12579 matches found
GHSA-9WX4-H78V-VM56 Requests `Session` object does not verify requests after making first request with verify=False
When using a requests.Session, if the first request to a given origin is made with verify=False, TLS certificate verification may remain disabled for all subsequent requests to that origin, even if verify=True is explicitly specified later. This occurs because the underlying connection is reused...
Apple Security Update: iOS 17.5.1 and iPadOS 17.5.1
Apple recommends to install security update iOS 17.5.1 and iPadOS 17.5.1 on devices iPhone XS and later, iPad Pro 13-inch, iPad Pro 12.9-inch 2nd generation and later, iPad Pro 10.5-inch, iPad Pro 11-inch 1st generation and later, iPad Air 3rd generation and later, iPad 6th generation and later,...
PT-2024-13727 · Zoho · Zoho Manageengine Adaudit Plus
Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine ADAudit Plus versions below 7271 Description: The issue allows SQL Injection while exporting a full summary report. Recommendations: For Zoho ManageEngine ADAudit Plus versions below 7271, update to version 7271 or later to...
PT-2024-4655
Name of the Vulnerable Software and Affected Versions: Roundcube Webmail versions prior to 1.5.7 and 1.6.x prior to 1.6.7 Description: The issue is related to a stored cross-site scripting vulnerability in the Roundcube webmail software, allowing an attacker to execute JavaScript code on the user...
PT-2024-20638
Name of the Vulnerable Software and Affected Versions Masteriyo LMS versions 1.7.2 and earlier Description The issue is related to Improper Privilege Management, allowing Privilege Escalation in Masteriyo LMS. Recommendations For Masteriyo LMS versions 1.7.2 and earlier, update to a version later...
PT-2024-21025 · Wpmu Dev · Wpmu Dev Defender Security
Name of the Vulnerable Software and Affected Versions: WPMU DEV Defender Security versions through 4.4.1 Description: The issue is related to an Authentication Bypass by Spoofing, allowing functionality bypass. Recommendations: For versions through 4.4.1, update to a version later than 4.4.1 to...
Intel Dynamic Tuning Technology Software Privilege Escalation (INTEL-SA-00984)
Improper access control in the Intel DTT Software before version 8.7.10802.26924 may allow an authenticated user to potentially enable escalation of privilege via local access. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version...
RunGptLLM class in LlamaIndex has a command injection
A command injection vulnerability exists in the RunGptLLM class of the llamaindex library, version 0.9.47, used by the RunGpt framework from JinaAI to connect to Language Learning Models LLMs. The vulnerability arises from the improper use of the eval function, allowing a malicious or compromised...
PT-2024-12810 · Intel · Intel(R) Cst
Name of the Vulnerable Software and Affected Versions: IntelR CST software versions prior to 2.1.10300 Description: The issue is related to improper access control in IntelR CST software, which may allow an authenticated user to potentially enable escalation of privilege via local access...
PT-2024-19046 · Intel · Intel Advisor
Name of the Vulnerable Software and Affected Versions: IntelR Advisor versions prior to 2024.0 Description: The issue is related to an uncontrolled search path in IntelR Advisor software, which may allow an authenticated user to potentially enable escalation of privilege via local access...
PT-2024-29798 · WordPress · Tutor Lms
Name of the Vulnerable Software and Affected Versions: Tutor LMS plugin for WordPress versions prior to 2.8.0 is not specified, however, the versions up to and including 2.7.0 are affected. Description: The issue allows unauthorized access, modification, and loss of data due to a missing capabili...
PT-2024-13435 · Intel +2 · Intel Media Sdk +3
Name of the Vulnerable Software and Affected Versions: IntelR Media SDK all versions IntelR oneVPL software versions prior to 23.3.5 Description: The issue is an out-of-bounds write that may allow an authenticated user to potentially enable escalation of privilege via local access. Recommendation...
PT-2024-11973 · Intel +2 · Intel Onevpl +3
Name of the Vulnerable Software and Affected Versions: IntelR Media SDK versions prior to 23.3.5 IntelR oneVPL software versions prior to 23.3.5 Description: The issue is an out-of-bounds read that may allow an authenticated user to potentially enable escalation of privilege via local access...
Cisco Secure Email Gateway HTTP Response Splitting Vulnerability
A vulnerability in the web-based management API of Cisco AsyncOS Software for Cisco Secure Email Gateway could allow an unauthenticated, remote attacker to conduct an HTTP response splitting attack. This vulnerability is due to insufficient input validation of some parameters that are passed to t...
Cisco AppDynamics Network Visibility Service Denial of Service Vulnerability
A vulnerability in Cisco AppDynamics Network Visibility Agent could allow an unauthenticated, local attacker to cause a denial of service DoS condition on an affected device. This vulnerability is due to the inability to handle unexpected input. An attacker who has local device access could explo...
Vulnerabilities fixed in Apple iOS and iPadOS
Apple has fixed vulnerabilities in iOS and iPadOS. A malicious party can exploit the vulnerabilities to carry out attacks that can lead to the following categories of damage: - Denial-of-Service DoS - Remote code execution Administrator/Root rights - Remote code execution User rights - Access to...
PT-2024-40245 · Ez Systems · Ez Platform
Name of the Vulnerable Software and Affected Versions: eZ Platform versions 2.x Description: The issue affects the password reset functionality in the eZ Platform Admin UI, making it vulnerable to brute force attacks. Depending on the configuration, an attacker may exploit this to gain control ov...
PT-2024-26955 · WordPress · Hl Twitter Wordpress Plugin
Name of the Vulnerable Software and Affected Versions: HL Twitter WordPress plugin versions through 2014.1.18 Description: The issue concerns a lack of CSRF check when unlinking Twitter accounts, potentially allowing attackers to make logged-in admins perform such actions via a CSRF attack...
PT-2024-20730 · Insyde · Insydeh2O
Name of the Vulnerable Software and Affected Versions: Insyde InsydeH2O kernel versions 5.2 through 5.2 before 05.29.09 Insyde InsydeH2O kernel versions 5.3 through 5.3 before 05.38.09 Insyde InsydeH2O kernel versions 5.4 through 5.4 before 05.46.09 Insyde InsydeH2O kernel versions 5.5 through 5....
