12579 matches found
Low: thunderbird
Issue Overview: The encrypted subject of an email message could be incorrectly and permanently assigned to an arbitrary other email message in Thunderbird's local cache. Consequently, when replying to the contaminated email message, the user might accidentally leak the confidential subject to a...
JVN#94521208: Multiple vulnerabilities in FitNesse
FitNesse contains multiple vulnerabilities listed below. Multiple cross-site scripting CWE-79 - CVE-2024-23604, CVE-2024-28128 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N| Base Score: 6.1 CVSS v2| AV:N/AC:M/Au:N/C:N/I:P/A:N| Base Score: 4.3 Improper...
PT-2024-2912 · Ivanti · Ivanti Avalanche
Name of the Vulnerable Software and Affected Versions: Ivanti Avalanche versions prior to 6.4.3 Description: The issue is related to a Path Traversal vulnerability in the web component of Ivanti Avalanche. This vulnerability is due to incorrect restriction of the directory path name with limited...
MGASA-2024-0062 Updated mplayer packages fix security vulnerabilities
The MPlayer Project mencoder SVN-r38374-13.0.1 is vulnerable to Divide By Zero via the function config of llibmpcodecs/vfscale.c. CVE-2022-38850 Certain The MPlayer Project products are vulnerable to Out-of-bounds Read via function readmetarecord of mplayer/libmpdemux/asfheader.c. This affects...
PT-2024-4249
Name of the Vulnerable Software and Affected Versions Apache CXF versions prior to 4.0.4 Apache CXF versions prior to 3.6.3 Apache CXF versions prior to 3.5.8 Description A Server-Side Request Forgery SSRF vulnerability in Apache CXF's Aegis DataBinding allows an attacker to perform SSRF style...
Cisco IOS XR Software SNMP Management Plane Protection ACL Bypass Vulnerability
A vulnerability in the UDP forwarding code of Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to bypass configured management plane protection policies and access the Simple Network Management Plane SNMP server of an affected device. This vulnerability is due to incorrect...
PT-2024-22522 · Dedecms · Dedecms
Name of the Vulnerable Software and Affected Versions: DedeCMS version 5.7 Description: A Cross-Site Request Forgery CSRF issue was found in DedeCMS. The vulnerability can be exploited via the "/dede/diy add.php" API endpoint. Recommendations: For DedeCMS version 5.7, update to a version that...
Apache Pulsar: Pulsar Functions Worker Allows Unauthorized File Access and Unauthorized HTTP/HTTPS Proxying
The Pulsar Functions Worker includes a capability that permits authenticated users to create functions where the function's implementation is referenced by a URL. The supported URL schemes include "file", "http", and "https". When a function is created using this method, the Functions Worker will...
Intel Chipset Software and SPS Advisory - Lenovo Support US
No description provided...
RLSA-2024:0950 Important: postgresql:15 security update
PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: postgresql: non-owner 'REFRESH MATERIALIZED VIEW CONCURRENTLY' executes arbitrary SQL CVE-2024-0985 For more details about the security issues, including the impact, a CVSS score, acknowledgments, and oth...
PT-2024-21789 · Unknown · A-Blog Cms
Name of the Vulnerable Software and Affected Versions: a-blog cms versions 3.1.x through 3.1.9 and earlier a-blog cms versions 3.0.x through 3.0.30 and earlier a-blog cms versions 2.11.x through 2.11.59 and earlier a-blog cms versions 2.10.x through 2.10.51 and earlier a-blog cms version 2.9 and...
PT-2024-2105 · Ibm · Ibm Qradar Siem On Azure Cloud
Name of the Vulnerable Software and Affected Versions: Open Management Infrastructure OMI versions prior to the fixed version IBM QRadar SIEM on Azure Cloud versions 7.3.3 through 7.5.0 Description: The Open Management Infrastructure OMI Remote Code Execution Vulnerability is related to the use o...
PT-2024-20679 · Unknown · Skysea Client View
Name of the Vulnerable Software and Affected Versions: SKYSEA Client View versions from Ver.11.220 prior to Ver.19.2 Description: An improper access control issue exists in the resident process of SKYSEA Client View. This issue can be exploited to execute an arbitrary process with SYSTEM privileg...
2024.1 IPU - Intel® Chipset Software and SPS Advisory
Summary: Potential security vulnerabilities in the Intel® Converged Security Management Engine CSME installer, Intel® Local Manageability Service software and Intel® Server Platform Servcies SPS may allow information disclosure, escalation of privilege, or denial of service. Vulnerability Details...
DLA-3759-1 qemu - security update
Bulletin has no description...
PT-2024-17787 · WordPress · User Registration
Name of the Vulnerable Software and Affected Versions: User Registration WordPress plugin versions prior to 2.12 Description: The issue allows users with at least the contributor role to render sensitive shortcodes, which can be used to generate and leak valid password reset URLs. This enables th...
DSA-5638-1 libuv1 - security update
Bulletin has no description...
SUSE-SU-2024:0811-1 Security update for go1.21
This update for go1.21 fixes the following issues: - Upgrade go to version 1.21.8 - CVE-2023-45289: net/http, net/http/cookiejar: incorrect forwarding of sensitive headers and cookies on HTTP redirect bsc1221000 - CVE-2023-45290: net/http: memory exhaustion in Request.ParseMultipartForm bsc122100...
CVE-2024-23283
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 16.7.6 and iPadOS 16.7.6, macOS Monterey 12.7.4, macOS Sonoma 14.4, macOS Ventura 13.6.5. An app may be able to access user-sensitive data...