PT-2024-29362 · Unknown · Codeigniter

Name of the Vulnerable Software and Affected Versions: Codeigniter version 3.1.13 Description: A Cross-Site Request Forgery CSRF issue allows attackers to arbitrarily change the Administrator password and escalate privileges. Recommendations: For Codeigniter version 3.1.13, update to a newer...

PT-2024-36912

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.74 Description A vulnerability in the Linux kernel's Bluetooth RFCOMM implementation could lead to a use-after-free issue. This occurs because bt sock alloc attaches an allocated sk object to the provided soc...

Security Bulletin: NVIDIA NeMo - October 2024

NVIDIA has released a software update for NVIDIA® NeMo. To protect your system, download and install this software update from the Releases tab on the NeMo Github page. Go to NVIDIA Product Security. Details This section provides a summary of potential vulnerabilities that this security update...

RHSA-2024:8026 Red Hat Security Advisory: thunderbird security update

Bulletin has no description...

PYSEC-2024-248

OpenCanary, a multi-protocol network honeypot, directly executed commands taken from its config file. Prior to version 0.9.4, where the config file is stored in an unprivileged user directory but the daemon is executed by root, it’s possible for the unprivileged user to change the config file and...

CGA-2PJ6-CQ6H-3WG7

Bulletin has no description...

PT-2024-39313 · Looker · Looker

Name of the Vulnerable Software and Affected Versions: Looker versions prior to 23.12.123 Looker versions prior to 23.18.117 Looker versions prior to 24.0.92 Looker versions prior to 24.6.77 Looker versions prior to 24.8.66 Looker versions prior to 24.10.78 Looker versions prior to 24.12.56 Looke...

CVE-2024-9180 Vault Operators in Root Namespace May Elevate Their Privileges

A privileged Vault operator with write permissions to the root namespace’s identity endpoint could escalate their own or another user’s privileges to Vault’s root policy. Fixed in Vault Community Edition 1.18.0 and Vault Enterprise 1.18.0, 1.17.7, 1.16.11, and 1.15.16...

CGA-3652-MR4R-QQJ4

Bulletin has no description...

PT-2024-32050 · Te Informatics · Nova Cms

Name of the Vulnerable Software and Affected Versions: TE Informatics Nova CMS versions prior to 5.0 Description: A SQL Injection vulnerability exists in TE Informatics Nova CMS due to a Hibernate flaw. This issue allows for SQL Injection, which can be exploited. Recommendations: For TE Informati...

PT-2024-21144 · Openfyde +1 · Openfyde +3

Name of the Vulnerable Software and Affected Versions: FydeOS for PC version 17.1 R114 FydeOS for VMware version 17.0 R114 FydeOS for You version 17.1 R114 OpenFyde version R114 Description: The issue allows attackers to gain root access without a password due to the root password being saved as ...

PT-2024-7462 · Mitel · Mitel Micollab

Name of the Vulnerable Software and Affected Versions: Mitel MiCollab versions prior to 9.8 SP1 FP2 9.8.1.201 Description: A vulnerability in the AWV component of Mitel MiCollab could allow an unauthenticated attacker to conduct a CRLF injection attack due to inadequate encoding of user input in...

Use After Free

Overview Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 is a package providing a default set of APIs for building an ASP.NET Core application. Contains assets used for self-contained deployments. Affected versions of this package are vulnerable to Use After Free that could allow remote code...

HPESBGN04708 rev.1 - HPE Unified OSS Console Assurance Monitoring (UOCAM), Multiple Vulnerabilities

Potential Security Impact: Local: Arbitrary Code Execution, Unauthorized Access to Files, Server-Side Request Forgery SSRF; Remote: Arbitrary Code Execution, Unauthorized Access to Files, Server-Side Request Forgery SSRF SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Unified...

MGASA-2024-0322 Updated hostapd & wpa_supplicant packages fix security vulnerability

The IEEE 802.11 standard sometimes enables an adversary to trick a victim into connecting to an unintended or untrusted network with Home WEP, Home WPA3 SAE-loop. Enterprise 802.1X/EAP, Mesh AMPE, or FILS, aka an "SSID Confusion" issue. This occurs because the SSID is not always used to derive th...

PT-2024-32888 · Mediawiki · Mediawiki Abusefilter Extension

Name of the Vulnerable Software and Affected Versions: MediaWiki AbuseFilter extension versions prior to 1.39.9 MediaWiki AbuseFilter extension versions 1.40.x MediaWiki AbuseFilter extension versions 1.41.x prior to 1.41.3 MediaWiki AbuseFilter extension versions 1.42.x prior to 1.42.2...

Express Open Redirect vulnerability

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in Express. This vulnerability affects the use of the Express Response object. This issue impacts Express: from 3.4.5 before 4.0.0-rc1...

Multiple vulnerabilities in JTEKT ELECTRONICS Kostac PLC Programming Software

Overview Kostac PLC Programming Software provided by JTEKT ELECTRONICS CORPORATION contains multiple vulnerabilities listed below. Out-of-bounds write CWE-787 - CVE-2024-47134 Stack-based buffer overflow CWE-121 - CVE-2024-47135 Out-of-bounds read CWE-125 - CVE-2024-47136 Michael Heinzl reported...

PT-2024-9615

Name of the Vulnerable Software and Affected Versions GStreamer versions prior to 1.24.10 Description A vulnerability has been identified in the gst wavparse smpl chunk function within gstwavparse.c. This function attempts to read 4 bytes from the data + 12 offset without checking if the size of...

PT-2024-31040 · Apple · Ios +1

Name of the Vulnerable Software and Affected Versions: iOS versions prior to 18.0.1 iPadOS versions prior to 18.0.1 Description: This issue involves audio messages in Messages potentially capturing a few seconds of audio before the microphone indicator is activated. The problem was addressed with...