PT-2024-19832 · Qualcomm · 205 Mobile Platform Firmware +225

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue involves a transient Denial of Service DOS that occurs while decoding an attach reject message received by a UE User Equipment, specifically...

PT-2024-17903 · Ashlar Vellum · Ashlar-Vellum Cobalt

Name of the Vulnerable Software and Affected Versions: Ashlar-Vellum Cobalt affected versions not specified Description: This issue allows remote attackers to execute arbitrary code on affected installations of Ashlar-Vellum Cobalt. User interaction is required to exploit this issue, as the targe...

PT-2024-38270 · Unknown · Youdiancms

Name of the Vulnerable Software and Affected Versions: YouDianCMS version 7 Description: A problematic issue has been found in the processing of the file "/t.php?action=phpinfo", leading to information disclosure. The attack can be initiated remotely. The vendor was contacted about this disclosur...

CVE-2024-41924

Acceptance of extraneous untrusted data with trusted data vulnerability exists in EC-CUBE 4 series. If this vulnerability is exploited, an attacker who obtained the administrative privilege may install an arbitrary PHP package. If the obsolete versions of PHP packages are installed, the product m...

CVE-2024-41924

Acceptance of extraneous untrusted data with trusted data vulnerability exists in EC-CUBE 4 series. If this vulnerability is exploited, an attacker who obtained the administrative privilege may install an arbitrary PHP package. If the obsolete versions of PHP packages are installed, the product m...

CVE-2024-41924

The EC-CUBE 4 series is vulnerable to a security flaw caused by the acceptance of extraneous untrusted data with trusted data (CWE-349 ). The vulnerability occurs because the system improperly validates inputs during the installation of plugins. An attacker who has obtained administrative privile...

JVN#48324254: EC-CUBE 4 Series improper input validation when installing plugins

EC-CUBE 4 series provided by EC-CUBE CO.,LTD improperly validates inputs when installing plugins CWE-349. Impact An attacker who obtained the administrative privilege may install an arbitrary PHP package. If the obsolete versions of PHP packages are installed, the product may be affected by some...

c2pa (>=0.16.1, <=0.19.1), c2patool (>=0.3.9, <=0.5.1) potentially affected by unknown CVE via xmp_toolkit (1.7.3)

xmptoolkit CARGO version 1.7.3 is affected by a known vulnerability. The following packages have a transitive dependency on xmptoolkit and may be impacted: - c2pa =0.16.1, =0.3.9, =0.5.1 Source cves: unknown CVE Source advisory: OSV:GHSA-66FW-43H8-F8P3...

c2pa (>=0.16.1, <=0.19.1), c2patool (>=0.3.9, <=0.5.1) potentially affected by unknown CVE via xmp_toolkit (1.7.3)

xmptoolkit CARGO version 1.7.3 is affected by a known vulnerability. The following packages have a transitive dependency on xmptoolkit and may be impacted: - c2pa =0.16.1, =0.3.9, =0.5.1 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2024-0360...

PT-2024-38051 · Unknown · Nimble Commander

Name of the Vulnerable Software and Affected Versions: Nimble Commander affected versions not specified Description: The issue arises from the server's improper validation of a client's authorization, specifically in the info.filesmanager.Files.PrivilegedIOHelperV2 component. This allows for the...

PT-2024-7521 · Autodesk · Autodesk Autocad

Name of the Vulnerable Software and Affected Versions: Autodesk AutoCAD affected versions not specified Description: A maliciously crafted SLDPRT file can cause a Heap Based Buffer Overflow when parsed in odxsw dll.dll through Autodesk AutoCAD. This issue can be leveraged by a malicious actor to...

Photon OS 4.0: Calico PHSA-2024-4.0-0605

An update of the calico package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2024-4.0-0605. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 3.0: Linux PHSA-2023-3.0-0527

An update of the linux package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2023-3.0-0527. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 5.0: Openresty PHSA-2024-5.0-0185

An update of the openresty package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2024-5.0-0185. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2012-4792 Microsoft Internet Explorer Use-After-Free Vulnerability CVE-2024-39891 Twilio Authy Information Disclosure Vulnerability These types of vulnerabilities a...

CVE-2024-6637

The WooCommerce - Social Login plugin for WordPress is vulnerable to unauthenticated privilege escalation in all versions up to, and including, 2.7.3. This is due to a lack of brute force controls on a weak one-time password. This makes it possible for unauthenticated attackers to brute force the...

CVE-2024-41122 Custom environment variables allow to alter execution flow of plugins in Woodpecker

Woodpecker is a simple yet powerful CI/CD engine with great extensibility. The server allow to create any user who can trigger a pipeline run malicious workflows: 1. Those workflows can either lead to a host takeover that runs the agent executing the workflow. 2. Or allow to extract the secrets w...

CISA Adds Three Known Exploited Vulnerabilities to Catalog

CISA has added three new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2024-34102 Adobe Commerce and Magento Open Source Improper Restriction of XML External Entity Reference XXE Vulnerability CVE-2024-28995 SolarWinds Serv-U Path...

CISA Adds One Known Exploited Vulnerability to Catalog

CISA has added one new vulnerability to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2024-36401 OSGeo GeoServer GeoTools Eval Injection Vulnerability These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose...

Citrix Virtual Apps and Desktop - Configuration, Policies and Security.

Introduction This article is a summary of the top support articles related to Citrix Virtual Apps and Desktop product configuration, compatibility and security. It also provides information related to Citrix Policies: Common issues, configuration and troubleshooting. Top Knowledge Content Securit...