CVE-2023-34974

An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network. QuTScloud, QVR, QES are not affected. We have already fixed the vulnerability in the following versions: Q...

BELL-CVE-2024-41052 CVE-2024-41052 does not affect BellSoft software

Bulletin has no description...

BELL-CVE-2024-41024 CVE-2024-41024 does not affect BellSoft software

Bulletin has no description...

CVE-2024-40794

This issue was addressed through improved state management. This issue is fixed in Safari 17.6, iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6. Private Browsing tabs may be accessed without authentication...

Azul Zulu OpenJDK is affected by multiple vulnerabilities.(2024-04-16).

Azul Zulu multiple vulnerabilities as referenced in the 2024-04-16 advisory. Affected CVEs CVE-2023-41993, CVE-2024-21002, CVE-2024-21004, CVE-2024-21003, CVE-2024-21005, CVE-2024-21011, CVE-2024-21012, CVE-2024-21068, CVE-2024-21085, CVE-2024-21094 CVE | Component| Base Score ---|---|---...

phonenumber: panic on parsing crafted phonenumber inputs

Impact The phonenumber parsing code may panic due to a reachable assert! guard on the phonenumber string. In a typical deployment of rust-phonenumber, this may get triggered by feeding a maliciously crafted phonenumber, e.g. over the network, specifically strings of the form...

PT-2024-27463 · Unknown +1 · Oqs-Provider +1

Name of the Vulnerable Software and Affected Versions: oqs-provider versions prior to 0.6.1 Description: The issue arises from the way oqs-provider handles lengths decoded with DECODE UINT32 at the start of serialized hybrid keys and signatures. Unchecked length values are later used for memory...

BELL-CVE-2024-35325 CVE-2024-35325 does not affect BellSoft software

Bulletin has no description...

PT-2024-40477 · Silverstripe · Silverstripe/Framework

Name of the Vulnerable Software and Affected Versions: Silverstripe Framework affected versions not specified Description: The issue allows arbitrary global functions to be executed if malicious user input is passed through as the second argument of ViewableData::renderWith. This occurs when the...

BELL-CVE-2024-36002 CVE-2024-36002 does not affect BellSoft software

Bulletin has no description...

BELL-CVE-2023-52665 CVE-2023-52665 does not affect BellSoft software

Bulletin has no description...

K000139508: rust-openssl vulnerability CVE-2024-3296

Security Advisory Description A timing-based side-channel flaw exists in the rust-openssl package, which could be sufficient to recover a plaintext across a network in a Bleichenbacher-style attack. To achieve successful decryption, an attacker would have to be able to send a large number of tria...

AZL-39968 CVE-2023-6237 affecting package nodejs18 for versions less than 18.20.2-1

Issue summary: Checking excessively long invalid RSA public keys may take a long time. Impact summary: Applications that use the function EVPPKEYpubliccheck to check RSA public keys may experience long delays. Where the key that is being checked has been obtained from an untrusted source this may...

Elastic Security Statement for CVE-2024-3094, xz versions 5.6.0 and 5.6.1

Elastic Products are not affected by this issue. On March 29th, 2024, Elastic became aware of the malicious code planted in the xz package. Elastic has performed an investigation to identify any Elastic Products which may be impacted by this issue and we have concluded that no Elastic products us...

CVE-2024-3400

A command injection as a result of arbitrary file creation vulnerability in the GlobalProtect feature of Palo Alto Networks PAN-OS software for specific PAN-OS versions and distinct feature configurations may enable an unauthenticated attacker to execute arbitrary code with root privileges on the...

PT-2024-23262 · Sap · Sap S/4Hana

Name of the Vulnerable Software and Affected Versions: SAP S/4 HANA affected versions not specified Description: The issue is related to the Cash Management component in SAP S/4 HANA, which fails to perform necessary authorization checks for an authenticated user. This results in an escalation of...

BELL-CVE-2024-26781

Bulletin has no description...

CVE-2024-31211

WordPress is an open publishing platform for the Web. Unserialization of instances of the WPHTMLToken class allows for code execution via its destruct magic method. This issue was fixed in WordPress 6.4.2 on December 6th, 2023. Versions prior to 6.4.0 are not affected...

BELL-CVE-2024-26710

Bulletin has no description...

Check Point Response to Docker Desktop Vulnerabilities

Solution This article provides Check Point response to Docker Desktop vulnerabilities that various vulnerability scanners may show when testing a Check Point Security Gateway / Management Server / Log Server. To exploit a Docker Desktop vulnerability, a malicious actor must have a local access on...