CVE-2024-9860

The Bridge Core plugin for WordPress is vulnerable to unauthorized modification of data or loss of data due to a missing capability check on the 'importaction' and 'installpluginperdemo' functions in versions up to, and including, 3.3. This makes it possible for authenticated attackers with...

PT-2024-39892 · WordPress · The Bridge Core

Name of the Vulnerable Software and Affected Versions: The Bridge Core plugin for WordPress versions up to, and including, 3.3 Description: The issue allows authenticated attackers with subscriber-level permissions or above to modify or lose data due to a missing capability check on the import...

CVE-2024-9234

The GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the installandactivatepluginfromexternal function install-active-plugin REST API endpoint in all versions up to,...

Lenovo Dolby Vision Provisioning 安全漏洞

Lenovo Dolby Vision Provisioning is a Dolby Vision Provisioning software from Lenovo China. A security vulnerability exists in Lenovo Dolby Vision Provisioning prior to version 2.0.0.2, which stems from an information disclosure vulnerability that could allow a local attacker to read files on the...

WordPress plugin GutenKit 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

Debian: Security Advisory (DLA-3914-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory (FEDORA-2024-f109ae6fc7)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2024-36409 · Dolby · Dolby Vision Provisioning

Name of the Vulnerable Software and Affected Versions: Dolby Vision Provisioning software versions prior to 2.0.0.2 Description: A potential information disclosure issue was reported in Lenovo's packaging of Dolby Vision Provisioning software that could allow a local attacker to read files on the...

Huawei EulerOS: Security Advisory for openjpeg2 (EulerOS-SA-2024-2561)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

KLA73908 Multiple vulnerabilities in Microsoft Office

Multiple vulnerabilities were found in Microsoft Office. Malicious users can exploit these vulnerabilities to spoof user interface, obtain sensitive information, execute arbitrary code, gain privileges. Below is a complete list of vulnerabilities: 1. A spoofing vulnerability in Microsoft Office c...

Apple Security Update: visionOS 2.0.1

Apple recommends to install security update visionOS 2.0.1 on devices Apple Vision Pro...

Apple Security Update: macOS Sequoia 15.0.1

Apple recommends to install security update macOS Sequoia 15.0.1 on devices macOS Sequoia...

Security Bulletin: NVIDIA Triton Inference Server - September 2024

NVIDIA has released a software update for NVIDIA Triton Inference Server to address the issue disclosed in this bulletin. To protect your system, install the latest release from the Triton Inference Server Releases page on GitHub, and view the Secure Deployment Considerations Guide. Go to NVIDIA...

Mageia: Security Advisory (MGASA-2024-0318)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian: Security Advisory (DSA-5775-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Vulnerabilities fixed in Apple macOS

Apple fixed vulnerabilities in macOS A malicious party can exploit the vulnerabilities to carry out attacks that can lead to the following categories of damage: - Denial-of-Service DoS - Manipulation of data - Circumvention of security measure - Access to sensitive data - Access to system data Fo...

Vite's `server.fs.deny` is bypassed when using `?import&raw`

Summary The contents of arbitrary files can be returned to the browser. Details @fs denies access to files outside of Vite serving allow list. Adding ?import&raw to the URL bypasses this limitation and returns the file content if it exists. PoC sh $ npm create vite@latest $ cd vite-project/ $ npm...

CVE-2024-42501

ArubaOS is affected by an authenticated Path Traversal vulnerability (CVE-2024-42501). The issue allows a remote attacker, with network access and high privileges, to install unsigned packages on the underlying OS and execute arbitrary code or implant software. The vulnerability source is ArubaOS...

RHSA-2019:2137 Red Hat Security Advisory: keycloak-httpd-client-install security, bug fix, and enhancement update

Bulletin has no description...

Vulnerability fixed in Rockwell Automation ThinManager

Rockwell Automation has fixed a vulnerability in ThinManager. A malicious party could exploit the vulnerability to install software on the vulnerable system to execute arbitrary code. Rockwell Automation has released updates to fix the vulnerability. See attached references for more information...