SonarSource SonarQube security vulnerabilities

SonarSource SonarQube is an open source code quality management system from SonarSource, Switzerland. A security vulnerability exists in SonarSource SonarQube versions prior to 9.9.5 LTA and 10.x versions prior to 10.5, which stems from the ability of a user with the administrator role to modify...

PT-2024-37167 · Avast · Avg/Avast Antivirus

Name of the Vulnerable Software and Affected Versions: AVG/Avast Antivirus versions prior to 24.1 Description: The issue allows a local attacker to escalate privileges via a COM hijack in a time-of-check to time-of-use TOCTOU scenario when self-protection is disabled. This occurs in the AVGUI.exe...

PT-2024-38610 · Webroot · Webroot Secureanywhere - Web Shield

Name of the Vulnerable Software and Affected Versions: Webroot SecureAnywhere - Web Shield versions prior to 2.1.2.3 Description: The issue is related to a 'Type Confusion' vulnerability in the wrUrl.Dll modules of Webroot SecureAnywhere - Web Shield, allowing functionality misuse. This...

PT-2024-31026 · Apple · Itunes

Name of the Vulnerable Software and Affected Versions: iTunes versions prior to 12.13.3 Description: A logic issue was addressed with improved restrictions, which could allow a local attacker to elevate their privileges. The issue is related to a local privilege escalation vulnerability...

M-Files Connector security vulnerabilities

M-Files Connector is an M-Files connector for network folders from M-Files, Inc. A security vulnerability exists in M-Files Connector for Copilot versions prior to 24.9.3 that stems from an access control error...

OpenC3 COSMOS Cross-Site Scripting Vulnerability

OpenC3 COSMOS is an OpenC3 open source application. A cross-site scripting vulnerability exists in OpenC3 COSMOS versions prior to 5.19.0. An attacker exploits this vulnerability to perform cross-site scripting attacks...

PT-2024-32642 · Openc3 · Openc3 Cosmos

Name of the Vulnerable Software and Affected Versions: OpenC3 COSMOS versions prior to 5.19.0 Description: OpenC3 COSMOS stores the password of a user unencrypted in the LocalStorage of a web browser. This makes the user password susceptible to exfiltration via Cross-site scripting. The issue may...

M-Files Hubshare security vulnerabilities

M-Files Hubshare is a collaboration solution from M-Files, Inc. designed to seamlessly share files, documents and collaborative content. A security vulnerability exists in M-Files Hubshare versions prior to 5.0.8.6 that stems from the presence of an HTML injection vulnerability...

DEBIAN-CVE-2024-9392

A compromised content process could have allowed for the arbitrary loading of cross-origin pages. This vulnerability affects Firefox 131, Firefox ESR 128.3, Firefox ESR 115.16, Thunderbird 128.3, and Thunderbird 131...

LibreNMS cross-site scripting vulnerabilities

LibreNMS is an open source network monitoring system based on PHP and MySQL from the LibreNMS community. The system features customizable alerts, auto-discovery of network environments, and automatic updates. A cross-site scripting vulnerability exists in LibreNMS version 24.7.0 and prior version...

LibreNMS cross-site scripting vulnerabilities

LibreNMS is an open source network monitoring system based on PHP and MySQL from the LibreNMS community. The system features customizable alerts, auto-discovery of network environments, and automatic updates. A cross-site scripting vulnerability exists in LibreNMS version 24.7.0 and prior version...

PT-2024-32381 · Unknown · Computer Vision Annotation Tool

Name of the Vulnerable Software and Affected Versions: Computer Vision Annotation Tool CVAT versions prior to 2.19.0 Description: The Computer Vision Annotation Tool CVAT is an interactive video and image annotation tool for computer vision. A malicious CVAT user with permissions to create or edi...

PT-2024-38983 · WordPress · Cost Calculator Builder

Name of the Vulnerable Software and Affected Versions: Cost Calculator Builder WordPress plugin versions prior to 3.2.29 Description: The issue is related to a SQL injection vulnerability. It occurs because the plugin does not properly sanitise and escape a parameter before using it in a SQL...

PT-2024-39462 · Unknown · Peadm Forge Module

Name of the Vulnerable Software and Affected Versions: PEADM Forge Module versions prior to 3.24.0 Description: A security misconfiguration was discovered in the software. Recommendations: For versions prior to 3.24.0, update to version 3.24.0 or later to resolve the issue...

RSM Design Website Template SQL Injection Vulnerability

RSM Design Website Template is a website template from RSM Design. A SQL injection vulnerability exists in RSM Design Website Template prior to version 1.2, which stems from the inclusion of a SQL injection vulnerability...

National Keep CyberMath has a security vulnerability

National Keep CyberMath is a cybersecurity risk analysis tool for organizations from National Keep. A security vulnerability exists in versions prior to National Keep CyberMath CYBM.240816253 that stems from the presence of an authorization error vulnerability that allows access to functionality...

CVE-2024-7575: Improper Neutralization of Special Elements used in a Command

In Progress Telerik UI for WPF versions prior to 2024 Q3 2024.3.924, a command injection attack is possible through improper neutralization of hyperlink elements...

CVE-2024-8316: Deserialization of Untrusted Data

In Progress Telerik UI for WPF versions prior to 2024 Q3 2024.3.924, a code execution attack is possible through an insecure deserialization vulnerability...

Strawberry GraphQL Cross-Site Request Forgery Vulnerability

Strawberry GraphQL is a Python GraphQL library utilizing type annotations in the Strawberry GraphQL open source. A cross-site request forgery vulnerability exists in Strawberry GraphQL versions prior to 0.243.0, which stems from vulnerability to cross-site request forgery CSRF attacks...

PT-2024-38934 · Telerik · Telerik Ui For Wpf

Name of the Vulnerable Software and Affected Versions: Telerik UI for WPF versions prior to 2024 Q3 2024.3.924 Description: The issue is related to an insecure deserialization vulnerability, which allows for a code execution attack. This vulnerability can be exploited remotely. Recommendations: F...