE-2024-38518

BigBlueButton is an open-source virtual classroom designed to help teachers teach and learners learn. An attacker with a valid join link to a meeting can trick BigBlueButton into generating a signed join link with additional parameters. One of those parameters may be "role=moderator", allowing an.....

CVE-2024-39302

BigBlueButton is an open-source virtual classroom designed to help teachers teach and learners learn. An attacker may be able to exploit the overly elevated file permissions in the /usr/local/bigbluebutton/core/vendor/bundle/ruby/2.7.0/gems/resque-2.6.0 directory with the goal of privilege...

CVE-2024-29040

This repository hosts source code implementing the Trusted Computing Group's (TCG) TPM2 Software Stack (TSS). The JSON Quote Info returned by Fapi_Quote has to be deserialized by Fapi_VerifyQuote to the TPM Structure TPMS_ATTEST. For the field TPM2_GENERATED magic of this structure any number can.....

CVE-2024-29040

This repository hosts source code implementing the Trusted Computing Group's (TCG) TPM2 Software Stack (TSS). The JSON Quote Info returned by Fapi_Quote has to be deserialized by Fapi_VerifyQuote to the TPM Structure TPMS_ATTEST. For the field TPM2_GENERATED magic of this structure any number can.....

CVE-2024-29040

This repository hosts source code implementing the Trusted Computing Group's (TCG) TPM2 Software Stack (TSS). The JSON Quote Info returned by Fapi_Quote has to be deserialized by Fapi_VerifyQuote to the TPM Structure TPMS_ATTEST. For the field TPM2_GENERATED magic of this structure any number can.....

CVE-2024-29040

This repository hosts source code implementing the Trusted Computing Group's (TCG) TPM2 Software Stack (TSS). The JSON Quote Info returned by Fapi_Quote has to be deserialized by Fapi_VerifyQuote to the TPM Structure TPMS_ATTEST. For the field TPM2_GENERATED magic of this structure any number can.....

CVE-2024-38525 dd-trace-cpp malformed unicode header values may cause crash

dd-trace-cpp is the Datadog distributed tracing for C++. When the library fails to extract trace context due to malformed unicode, it logs the list of audited headers and their values using the nlohmann JSON library. However, due to the way the JSON library is invoked, it throws an uncaught...

GHSA-95PR-FXF5-86GV vulnerabilities

Vulnerabilities for packages: skaffold, policy-controller, wolfictl, apko, slsa-verifier, goreleaser, flux-source-controller, neuvector-sigstore-interface, aactl, falcoctl, tkn, tekton-chains, ko, spire-server, vexctl, gitsign, zarf, kubescape, zot, falco,...

CVE-2024-29018 vulnerabilities

Vulnerabilities for packages: trivy, dagger, prometheus, kaniko, wolfictl, ctop, telegraf, kargo, goreleaser, crossplane, aactl, cadvisor, tkn, up, syft, ko, spire-server, buf, buildkitd, docker-compose, grype, conftest, kubescape, loki, zot, datadog-agent,...

GHSA-2C7C-3MJ9-8FQH vulnerabilities

Vulnerabilities for packages: vault, istio-pilot-discovery, kots, sops, cloudflared, kyverno, slsa-verifier, oauth2-proxy, argo-workflows, cosign, tekton-pipelines, flux-source-controller, aactl, external-secrets-operator, argo-cd, tkn, fulcio, tekton-chains, spire-server, terragrunt, vexctl,...

GHSA-JQ35-85CJ-FJ4P vulnerabilities

Vulnerabilities for packages: skaffold, prometheus, k3d, ctop, slsa-verifier, k3s, bom, paranoia, goreleaser, tekton-pipelines, aactl, kpt, up, tekton-chains, scorecard, cert-manager, kubescape, loki, chartmuseum,...

GHSA-MQ39-4GV4-MVPX vulnerabilities

Vulnerabilities for packages: trivy, dagger, prometheus, kaniko, wolfictl, ctop, telegraf, kargo, goreleaser, crossplane, aactl, cadvisor, tkn, up, syft, ko, spire-server, buf, buildkitd, docker-compose, grype, conftest, kubescape, loki, zot, datadog-agent,...

CVE-2023-45289 vulnerabilities

Vulnerabilities for packages: aws-flb-firehose, configmap-reload, nuclei, k8sgpt, dagger, flannel-cni-plugin, secrets-store-csi-driver-provider-gcp, velero, temporal-ui-server, kaf, wireguard-go, wazero, k8ssandra-operator, aws-ebs-csi-driver, nri-discovery-kubernetes, nri-couchbase,...

GHSA-8R3F-844C-MC37 vulnerabilities

Vulnerabilities for packages: configmap-reload, nuclei, k8sgpt, dagger, secrets-store-csi-driver-provider-gcp, velero, temporal-ui-server, kaf, k8ssandra-operator, aws-ebs-csi-driver, nri-discovery-kubernetes, guac, capslock, kaniko, sops, temporal, filebeat, kubernetes-dns-node-cache,...

CVE-2024-27304 vulnerabilities

Vulnerabilities for packages: trillian, step-ca, keda, temporal-server, telegraf, vault, ferretdb, kube-bench, src, kine, k3s, caddy, spicedb, amass, argo-workflows,...

GHSA-MRWW-27VC-GGHV vulnerabilities

Vulnerabilities for packages: trillian, step-ca, keda, temporal-server, telegraf, vault, ferretdb, kube-bench, src, kine, k3s, caddy, spicedb, amass, argo-workflows,...

GHSA-232P-VWFF-86MP vulnerabilities

Vulnerabilities for packages: apko, helm, ctop, up, ko, bom,...

GHSA-X32M-MVFJ-52XV vulnerabilities

Vulnerabilities for packages:...

GHSA-9766-5277-J5HR vulnerabilities

Vulnerabilities for packages:...

CVE-2023-3955 vulnerabilities

Vulnerabilities for packages: argo-cd, cluster-autoscaler, calico,...

CVE-2023-46402 vulnerabilities

Vulnerabilities for packages: pulumi-kubernetes-operator, flux-notification-controller, argo-cd, argo-workflows,...

CVE-2023-38470 vulnerabilities

Vulnerabilities for packages:...

GHSA-5QM6-J92F-79JP vulnerabilities

Vulnerabilities for packages:...

GHSA-797F-63WG-8CHV vulnerabilities

Vulnerabilities for packages: aws-cli-v2,...

GHSA-JM46-725R-HH9V vulnerabilities

Vulnerabilities for packages: aws-cli-v2,...

CVE-2024-3177 vulnerabilities

Vulnerabilities for packages: node-feature-discovery, kubernetes-csi-driver-hostpath, kubernetes, calico, local-static-provisioner, kubernetes-dns-node-cache, nodetaint, aws-ebs-csi-driver, cluster-autoscaler, ip-masq-agent,...

CVE-2024-26130 vulnerabilities

Vulnerabilities for packages: ggshield, py3-cryptography, az, py3-cassandra-medusa,...

CVE-2022-3736 vulnerabilities

Vulnerabilities for packages:...

CVE-2024-3154 vulnerabilities

Vulnerabilities for packages: wolfictl,...

GHSA-C5PJ-MQFH-RVC3 vulnerabilities

Vulnerabilities for packages: wolfictl,...

CVE-2024-23652 vulnerabilities

Vulnerabilities for packages: kaniko, buildkitd, trivy, skaffold, docker, conftest, scorecard, kubescape, zot, datadog-agent,...

CVE-2023-31130 vulnerabilities

Vulnerabilities for packages:...

CVE-2024-35242 vulnerabilities

Vulnerabilities for packages:...

GHSA-CF7P-GM2M-833M vulnerabilities

Vulnerabilities for packages:...

CVE-2021-36213 vulnerabilities

Vulnerabilities for packages: consul,...

CVE-2021-38698 vulnerabilities

Vulnerabilities for packages: consul,...

GHSA-6HW5-6GCX-PHMW vulnerabilities

Vulnerabilities for packages: consul,...

GHSA-Q6H7-4QGW-2J9P vulnerabilities

Vulnerabilities for packages: consul,...

CVE-2023-43618 vulnerabilities

Vulnerabilities for packages:...

CVE-2023-43620 vulnerabilities

Vulnerabilities for packages:...

CVE-2023-43621 vulnerabilities

Vulnerabilities for packages:...

CVE-2022-23471 vulnerabilities

Vulnerabilities for packages:...