PT-2024-31656

Name of the Vulnerable Software and Affected Versions: Apache NiFi versions 1.10.0 through 1.27.0 Apache NiFi versions 2.0.0-M1 through 2.0.0-M3 Description: The vulnerability allows an authenticated user, authorized to configure a Parameter Context, to enter arbitrary JavaScript code in the...

PT-2024-32705 · WordPress · Helpiewp Accordion & Faq

Name of the Vulnerable Software and Affected Versions: HelpieWP Accordion & FAQ – Helpie WordPress Accordion FAQ Plugin versions 1.27 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows...

WordPress FAQ / Accordion / Docs – Helpie WordPress FAQ Accordion plugin plugin <= 1.27 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by 0tter Patchstack Alliance in WordPress Plugin Helpie FAQ versions = 1.27...

WordPress Accordion & FAQ – Helpie WordPress Accordion FAQ Plugin Plugin <= 1.27 is vulnerable to Cross Site Scripting (XSS)

Software Accordion & FAQ – Helpie WordPress Accordion FAQ Plugin Type Plugin Vulnerable versions = 1.27 Fixed in 1.28 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-47647 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID aac881dee8e9 Credits...

OPENSUSE-SU-2024:14173-1 ruby3.3-rubygem-multi_xml-0.6.0-1.27 on GA media

These are all security issues fixed in the ruby3.3-rubygem-multixml-0.6.0-1.27 package on the GA media of openSUSE Tumbleweed...

Security Bulletin: IBM Cloud Kubernetes Service is affected by a Kubernetes API server security vulnerability (CVE-2024-3177)

Summary IBM Cloud Kubernetes Service is affected by a security vulnerability in the Kubernetes API server that may allow mountable secret policy enforcement to be bypassed during pod admission CVE-2024-3177. Vulnerability Details CVEID: CVE-2024-3177 Description: Kubernetes kube-apiserver could...

CVE-2024-27304 vulnerabilities

Vulnerabilities for packages: step, trillian-fips, falcosidekick-fips, amass, caddy, argo-workflows, step-ca, trillian, k3s, wavefront-collector-for-kubernetes, ferretdb, spicedb, src, kots, caddy-fips, temporal-server-fips, temporal-server, argo-workflows-fips, kine, kube-bench-fips, kube-bench...

GHSA-7JWH-3VRQ-Q3M8 vulnerabilities

Vulnerabilities for packages: step, trillian-fips, falcosidekick-fips, amass, caddy, argo-workflows, step-ca, trillian, k3s, wavefront-collector-for-kubernetes, ferretdb, spicedb, src, kots, caddy-fips, temporal-server-fips, temporal-server, argo-workflows-fips, kine, kube-bench-fips, kube-bench...

CVE-2024-21626 vulnerabilities

Vulnerabilities for packages: kaniko, buildkitd, zot, grype, k3s, skaffold, podman, nerdctl, cadvisor, kots, docker, trivy, newrelic-infrastructure-agent, syft, zarf, k9s, wolfictl, k3d, kubernetes, runc, ctop, kubescape, skopeo...

WordPress Republish Old Posts Plugin <= 1.21 is vulnerable to Cross Site Request Forgery (CSRF)

Software Republish Old Posts Type Plugin Vulnerable versions = 1.21 Fixed in 1.27 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-52145 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 5a397512a40f Credits Skalucy Required...

Command injection

Dasan Networks - W-Web versions 1.22-1.27 - CWE-78: Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection'...

CVE-2023-42495 Dasan Networks - W-Web versions 1.22-1.27 - CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Dasan Networks - W-Web versions 1.22-1.27 - CWE-78: Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection'...

Dasan W-Web OS Command Injection Vulnerability

Dasan W-Web is a network appliance from Dasan. An operating system command injection vulnerability exists in Dasan W-Web versions 1.22-1.27, which stems from the presence of an operating system command injection vulnerability...

GHSA-HQ6Q-C2X6-HMCH vulnerabilities

Vulnerabilities for packages: nodetaint, spark-operator, prometheus-adapter, ip-masq-agent, kubernetes-dns-node-cache, aws-efs-csi-driver...

GHSA-M425-MQ94-257G vulnerabilities

Vulnerabilities for packages: spark-operator, kubevela, scorecard, aactl, kubeflow, up, buildkitd, dgraph, terraform-provider-sendgrid, kubescape, k3d, src, cortex, slsa-verifier...

GHSA-QPPJ-FM5R-HXR3 vulnerabilities

Vulnerabilities for packages: dex, pulumi, kaf, conftest, nodetaint, prometheus-adapter, bom, aactl, certificate-transparency, hugo, git-lfs, kubescape, src, pulumi-kubernetes-operator, cortex, gke-gcloud-auth-plugin, dynamic-localpv-provisioner, kubewatch, rqlite, k3d, ko, nri-prometheus,...

SUSE CVE-2023-33863

SerialiseValue in RenderDoc before 1.27 allows an Integer Overflow with a resultant Buffer Overflow. 0xffffffff is sign-extended to 0xffffffffffffffff SIZEMAX and then there is an attempt to add 1...

PT-2023-24519 · Renderdoc · Renderdoc

Name of the Vulnerable Software and Affected Versions: RenderDoc versions prior to 1.27 Description: The issue arises from an integer overflow in the SerialiseValue function, which leads to a buffer overflow. This occurs when the value 0xffffffff is sign-extended to 0xffffffffffffffff SIZE MAX an...

PT-2023-24520 · Renderdoc · Renderdoc

Name of the Vulnerable Software and Affected Versions: RenderDoc versions prior to 1.27 Description: The issue is related to an Integer Overflow that results in a Buffer Overflow. This occurs because the StreamReader::ReadFromExternal function in RenderDoc uses uint32 tm BufferSize-m InputSize ev...

CVE-2023-33865

CVE-2023-33865 series in RenderDoc : Open-source graphics debugger RenderDoc before 1.27 is vulnerable to a symlink-based local privilege escalation in /tmp/RenderDoc. This is part of a trio of issues (CVE-2023-33863, CVE-2023-33864, CVE-2023-33865) that also include integer overflow/underflow le...