PT-2024-10418

Name of the Vulnerable Software and Affected Versions FFmpeg version 6.1.1 Description The issue is related to an integer overflow in the FFmpeg CAF decoder. This could potentially allow an attacker to cause a denial of service. Recommendations For version 6.1.1, consider updating to a newer...

PT-2024-22965

Name of the Vulnerable Software and Affected Versions Xpdf versions 4.05 and earlier Description The issue is an out-of-bounds array write in Xpdf, triggered by a negative object number in an indirect reference in the input PDF file. This occurs when the software processes a PDF file containing a...

CVE-2021-47177

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Fix sysfs leak in allociommu iommudevicesysfsadd is called before, so is has to be cleaned on subsequent errors...

PT-2024-2509 · Arm +3 · Mbed Crypto +4

Name of the Vulnerable Software and Affected Versions: Mbed TLS versions 2.18.0 through 2.28.x before 2.28.8 Mbed TLS versions 3.x before 3.6.0 Mbed Crypto affected versions not specified Description: The PSA Crypto API in Mbed TLS and Mbed Crypto mishandles shared memory, which can be exploited ...

CVE-2024-29188 Malicious directory junction can cause WiX RemoveFoldersEx to possibly delete elevated files

WiX toolset lets developers create installers for Windows Installer, the Windows installation engine. The custom action behind WiX's RemoveFolderEx functionality could allow a standard user to delete protected directories. RemoveFolderEx deletes an entire directory tree during installation or...

PT-2024-3233 · Brocade · Brocade Sannav

Name of the Vulnerable Software and Affected Versions: Brocade SANnav versions prior to 2.3.1 Brocade SANnav version 2.3.0a Description: A vulnerability in Brocade SANnav is related to insufficient protection of registration data in the PostgreSQL component. This could allow a privileged user to...

PT-2024-23088 · Kerlink +1 · Kerlink Firewall +2

Name of the Vulnerable Software and Affected Versions: ChirpStack chirpstack-mqtt-forwarder versions 4.2.0 and earlier ChirpStack chirpstack-gateway-bridge versions 4.0.10 and earlier Description: The Kerlink firewall in ChirpStack wrongly accepts certain TCP packets when a connection is not in t...

CVE-2024-29916

The CVE describes a vulnerability in dormakaba Saflok systems (pre‑November‑2023 software update) where an attacker who has a valid active or expired keycard for a property can unlock arbitrary doors via forged keycards. The root cause is a UID‑only based key derivation function, affecting Saflok...

Medium: wireshark

Issue Overview: An issue in Wireshark team Wireshark before v.4.2.0 allows a remote attacker to cause a denial of service via the packet-bgp.c, dissectbgpopentvbuffttvb, prototreetree, packetinfopinfo, optlen components. CVE-2024-24478 Affected Packages: wireshark Issue Correction: Run dnf update...

PT-2024-23089 · Distrobox · Distrobox

Name of the Vulnerable Software and Affected Versions: Distrobox versions prior to 1.7.0.1 Description: The issue allows attackers to execute arbitrary code via command injection into exported executables. Recommendations: For versions prior to 1.7.0.1, update to version 1.7.0.1 or later to resol...

CVE-2024-27105 Frappe File Permissions can by bypassed using certain endpoints

Frappe is a full-stack web application framework. Prior to versions 14.66.3 and 15.16.0, file permission can be bypassed using certain endpoints, granting less privileged users permission to delete or clone a file. Versions 14.66.3 and 15.16.0 contain a patch for this issue. No known workarounds...

PT-2024-22416 · Unknown · Myprestamodules Ordersexport

Name of the Vulnerable Software and Affected Versions: MyPrestaModules ordersexport versions 6.0.2 and earlier Description: The issue allows a remote attacker to execute arbitrary code via the "download.php" component. Recommendations: For versions 6.0.2 and earlier, update to a version that...

CVE-2024-27439 Apache Wicket: Possible bypass of CSRF protection

An error in the evaluation of the fetch metadata headers could allow a bypass of the CSRF protection in Apache Wicket. This issue affects Apache Wicket: from 9.1.0 through 9.16.0, and the milestone releases for the 10.0 series. Apache Wicket 8.x does not support CSRF protection via the fetch...

PT-2024-15869 · WordPress · Appointment Booking Calendar

Name of the Vulnerable Software and Affected Versions: Appointment Booking Calendar WordPress plugin versions prior to 1.3.83 Description: The issue concerns a lack of CSRF checks in certain areas, potentially allowing attackers to trick logged-in users into performing unwanted actions, such as...

KLA65226 Multiple vulnerabilities in Mozilla Thunderbird

Multiple vulnerabilities were found in Mozilla Thunderbird. Malicious users can exploit these vulnerabilities to cause denial of service, execute arbitrary code, obtain sensitive information, bypass security restrictions, gain privileges. Below is a complete list of vulnerabilities: 1. Out of...

CVE-2024-22412 ClickHouse's Role-based Access Control is bypassed when query caching is enabled.

ClickHouse is an open-source column-oriented database management system. A bug exists in the cloud ClickHouse offering prior to version 24.0.2.54535 and in github.com/clickhouse/clickhouse version 23.1. Query caching bypasses the role based access controls and the policies being enforced on roles...

PT-2024-2273 · Unitronics · Unilogic

Name of the Vulnerable Software and Affected Versions: Unitronics Unistream Unilogic versions prior to 1.35.227 Description: The issue is related to the use of less trusted sources, which may allow remote code execution. Exploitation of this issue could enable a remote attacker to execute arbitra...

PT-2024-2290 · Adobe · Animate

Name of the Vulnerable Software and Affected Versions: Adobe Animate versions 24.0, 23.0.3 and earlier Description: The issue is caused by a buffer overflow in dynamic memory, which could allow an attacker to execute arbitrary code by using a specially crafted file. Exploitation of this issue...

PT-2024-2918 · Ivanti · Ivanti Avalanche

Name of the Vulnerable Software and Affected Versions: Ivanti Avalanche versions prior to 6.4.3 Description: The issue is related to a Path Traversal vulnerability in the web component of Ivanti Avalanche. This vulnerability allows a remote authenticated attacker to delete specific types of files...

PT-2024-14652 · Linux +10 · Linux Kernel +10

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.7.0-rc3 Description: The Linux kernel has a vulnerability in the net/sched module, specifically in the act ct function. This function adds a reference to the skb socket buffer before defragmentation, which can...