Vulnerabilities fixed in Ivanti Connect Secure and Policy Secure

Ivanti has fixed a vulnerability in Connect Secure and Policy Secure. UPDATE: POC code is now available online for this vulnerability. An authenticated malicious person with access to the admin portal of Connect Secure or Policy Secure can exploit the vulnerability to execute code remotely. Ivant...

PT-2024-39684 · WordPress · Shoplentor

Name of the Vulnerable Software and Affected Versions: ShopLentor plugin for WordPress versions prior to 2.9.9 Description: The issue allows authenticated attackers with Contributor-level access and above to extract sensitive private, pending, and draft Elementor template data. This is possible d...

CVE-2024-7049 Exposure of Token in open-webui/open-webui

In version v0.3.8 of open-webui/open-webui, a vulnerability exists where a token is returned when a user with a pending role logs in. This allows the user to perform actions without admin confirmation, bypassing the intended approval process...

PT-2024-38044 · Unknown · Open-Webui

Name of the Vulnerable Software and Affected Versions: open-webui/open-webui version v0.3.8 Description: A vulnerability exists where a token is returned when a user with a pending role logs in, allowing the user to perform actions without admin confirmation and bypassing the intended approval...

CVE-2024-8801

The Happy Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.12.2 via the Content Switcher widget. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract sensitive data...

PT-2024-39136 · WordPress · Daily Prayer Time

Name of the Vulnerable Software and Affected Versions: Daily Prayer Time plugin for WordPress versions up to, and including, 2024.08.26 Description: The issue arises from insufficient escaping on the user-supplied max word attribute of the quran verse shortcode and lack of sufficient preparation ...

PT-2024-36917

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A vulnerability has been resolved in the Linux kernel related to the wifi driver rtw88. When removing kernel modules, the driver uses skb queue purge to purge TX skb but does not report ...

PT-2024-6335 · Microsoft · Office Visio +2

Name of the Vulnerable Software and Affected Versions: Microsoft Visio affected versions not specified Microsoft Office affected versions not specified Microsoft 365 Apps for Enterprise affected versions not specified Description: The issue is related to errors in access control, allowing an...

DEBIAN-CVE-2024-46796

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double put of @cfile in smb2setpathsize If smb2compoundop is called with a valid @cfile and returned -EINVAL, we need to call cifsgetwritablepath before retrying it as the reference of @cfile was already dropped ...

UBUNTU-CVE-2024-46796

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double put of @cfile in smb2setpathsize If smb2compoundop is called with a valid @cfile and returned -EINVAL, we need to call cifsgetwritablepath before retrying it as the reference of @cfile was already dropped ...

PT-2024-31814

Name of the Vulnerable Software and Affected Versions: Cleanlab versions 2.4.0 or newer Description: The issue is related to the deserialization of untrusted data, which can occur in the Cleanlab project. This allows a maliciously crafted datalab.pkl file to run arbitrary code on an end user's...

PT-2024-31280 · Unknown · Perfex Crm

Name of the Vulnerable Software and Affected Versions: Perfex CRM version 1.1.0 Description: A stored cross-site scripting XSS issue in the Discussion section allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Content parameter. This enables attacker...

PT-2024-12602 · Loftware · Loftware Spectrum

Name of the Vulnerable Software and Affected Versions: Loftware Spectrum versions through 4.6 Description: The issue concerns an unprotected JMX Registry in Loftware Spectrum. Recommendations: For versions through 4.6, consider restricting access to the JMX Registry as a temporary mitigation...

Monero: A peer can remotely fill the pending block queue to an extremely high size, with blocks that will never leave the queue.

The pending block queue in the Monero cryptocurrency protocol could be remotely filled to an extremely high size, up to approximately 54 GB, with blocks that would never leave the queue. This was possible due to lax rules in the synchronization code that allowed the queue size limit to be bypasse...

CVE-2024-45304 OwnableTwoStep allows a pending owner to accept ownership after the original owner has renounced ownership in cairo-contracts

Cairo-Contracts are OpenZeppelin Contracts written in Cairo for Starknet, a decentralized ZK Rollup. This vulnerability can lead to unauthorized ownership transfer, contrary to the original owner's intention of leaving the contract without an owner. It introduces a security risk where an unintend...

PT-2024-31209 · Shopxo · Shopxo

Name of the Vulnerable Software and Affected Versions: ShopXO version 6.2 Description: The issue is related to Cross Site Scripting XSS in the backend, allowing attackers to execute code by changing POST parameters. This enables attackers to perform code execution, potentially leading to...

kernel: md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING

A vulnerability was found in the Linux kernel's md/raid5 implementation within the raid5d function. This flaw can cause a deadlock when handling I/O operations due to a conflict between the reconfigmutex and the MDSBCHANGEPENDING flag, leading to excessive CPU usage and denial of service...

PT-2024-31512 · Byob · Byob

Name of the Vulnerable Software and Affected Versions: BYOB Build Your Own Botnet version 2.0 Description: An arbitrary file write issue in the exfiltration endpoint allows attackers to overwrite SQLite databases and bypass authentication via an unauthenticated HTTP request with a crafted...

SUSE CVE-2024-43863

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Fix a deadlock in dma buf fence polling Introduce a version of the fence ops that on release doesn't remove the fence from the pending list, and thus doesn't require a lock to fix poll-fence wait-fence unref deadlocks...

SUSE CVE-2024-43869

In the Linux kernel, the following vulnerability has been resolved: perf: Fix event leak upon exec and file release The perf pending task work is never waited upon the matching event release. In the case of a child event, released via freeevent directly, this can potentially result in a leaked...