EUVD-2024-36465

GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. An authenticated user can attach a document to any item, even if the user has no write access on it. Upgrade to 10.0.16...

PT-2024-5565 · Juniper Networks · Junos Evolved

Name of the Vulnerable Software and Affected Versions: Junos OS Evolved on ACX 7000 Series versions prior to 21.4R3-S7-EVO Junos OS Evolved on ACX 7000 Series versions 22.1 prior to 22.1R3-S6-EVO Junos OS Evolved on ACX 7000 Series versions 22.2 prior to 22.2R3-S3-EVO Junos OS Evolved on ACX 7000...

EUVD-2024-2328

Fides is an open-source privacy engineering platform. fides.js, a client-side script used to interact with the consent management features of Fides, used the polyfill.io domain in a very limited edge case, when it detected a legacy browser such as IE11 that did not support the fetch standard...

CVE-2024-38519

CVE-2024-38519 affects yt-dlp and youtube-dl: prior to fixes, the tools do not limit downloaded file extensions, enabling potential creation of arbitrary filenames and path traversal on Windows, with risk of arbitrary code execution due to config/files being read from the working directory. The i...

CVE-2024-29868 Apache StreamPipes, Apache StreamPipes: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in Recovery Token Generation

Use of Cryptographically Weak Pseudo-Random Number Generator PRNG vulnerability in Apache StreamPipes user self-registration and password recovery mechanism. This allows an attacker to guess the recovery token in a reasonable time and thereby to take over the attacked user's account. This issue...

EUVD-2024-1896

XSS in Upload page in Apache JSPWiki 2.12.1 and priors allows the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. Apache JSPWiki users should upgrade to 2.12.2 or later...

PT-2024-23092 · Apache · Apache Streampipes

Name of the Vulnerable Software and Affected Versions: Apache StreamPipes versions 0.69.0 through 0.93.0 Description: The issue is related to the use of a cryptographically weak pseudo-random number generator PRNG in the user self-registration and password recovery mechanism. This allows an...

CVE-2023-45673 Arbitrary code execution on click of PDF links in Joplin

Joplin is a free, open source note taking and to-do application. A remote code execution RCE vulnerability in affected versions allows clicking on a link in a PDF in an untrusted note to execute arbitrary shell commands. Clicking links in PDFs allows for arbitrary code execution because Joplin...

CVE-2024-37902 Path thraversal in DeepJavaLibrary

DeepJavaLibraryDJL is an Engine-Agnostic Deep Learning Framework in Java. DJL versions 0.1.0 through 0.27.0 do not prevent absolute path archived artifacts from inserting archived files directly into the system, overwriting system files. This is fixed in DJL 0.28.0 and patched in DJL Large Model...

OPENSUSE-SU-2024:10974-1 doxygen2man-2.0.2+20201203.def947e-1.6 on GA media

These are all security issues fixed in the doxygen2man-2.0.2+20201203.def947e-1.6 package on the GA media of openSUSE Tumbleweed...

CVE-2024-37885 Code injection in Nextcloud Desktop Client for macOS

The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with your computer. A code injection in Nextcloud Desktop Client for macOS allowed to load arbitrary code when starting the client with DYLDINSERTLIBRARIES set in the enviroment. It is recommended that the Nextcloud...

CGA-M5MC-V5JJ-FQ26

Bulletin has no description...

CGA-44QW-99VP-WCPM

Bulletin has no description...

GHSA-4QPJ-GXXG-JQG4 Swiftmailer Sendmail transport arbitrary shell execution

Prior to 5.2.1, the sendmail transport SwiftTransportSendmailTransport was vulnerable to an arbitrary shell execution if the "From" header came from a non-trusted source and no "Return-Path" is configured. This has been fixed in 5.2.1. If you are using sendmail as a transport, you are encouraged ...

PYSEC-2024-166

Nautobot is a Network Source of Truth and Network Automation Platform. A user with permissions to view Dynamic Group records extras.viewdynamicgroup permission can use the Dynamic Group detail UI view /extras/dynamic-groups// and/or the members REST API view /api/extras/dynamic-groups//members/ t...

CVE-2023-6349 Heap overflow in libvpx

A heap overflow vulnerability exists in libvpx - Encoding a frame that has larger dimensions than the originally configured size with VP9 may result in a heap overflow in libvpx. We recommend upgrading to version 1.13.1 or above...

PT-2024-24104 · Aruba · Aruba Instantos/Arubaos

Name of the Vulnerable Software and Affected Versions: Aruba InstantOS/ArubaOS versions prior to 10.5.1.0 Description: The issue is related to command injection vulnerabilities in the Soft AP Daemon service, which can lead to unauthenticated remote code execution. This is achieved by sending...

PT-2024-10784 · Extreme Networks · Extreme Networks Exos

Name of the Vulnerable Software and Affected Versions: Extreme Networks EXOS versions prior to 22.7 Extreme Networks EXOS versions prior to 30.2 Description: The issue is related to the Web GUI of Extreme Networks EXOS, which fails to restrict URL access. This allows attackers to access sensitive...

CVE-2024-34341 The Trix Editor Contains an Arbitrary Code Execution Vulnerability

Trix is a rich text editor. The Trix editor, versions prior to 2.1.1, is vulnerable to arbitrary code execution when copying and pasting content from the web or other documents with markup into the editor. The vulnerability stems from improper sanitization of pasted content, allowing an attacker ...

CVE-2024-28148 Apache Superset: Incorrect datasource authorization on explore REST API

An authenticated user could potentially access metadata for a datasource they are not authorized to view by submitting a targeted REST API request.This issue affects Apache Superset: before 3.1.2. Users are recommended to upgrade to version 3.1.2 or above, which fixes the issue...