PT-2024-6214 · Ivanti · Ivanti Epm

Name of the Vulnerable Software and Affected Versions: Ivanti EPM versions prior to 2022 SU6 Ivanti EPM versions prior to the 2024 September update Description: The issue is related to an uncontrolled search path in the agent of Ivanti EPM. This can be exploited by a local authenticated attacker...

Multiple Vulnerabilities in Veeam Backup & Replication

On Wednesday, September 4, 2024, backup and recovery software provider Veeam released their September security bulletin disclosing various vulnerabilities in Veeam products. One of the higher-severity vulnerabilities included in the bulletin is CVE-2024-40711, a critical unauthenticated remote co...

Pgpool-II vulnerable to information disclosure

Overview Pgpool-II is a cluster management tool. Pgpool-II contains an information disclosure vulnerability CWE-213 in its query cache function. PgPool Global Development Group reported this vulnerability to IPA to notify users of its solution through JVN. JPCERT/CC and PgPool Global Development...

PT-2024-9674 · Synology · Synology Router Manager

Name of the Vulnerable Software and Affected Versions: Synology Router Manager versions prior to 1.3.1-9346-10 Description: The issue is related to the DDNS Record component of Synology Router Manager, where improper neutralization of input during web page generation allows for Cross-site Scripti...

PT-2024-9665 · Synology · Synology Router Manager

Name of the Vulnerable Software and Affected Versions: Synology Router Manager SRM versions prior to 1.3.1-9346-10 Description: The issue is related to improper neutralization of input during web page generation, which can lead to Cross-site Scripting attacks. Remote authenticated users with...

PT-2024-9668 · Synology · Synology Router Manager

Name of the Vulnerable Software and Affected Versions: Synology Router Manager versions prior to 1.3.1-9346-10 Description: The issue is related to improper neutralization of input during web page generation, also known as Cross-site Scripting XSS, in the Network WOL functionality. This could all...

CGA-87MM-7CV7-9JRW

Bulletin has no description...

DLA-3879-1 bluez - security update

Bulletin has no description...

CVE-2024-45039 gnark's Groth16 commitment extension unsound for more than one commitment

gnark is a fast zk-SNARK library that offers a high-level API to design circuits. Versions prior to 0.11.0 have a soundness issue - in case of multiple commitments used inside the circuit the prover is able to choose all but the last commitment. As gnark uses the commitments for optimized...

JVN#32529796: Multiple products from KINGSOFT JAPAN vulnerable to path traversal

KINGSOFT JAPAN, INC. provides Kingsoft Office Software's WPS Office and its related products localized for Japan. WPS Office and its related products provided by KINGSOFT JAPAN, INC. contain a path traversal vulnerability CWE-22, CVE-2024-7262, CVE-2024-7263 due to inadequate file path validation...

CGA-9Q36-6J98-PCXF

Bulletin has no description...

CVE-2024-45053 Remote Code Execution Vulnerability via SSTI in Fides Webserver Jinja Email Templating Engine

Fides is an open-source privacy engineering platform. Starting in version 2.19.0 and prior to version 2.44.0, the Email Templating feature uses Jinja2 without proper input sanitization or rendering environment restrictions, allowing for Server-Side Template Injection that grants Remote Code...

RUSTSEC-2024-0383 bcc is unmaintained

bcc will no longer be maintained as declared by the developer. Users are recommended to use libbpf-rs instead. See libbpf-rs...

CVE-2024-45450

Permission control vulnerability in the software update module. Impact: Successful exploitation of this vulnerability may affect service confidentiality...

CVE-2024-45450

Permission control vulnerability in the software update module. Impact: Successful exploitation of this vulnerability may affect service confidentiality...

CVE-2024-45450

Permission control vulnerability in the software update module. Impact: Successful exploitation of this vulnerability may affect service confidentiality...

CVE-2024-45450

CVE-2024-45450 describes a privilege control vulnerability in the software update module affecting Huawei’s HarmonyOS and EMUI. The vulnerability is documented as a permission control issue with potential impact to service confidentiality. Reported CVSS data indicate a HIGH base score from NVD (A...

CVE-2024-45450: Exposure of Sensitive Information to an Unauthorized Actor

Permission control vulnerability in the software update module. Impact: Successful exploitation of this vulnerability may affect service confidentiality...

PT-2024-26063 · Dressroom · Dressroom

Name of the Vulnerable Software and Affected Versions: Dressroom versions prior to SMR Sep-2024 Release 1 Description: The issue is related to improper access control in item selection, allowing local attackers to access protected data. User interaction is required to trigger this issue. There is...

PT-2025-18104 · Docker · Docker Desktop

Name of the Vulnerable Software and Affected Versions: Docker Desktop versions prior to 4.41.0 Description: A vulnerability in the update process of Docker Desktop for Windows could allow a local, low-privileged attacker to escalate privileges to SYSTEM. During an update, Docker Desktop attempts ...