DLA-3784-1 libcaca - security update

Bulletin has no description...

DLA-3783-1 expat - security update

Bulletin has no description...

ENL Newsletter <= 1.0.1 - Campaign Deletion via CSRF

Description The plugin does not have CSRF checks in some places, which could allow attackers to make logged in admins delete arbitrary Campaigns via a CSRF attack PoC Make an admin open a URL like where is a valid ID: http://example.com/wp-admin/admin.php?page=enl-campaigns=campaign-delete=...

PT-2024-2955 · Libhtp · Libhtp

Name of the Vulnerable Software and Affected Versions: LibHTP versions 0.5.46 Description: The issue is related to the parsing of malformed request traffic, which can lead to excessive CPU usage. This can be exploited by a remote attacker to cause a denial of service. Recommendations: For version...

PT-2024-21583 · Siyuan · Siyuan

Name of the Vulnerable Software and Affected Versions: SiYuan version 3.0.3 Description: The issue allows executing arbitrary commands on the server due to the application being vulnerable to Server Side XSS. Recommendations: For SiYuan version 3.0.3, update to a version that fixes the Server Sid...

CVE-2023-52641 fs/ntfs3: Add NULL ptr dereference checking at the end of attr_allocate_frame()

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: Add NULL ptr dereference checking at the end of attrallocateframe It is preferable to exit through the out: label because internal debugging functions are located there...

Cisco TelePresence Management Suite Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco TelePresence Management Suite TMS could allow a low-privileged, remote attacker to conduct a cross-site scripting XSS attack against a user of the interface. This vulnerability is due to insufficient input validation by the web-based...

Cisco Identity Services Engine Cross-Site Request Forgery Vulnerability

A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack and perform arbitrary actions on an affected device. This vulnerability is due to insufficient CSRF...

Cisco Enterprise Chat and Email Cross-Site Scripting Vulnerability

A vulnerability in the web UI of Cisco Enterprise Chat and Email ECE could allow an authenticated, remote attacker to conduct a cross-site scripting XSS attack against a user of the interface. This vulnerability exists because the web UI does not properly validate user-supplied input. An attacker...

PT-2024-20716 · Ibm · Ibm Db2

Name of the Vulnerable Software and Affected Versions: IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server versions 11.1 and 11.5 Description: The issue allows an authenticated user to cause a denial of service using a specially crafted query. Recommendations: For versions 11.1 and...

QUIC's Connection ID Mechanism vulnerable to Memory Exhaustion Attack

An attacker can cause its peer to run out of memory by sending a large number of NEWCONNECTIONID frames that retire old connection IDs. The receiver is supposed to respond to each retirement frame with a RETIRECONNECTIONID frame. The attacker can prevent the receiver from sending out the vast...

PT-2024-2667

Name of the Vulnerable Software and Affected Versions Flowmon versions prior to 11.1.14 and 12.3.5 Description A command injection vulnerability has been identified in Flowmon, allowing an unauthenticated user to gain entry to the system via the management interface and execute arbitrary system...

Important: tomcat9

Issue Overview: Denial of Service via incomplete cleanup vulnerability in Apache Tomcat. It was possible for WebSocket clients to keep WebSocket connections open leading to increased resource consumption.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through...

KEYENCE VT STUDIO may insecurely load Dynamic Link Libraries

Overview VT STUDIO provided by KEYENCE CORPORATION contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries CWE-427, CVE-2024-28099. KEYENCE CORPORATION reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. Impact...

Android Security Bulletin—April 2024Stay organized with collectionsSave and categorize content based on your preferences.

The Android Security Bulletin contains details of security vulnerabilities affecting Android devices. Security patch levels of 2024-04-05 or later address all of these issues. To learn how to check a device's security patch level, see Check and update your Android version. Android partners are...

PT-2024-2453

Name of the Vulnerable Software and Affected Versions Mikrotik RouterOS x86 versions 6.40.5 through 6.49.10 Description An issue in the processing of input data allows a remote attacker to cause a denial of service, resulting in a device crash. This is achieved by sending crafted packet data to t...

PT-2024-23487 · Unknown · Aesop Story Engine

Name of the Vulnerable Software and Affected Versions: Aesop Story Engine versions prior to 2.3.3 Description: The issue is related to improper neutralization of input during web page generation, which leads to a Stored XSS vulnerability. This allows for the storage of malicious scripts in the...

PT-2024-23760 · Unknown · Comic Easel

Name of the Vulnerable Software and Affected Versions: Comic Easel versions 1.15 and earlier Description: The issue affects Comic Easel, allowing Reflected XSS due to improper neutralization of input during web page generation. Recommendations: For Comic Easel versions 1.15 and earlier, update to...

PT-2024-23489 · Unknown · Maurice Spin 360 Deg/3D Model Viewer

Name of the Vulnerable Software and Affected Versions: Maurice Spin 360 deg and 3D Model Viewer versions 1.2.7 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Stored XSS attacks...

CVE-2024-23539 Apache Fineract: Under certain system configurations, the sqlSearch parameter for specific endpoints was vulnerable to SQL injection attacks, potentially allowing attackers to manipulate database queries.

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache Fineract.This issue affects Apache Fineract: 1.8.5. Users are recommended to upgrade to version 1.8.5 or 1.9.0, which fix the issue...