There's a flaw in src/lib/openjp2/pi.c of openjpeg in versions prior to 2.4.0. If an attacker is able to provide untrusted input to openjpeg's conversion/encoding functionality they could cause an out-of-bounds read. The highest impact of this flaw is to application availability.

...

CVE-2024-39126

Roundup before 2.4.0 allows XSS via JavaScript in PDF, XML, and SVG documents...

CVE-2024-39124

In Roundup before 2.4.0, classhelpers generic.help.html allow XSS...

CVE-2024-39126

Roundup before 2.4.0 allows XSS via JavaScript in PDF, XML, and SVG documents...

CVE-2024-39125

Roundup before 2.4.0 allows XSS via a SCRIPT element in an HTTP Referer header...

CVE-2024-39126

Roundup before 2.4.0 allows XSS via JavaScript in PDF, XML, and SVG documents...

CVE-2024-39125

Roundup before 2.4.0 allows XSS via a SCRIPT element in an HTTP Referer header...

CVE-2024-39126

Roundup before 2.4.0 allows XSS via JavaScript in PDF, XML, and SVG documents...

PT-2024-28355 · Roundup · Roundup

Name of the Vulnerable Software and Affected Versions: Roundup versions prior to 2.4.0 Description: The issue allows for cross-site scripting XSS via a SCRIPT element in an HTTP Referer header. Recommendations: For versions prior to 2.4.0, update to version 2.4.0 or later to resolve the issue...

CVE-2024-39125

Roundup before 2.4.0 allows XSS via a SCRIPT element in an HTTP Referer header...

CVE-2024-39126

CVE-2024-39126 : The vulnerability affects Roundup prior to 2.4.0, enabling cross-site scripting through JavaScript in PDF, XML, and SVG documents. The description and connected records confirm the issue, but do not provide exploitation details, affected vendor-specific patch versions, or concret...

CVE-2024-39124

CVE-2024-39124 affects Roundup before 2.4.0 due to improper sanitization in classhelpers (_generic.help.html), enabling Cross‑Site Scripting (XSS). Root cause: insufficient input sanitization. Impact: potential XSS; exploitation details are not provided in the supplied documents. Remediation: upg...

CVE-2024-39126

Roundup before 2.4.0 allows XSS via JavaScript in PDF, XML, and SVG documents...

CVE-2024-39124

In Roundup before 2.4.0, classhelpers generic.help.html allow XSS...

PT-2024-28354 · Roundup · Roundup

Name of the Vulnerable Software and Affected Versions: Roundup versions prior to 2.4.0 Description: The issue allows XSS in classhelpers, specifically in generic.help.html. Recommendations: For versions prior to 2.4.0, update to version 2.4.0 or later to resolve the issue...

OPENSUSE-SU-2024:14170-1 ruby3.3-rubygem-kramdown-2.4.0-1.12 on GA media

These are all security issues fixed in the ruby3.3-rubygem-kramdown-2.4.0-1.12 package on the GA media of openSUSE Tumbleweed...

Exploit for Code Injection in Rejetto Http_File_Server

An unauth SSTI in the Rejetto HTTP File Server HFS. Original...

AZL-42942 CVE-2024-6104 affecting package keda for versions less than 2.4.0-22

go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file. This could lead to go-retryablehttp writing sensitive HTTP basic auth credentials to its log file. This vulnerability, CVE-2024-6104, was fixed in go-retryablehttp 0.7.7...

PrestaShop Security Breach

PrestaShop is an open source e-commerce solution from the American company PrestaShop. The solution offers multiple payment methods, SMS alerts, and product image zoom, among other features. A security vulnerability exists in PrestaShop helpdesk version 2.4.0 and prior versions, which stems from...

PT-2024-26282 · Unknown · Fme Modules For Prestashop

Name of the Vulnerable Software and Affected Versions: FME Modules for PrestaShop helpdesk module versions up to 2.4.0 Description: The issue allows attackers to obtain sensitive information and cause other impacts. It is related to the Tickets::getsearchedtickets function. Recommendations: For...