Intel Graphics Command Center Service Software May 2024 Security Update

Intel has informed HP of a potential security vulnerability in some Intel® Graphics Command Center Service software bundled in some Intel® Graphics Windows DCH driver software, which might allow escalation of privilege. Intel is releasing software updates to mitigate this potential vulnerability...

CVE-2024-34353 matrix-sdk-crypto contains a log exposure of private key of the server-side key backup

The matrix-sdk-crypto crate, part of the Matrix Rust SDK project, is an implementation of a Matrix end-to-end encryption state machine in Rust. In Matrix, the server-side key backup stores encrypted copies of Matrix message keys. This facilitates key sharing between a user's devices and provides ...

PT-2024-4835 · Apple · Ios +1

Name of the Vulnerable Software and Affected Versions: iOS versions prior to 17.5 iPadOS versions prior to 17.5 Description: A privacy issue was addressed with improved client ID handling for alternative app marketplaces. The issue is related to the MarketplaceKit component and its lack of...

PT-2024-22054 · Apple · Macos Sonoma +7

Name of the Vulnerable Software and Affected Versions: tvOS versions prior to 17.5 visionOS versions prior to 1.2 iOS versions prior to 17.5 iPadOS versions prior to 17.5 watchOS versions prior to 10.5 macOS Sonoma versions prior to 14.5 Description: An out-of-bounds write issue was addressed wit...

PT-2024-22045 · Apple · Macos Sonoma +5

Name of the Vulnerable Software and Affected Versions: iOS versions prior to 17.5 iPadOS versions prior to 17.5 tvOS versions prior to 17.5 watchOS versions prior to 10.5 macOS Sonoma versions prior to 14.5 Description: The issue was addressed with improved memory handling. An app may be able to...

JVN#28869536: Multiple vulnerabilities in Cybozu Garoon

Cybozu Garoon provided by Cybozu, Inc. contains multiple vulnerabilities listed below. Improper handling of data in Mail CWE-231 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H Base Score 4.9 CVE-2024-31397 CyVDB-3167 Improper restriction on the output of some API CWE-201...

SUSE-SU-2024:1591-1 Security update for python-Werkzeug

This update for python-Werkzeug fixes the following issues: - CVE-2024-34069: Fixed a remote code execution through debugger when interacting with attacker controlled domain bsc1223979...

SUSE-SU-2024:1588-1 Security update for go1.21

This update for go1.21 fixes the following issues: Update to go1.21.10: - CVE-2024-24787: cmd/go: arbitrary code execution during build on darwin bsc1224017 - net/http: TestRequestLimit/h2 becomes significantly more expensive and slower after x/[email protected]...

DSA-5687-1 chromium - security update

Bulletin has no description...

JVN#61054671: Phormer vulnerable to cross-site scripting

Phormer contains a cross-site scripting vulnerability CWE-79. Impact An arbitrary script may be executed on the web browser of the user. Solution Update the Software Update the software to the latest version according to the information provided by the developer. Phormer version 3.35 was released...

SUSE-SU-2024:1574-1 Security update for go1.21

This update for go1.21 fixes the following issues: Update to go1.21.10: - CVE-2024-24787: cmd/go: arbitrary code execution during build on darwin bsc1224017 - net/http: TestRequestLimit/h2 becomes significantly more expensive and slower after x/[email protected]...

PT-2024-26774 · WordPress · The Letterpress

Name of the Vulnerable Software and Affected Versions: The LetterPress WordPress plugin versions 1.2.2 and earlier Description: The issue is related to the lack of CSRF checks in some areas, allowing attackers to perform unwanted actions on logged-in users via CSRF attacks, such as deleting...

CVE-2024-29207

CVE-2024-29207 describes an improper certificate validation in Ubiquiti UniFi Connect ecosystem. Affected products and versions: UniFi Connect Application <= v3.7.9, UniFi Connect EV Station <= v1.1.18, UniFi Connect EV Station Pro <= v1.1.18, UniFi Connect Display <= v1.9.324, UniFi ...

Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull

Impact An authenticated user who has access to a game server is able to bypass the previously implemented access control https://github.com/pterodactyl/wings/security/advisories/GHSA-6rg3-8h8x-5xfv that prevents accessing internal endpoints of the node hosting Wings in the pull endpoint. This wou...

PT-2024-25547 · Unknown · Exclusive Addons For Elementor

Name of the Vulnerable Software and Affected Versions: Exclusive Addons Elementor versions through 2.6.9.1 Description: The issue is related to a Missing Authorization vulnerability in Exclusive Addons Elementor. Recommendations: For versions through 2.6.9.1, update to a version later than 2.6.9....

HP Application Enabling Software Driver - Privileged File Overwrite

A potential security vulnerability has been identified in the HP Application Enabling Software Driver for certain HP PC products, which might allow escalation of privilege. HP is releasing software updates to mitigate this potential vulnerability. Mitigation is available in HP Application Enablin...

PT-2024-29140 · WordPress · Slider Revolution

Name of the Vulnerable Software and Affected Versions: Slider Revolution plugin for WordPress versions up to, and including, 6.7.7 Description: The issue allows for Stored Cross-Site Scripting via the htmltag parameter due to insufficient input sanitization and output escaping. This enables...

Pet Manager <= 1.4 - Reflected XSS

Description The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin PoC 1. Add a pet and publish the listing 2. View the pet on the frontend of the site...

PT-2024-26157 · WordPress · Sticky Buttons

Name of the Vulnerable Software and Affected Versions: The Sticky Buttons WordPress plugin versions prior to 3.2.4 Description: The issue is related to the lack of CSRF checks in some bulk actions, which could allow attackers to make logged-in admins perform unwanted actions, such as deleting...

Security Bulletin: NVIDIA Triton Inference Server - April 2024

NVIDIA has released a software update for NVIDIA Triton Inference Server to address the issue disclosed in this bulletin. To protect your system, install the latest release from the Triton Inference Server Releases page on GitHub, and view the Secure Deployment Considerations Guide. Go to NVIDIA...