PT-2024-2494 · Tenda · Tenda Ac7

Name of the Vulnerable Software and Affected Versions: Tenda AC7 version 15.03.06.44 Description: A critical issue was found in the saveParentControlInfo function of the /goform/saveParentControlInfo file, which is related to a stack-based buffer overflow. This can be exploited remotely by...

PT-2024-40668 · Git +1 · Libxaac

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: A heap-buffer-overflow read issue was identified, as reported by OSS-Fuzz. The crash type is Heap-buffer-overflow READ 1, and it occurs in the ixaac enco...

PT-2024-22609 · Symfony +1 · Symfony1 +1

Name of the Vulnerable Software and Affected Versions: Symfony1 versions 1.3.0 through 1.5.17 Description: This issue is related to a gadget chain in Symfony1 due to a vulnerable Swift Mailer dependency. The vulnerability allows an attacker to achieve remote code execution if a developer...

WordPress Automatic Plugin <= 3.92.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software Automatic Type Plugin Vulnerable versions = 3.92.0 Fixed in 3.92.1 OWASP Top 10 A8: Cross Site Request Forgery CSRF Classification Cross Site Request Forgery CSRF CVE CVE-2024-27955 Patch priority Low CVSS severity Low 8.8 Developer Claim ownership PSID cf1662afb1ce Credits Rafie Muhamma...

PT-2024-2121 · Microsoft · Windows Graphics +1

Name of the Vulnerable Software and Affected Versions: Windows Graphics Component affected versions not specified Description: The issue is related to insufficient access restrictions in the Windows Graphics Component, allowing an attacker to elevate their privileges. This can affect the system,...

PT-2024-12247 · Unknown · Gotham Gaia

Name of the Vulnerable Software and Affected Versions: Gotham Gaia affected versions not specified Description: A stored cross-site scripting XSS issue was discovered, allowing an attacker to bypass Content Security Policy CSP and achieve a persistent cross-site scripting payload. Recommendations...

PT-2024-2158 · Microsoft · Skype For Consumer

Name of the Vulnerable Software and Affected Versions: Skype for Consumer affected versions not specified Description: The issue is related to insufficient input validation, allowing a remote attacker to execute arbitrary code. Exploitation may require user action, such as visiting a malicious...

PT-2024-2104 · Microsoft · Windows Usb Print Driver +1

Name of the Vulnerable Software and Affected Versions: Windows USB Print Driver affected versions not specified Description: The issue is related to insufficient access restrictions in the Windows USB Print Driver, allowing an attacker to potentially elevate their privileges. There is no...

PT-2024-2285 · Microsoft · Alljoyn Api +1

Name of the Vulnerable Software and Affected Versions: Microsoft AllJoyn API versions affected versions not specified Description: The issue is related to insufficient input validation in the AllJoyn API implementation, which can lead to a denial-of-service condition. This can be exploited by a...

PT-2024-2122 · Microsoft · Windows Installer +1

Name of the Vulnerable Software and Affected Versions: Windows Installer affected versions not specified Description: The issue is related to insufficient access control in the Windows operating system installer, allowing an attacker to elevate their privileges. This can affect the system,...

PT-2024-2149 · Microsoft +1 · Visual Studio Code +1

Name of the Vulnerable Software and Affected Versions: Visual Studio Code affected versions not specified Description: The issue is related to insufficient access restrictions in the editor, allowing a remote attacker to potentially elevate their privileges. Recommendations: At the moment, there ...

PT-2024-2287 · Microsoft · Defender

Name of the Vulnerable Software and Affected Versions: Microsoft Defender affected versions not specified Description: The issue is related to errors in security settings, allowing an attacker to bypass existing security restrictions using a specially crafted file. Recommendations: At the moment,...

PT-2024-40656 · Git +1 · Gpac

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a heap-buffer-overflow read error. Technical details include the crash type and state, which involve functions such as gf...

PT-2024-13353 · Undefined · Undefined

Name of the Vulnerable Software and Affected Versions: No information is available about the vulnerable software and its affected versions. Description: The issue was initially discovered and potentially associated with a specific identifier, but details about the issue itself, such as its nature...

Design/Logic Flaw

go-zero is a web and rpc framework. Go-zero allows user to specify a CORS Filter with a configurable allows param - which is an array of domains allowed in CORS policy. However, the isOriginAllowed uses strings.HasSuffix to check the origin, which leads to bypass via a malicious domain. This...

PT-2024-20751 · Appsamvid · Appsamvid

Name of the Vulnerable Software and Affected Versions: AppSamvid affected versions not specified Description: The issue exists due to the usage of vulnerable and outdated components in the software. An attacker with local administrative privileges could exploit this by placing malicious DLLs on t...

PT-2024-4187 · Unknown · Svacer Sast

Name of the Vulnerable Software and Affected Versions: Svacer SAST affected versions not specified Description: The issue is related to insecure handling of parameters when creating short links. This can be exploited by a remote attacker to redirect users to an arbitrary URL. Recommendations: At...

PT-2024-40962 · Gtk-Rs · Gtk-Rs

Name of the Vulnerable Software and Affected Versions: gtk-rs affected versions not specified Description: The gtk-rs GTK3 bindings are no longer maintained. The maintainers have archived the repository and added a note to the crate description and its README.md that the crates are no longer...

PT-2024-40957 · Gtk-Rs · Gtk-Rs

Name of the Vulnerable Software and Affected Versions: gtk-rs affected versions not specified Description: The gtk-rs GTK3 bindings are no longer maintained. The maintainers have archived the repository and added a note to the crate description and its README.md that the crates are no longer...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in Perl HTTP [CVE-2023-31486]

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to a denial of service in Perl HTTP Tiny module, caused by the failure to verify TLS certificates by default and requiring users to opt in to verify certificates CVE-2023-31486. Perl HTTP is used as a component ...