CISCO-SA-20190515-CUIC

creationtimestamp| type| source ---|---|--- 2024-12-17 09:00:35+00:00| seen| https://social.circl.lu/users/vulnerabilitylookup/statuses/113667342696034701...

CISCO-SA-20170927-CC

creationtimestamp| type| source ---|---|--- 2024-12-17 09:00:31+00:00| seen| https://social.circl.lu/users/vulnerabilitylookup/statuses/113667342601123638...

CISCO-SA-20180117-ELM

creationtimestamp| type| source ---|---|--- 2024-12-17 06:41:54+00:00| seen| https://social.circl.lu/users/vulnerabilitylookup/statuses/113666794990072529...

CISCO-SA-20190501-FABRIC

creationtimestamp| type| source ---|---|--- 2024-12-17 06:41:53+00:00| seen| https://social.circl.lu/users/vulnerabilitylookup/statuses/113666794783383554...

CISCO-SA-20180207-CPS

creationtimestamp| type| source ---|---|--- 2024-12-17 06:40:42+00:00| seen| https://social.circl.lu/users/vulnerabilitylookup/statuses/113666792779739071...

Critical Apache Struts File Upload Vulnerability (CVE-2024-53677)—Risks, Implications, and Enterprise Countermeasures

Apache has announced a critical vulnerability affecting Apache Struts CVE-2024-53677, a widely used Java-based web application framework. Struts is integral to many enterprise environments due to its robust architecture, extensive data validation capabilities, and seamless integration with other...

PT-2024-17575 · WordPress · Woocommerce Additional Fees On Checkout

Name of the Vulnerable Software and Affected Versions: WooCommerce Additional Fees On Checkout Free plugin for WordPress versions up to, and including, 1.4.7 Description: The issue is related to Reflected Cross-Site Scripting via the number parameter due to insufficient input sanitization and...

CVE-2024-12698

An incomplete fix for ose-olm-catalogd-container was issued for the Rapid Reset Vulnerability CVE-2023-39325/CVE-2023-44487 where only unauthenticated streams were protected, not streams created by authenticated sources. Mitigation Red Hat Product Security does not have any mitigation...

PT-2024-36328 · Unknown · Gaxx Keywords

Name of the Vulnerable Software and Affected Versions: Gaxx Keywords versions n/a through 0.2 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web application,...

PT-2024-17315 · WordPress · Stripe Donation Plugin

Name of the Vulnerable Software and Affected Versions: Stripe Donation plugin for WordPress versions 1.2.5 and earlier Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'stripe donation' shortcode due to insufficient input sanitization and output escaping on...

SUSE CVE-2024-45337

Applications and libraries which misuse connection.serverAuthenticate via callback field ServerConfig.PublicKeyCallback may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is...

PT-2025-3667 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue arises in the Linux kernel's netfs subsystem, specifically when handling the copy to cache on write-begin operation for ceph filesystems. At the end of netfs unlock read foli...

Ubuntu: Security Advisory (USN-7154-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Beego has Collision Hazards of MD5 in Cache Key Filenames

In the context of using MD5 to generate filenames for cache keys, there are significant collision hazards that need to be considered. MD5, or Message Digest Algorithm 5, is a widely known cryptographic hash function that produces a 128-bit hash value. However, MD5 is no longer considered secure...

GHSA-9J3M-FR7Q-JXFW Beego has Collision Hazards of MD5 in Cache Key Filenames

In the context of using MD5 to generate filenames for cache keys, there are significant collision hazards that need to be considered. MD5, or Message Digest Algorithm 5, is a widely known cryptographic hash function that produces a 128-bit hash value. However, MD5 is no longer considered secure...

Something to Read When You Are On Call and Everyone Else is at the Office Party

Welcome to this week's edition of the Threat Source newsletter. The new head of the UK's National Cyber Security Centre, Richard Horne, recently remarked that there is a "clearly widening gap between, on the one hand, the threat and our exposure to it and, on the other, the defences that are in...

CVE-2024-55601

A flaw was found in the Hugo static site generator. Some HTML attributes in Markdown in the internal templates do not escape in internal render hooks. Hugo users who do not trust their Markdown content files and are using one or more of these templates are impacted; default/markup/render-link.htm...

CVE-2024-47539

A flaw was found in the GStreamer library. An out-of-bounds write in the MP4/MOV demuxer when handling CEA608 Closed Caption tracks can lead to crashes for certain input files. This vulnerability allows a malicious third party to trigger a crash of the application and perform code execution throu...

CVE-2024-47537

A flaw was found in the GStreamer library. An integer overflow in the MP4/MOV demuxer's sample table parser can lead to out-of-bounds writes and NULL-pointer dereferences for certain input files. This vulnerability allows a malicious third party to trigger an application crash and, in the case of...

CVE-2024-11053

A flaw was found in curl. A logic error when processing credentials from the .netrc file while performing redirects allows the transfer of credentials from the original host to the followed-to host under certain circumstances, leaking the credentials to the followed-to host. Mitigation Avoid usin...