ethOS security vulnerabilities

ethOS is an application from ethOS, Inc. A security vulnerability exists in ethOS version 1.3.3 and prior versions, which stems from allowing man-in-the-middle attacks...

PT-2024-27227

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.9 Description The issue is related to a deadlock regression in the Linux kernel's wifi: iwlwifi module, which was introduced with the LED merge in version 6.9. The deadlock occurs when all worker threads are bu...

PT-2024-22659 · Dell · Dell Openmanage Enterprise

Name of the Vulnerable Software and Affected Versions: Dell OpenManage Enterprise versions prior to 4.1.0 Description: The issue is related to an Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS, which could allow a high privileged attacker with...

Wallos SQL injection vulnerability

Wallos is an open source personal subscription tracker by the individual developer Miguel Ribeiro. A SQL injection vulnerability exists in Wallos versions prior to 1.15.3, which originates from an easy SQL injection via the category and payment parameters of /subscriptions/get.php...

HPESBGN04639 rev.1 - HPE OneView, Multiple Vulnerabilities

Potential Security Impact: Remote: Bypass Security Restrictions, Denial of Service DoS SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE OneView - All versions prior to 8.90 CVSS Scores: | CVE | CVSS Vector | Base Score | | --- | --- | --- | | CVE-2021-42717 |...

WordPress plugin VOD Infomaniak: Cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

PT-2024-4417

Name of the Vulnerable Software and Affected Versions ejs versions prior to 3.1.10 Description The issue is related to the lack of certain pollution protection in the ejs package, which can be exploited to execute arbitrary code by injecting specially crafted JavaScript code. This can be done by ...

DEBIAN-CVE-2024-33663

python-jose through 3.3.0 has algorithm confusion with OpenSSH ECDSA keys and other key formats. This is similar to CVE-2022-29217...

WordPress plugin Filterable Portfolio: Cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

PT-2024-22402 · WordPress · Wp Chat App

Name of the Vulnerable Software and Affected Versions: WP Chat App WordPress plugin versions prior to 3.6.4 Description: The issue allows high privilege users, such as admins, to perform Cross-Site Scripting attacks even when unfiltered html is disallowed, due to the plugin not sanitizing and...

PT-2024-12106 · Jumpcloud · Jumpcloud Agent

Name of the Vulnerable Software and Affected Versions: JumpCloud Agent versions prior to 1.178.0 Description: The issue allows privilege escalation to SYSTEM via a repair action in the installer. This is due to the creation of a temporary file in a directory with insecure permissions...

PT-2024-22356 · Unknown +1 · Glpi Agent +1

Name of the Vulnerable Software and Affected Versions: GLPI Agent versions prior to 1.7.2 Description: A local user can modify the GLPI-Agent code or used DLLs to modify agent logic and potentially gain higher privileges. Recommendations: For versions prior to 1.7.2, upgrade to GLPI-Agent 1.7.2 t...

PT-2024-3535 · Qnap · Qts +1

Name of the Vulnerable Software and Affected Versions: QTS versions prior to 5.1.6.2722 build 20240402 QuTS hero versions prior to h5.1.6.2734 build 20240414 Description: The issue is caused by a buffer copy without checking the size of input, which may allow authenticated users to execute code v...

PT-2024-24761 · Unknown · Loginpress Pro

Name of the Vulnerable Software and Affected Versions: LoginPress Pro versions prior to 3.0.0 Description: The issue is related to an Improper Restriction of Excessive Authentication Attempts, which allows for the removal of important client functionality. Recommendations: For versions prior to...

PT-2024-24742 · Vyper · Vyper

Name of the Vulnerable Software and Affected Versions: Vyper versions 0.3.10 and prior Description: The issue arises from using the sqrt builtin in Vyper, which can result in a double eval vulnerability when the argument has side-effects. This occurs because the build IR function of the sqrt...

SUSE CVE-2024-31208

Synapse is an open-source Matrix homeserver. A remote Matrix user with malicious intent, sharing a room with Synapse instances before 1.105.1, can dispatch specially crafted events to exploit a weakness in the V2 state resolution algorithm. This can induce high CPU consumption and accumulate...

PT-2024-24934

Name of the Vulnerable Software and Affected Versions Python Social Auth versions prior to 5.4.1 Description The issue arises due to default case-insensitive collation in MySQL or MariaDB databases, causing third-party authentication user IDs to not be case-sensitive. This could lead to different...

PT-2024-5143 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions prior to 16.9.6 GitLab CE/EE versions 16.10 through 16.10.3 GitLab CE/EE versions 16.11 through 16.11.0 Description: The issue is related to insufficient access control in the Email Address Handler component of GitLab,...

WordPress Plugin BookingPress Authorization Issue Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blogging sites on servers with PHP and MySQL.WordPress plugin is an application plugin. The WordPress...

PT-2024-13488

Name of the Vulnerable Software and Affected Versions Automattic Jetpack versions prior to 12.7 Description The issue is related to an Improper Restriction of Rendered UI Layers or Frames vulnerability, which allows Clickjacking. Recommendations For versions prior to 12.7, update to version 12.7 ...