PT-2024-6113 · Cisco · Cisco Nx-Os +1

Name of the Vulnerable Software and Affected Versions: Cisco NX-OS Software affected versions not specified Description: The issue is related to insufficient security restrictions when executing application arguments from the Bash shell, allowing an authenticated, local attacker with privileges t...

DSA-5745-1 postgresql-15 - security update

Bulletin has no description...

CVE-2024-42366 VR Overlay RCE

VRCX is an assistant/companion application for VRChat. In versions prior to 2024.03.23, a CefSharp browser with over-permission and cross-site scripting via overlay notification can be combined to result in remote command execution. These vulnerabilities are patched in VRCX 2023.12.24. In additio...

CVE-2024-42357 Shopware vulnerable to blind SQL-injection in DAL aggregations

Shopware is an open commerce platform. Prior to versions 6.6.5.1 and 6.5.8.13, the Shopware application API contains a search functionality which enables users to search through information stored within their Shopware instance. The searches performed by this function can be aggregated using the...

CVE-2024-42356 Shopware vulnerable to Server Side Template Injection in Twig using Context functions

Shopware is an open commerce platform. Prior to versions 6.6.5.1 and 6.5.8.13, the context variable is injected into almost any Twig Template and allows to access to current language, currency information. The context object allows also to switch for a short time the scope of the Context as a...

PT-2024-26023 · Unknown · Paymentmanagerservice

Name of the Vulnerable Software and Affected Versions: PaymentManagerService versions prior to SMR Aug-2024 Release 1 Description: The issue is related to improper access control in the PaymentManagerService, allowing local attackers to bypass restrictions on starting services from the background...

PT-2024-38284 · WordPress · Accept Stripe Payments

Name of the Vulnerable Software and Affected Versions: Accept Stripe Payments plugin for WordPress versions up to and including 2.0.86 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the accept stripe payment ng shortcode. This...

SUSE-SU-2024:2792-1 Security update for the Linux Kernel (Live Patch 44 for SLE 15 SP3)

This update for the Linux Kernel 5.3.18-15030059161 fixes several issues. The following security issues were fixed: - CVE-2024-27398: Fixed use-after-free bug caused by scosocktimeout bsc1225013. - CVE-2024-35950: drm/client: Fully protect modes with dev-modeconfig.mutex bsc1225310. -...

Cybozu Office vulnerable to bypass browsing restrictions in Custom App

Overview Cybozu Office provided by Cybozu, Inc. contains a vulnerability which allows to bypass browsing restrictions in Custom App CWE-201. Cybozu, Inc. reported this vulnerability to JPCERT/CC to notify users of the solution through JVN. Impact A user who can login to the product may view data...

PT-2024-19883 · Zscaler · Zscaler Client Connector

Name of the Vulnerable Software and Affected Versions: Zscaler Client Connector versions prior to 4.2 Description: The issue arises from the Zscaler Updater process not validating the digital signature of the installer before execution. This allows arbitrary code to be locally executed...

Pimax Play and PiTool accept WebSocket connections from unintended endpoints

Overview Pimax Play and PiTool provided by Pimax accept WebSocket connections from unintended endpoints CWE-923. Rei Yano reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact Arbitrary code may be executed by a...

JVN#50850706: Pimax Play and PiTool accept WebSocket connections from unintended endpoints

Pimax Play and PiTool provided by Pimax accept WebSocket connections from unintended endpointsCWE-923. Impact Arbitrary code may be executed by a remote unauthenticated attacker. Solution Update the Software For Pimax Play, update the software to the latest version according to the information...

PT-2024-26960 · WordPress · Pinpoint Booking System

Name of the Vulnerable Software and Affected Versions: The Pinpoint Booking System WordPress plugin versions prior to 2.9.9.4.8 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This can occur even when the unfiltered html capabili...

PT-2024-25533 · Cosy+ · Cosy+

Name of the Vulnerable Software and Affected Versions: Cosy+ versions 21.x below 21.2s10 Cosy+ versions 22.x below 22.1s3 Description: The issue is related to code injection due to improper parameter blacklisting. This can be exploited with local network access. The estimated number of potentiall...

Error message when you try to update a Microsoft Windows-based computer: "0x80070002"

Error message when you try to update a Microsoft Windows-based computer: "0x80070002" Technical update: September 12, 2006 Microsoft has released a Microsoft Security Advisory on this problem for IT professionals. The security advisory contains additional security-related information about this...

MS10-096: Vulnerability in Windows Address Book could allow remote code execution

MS10-096: Vulnerability in Windows Address Book could allow remote code execution Applies To Windows 7 Enterprise Windows 7 Home Basic Windows 7 Home Premium Windows 7 Professional Windows 7 Ultimate Windows Server 2008 R2 Standard Windows Server 2008 R2 Enterprise Windows Server 2008 R2 Datacent...

PT-2024-35718 · WordPress · Breakdance

Name of the Vulnerable Software and Affected Versions: Breakdance plugin for WordPress versions up to, and including, 1.7.2 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows authenticated attackers with...

GHSA-55P7-V223-X366 IdentityServer Open Redirect vulnerability

Impact It is possible for an attacker to craft malicious Urls that certain functions in IdentityServer will incorrectly treat as local and trusted. If such a Url is returned as a redirect, some browsers will follow it to a third-party, untrusted site. Affected Methods - In the...

CGA-2R4P-9JQ9-GC3R

Bulletin has no description...

Apple fixes Siri vulnerabilities that could have allowed sensitive data theft from locked device. Update now!

Apple has released security updates for many of its products in order to patch several vulnerabilities that could allow an attacker to steal sensitive information from a locked device. Included in the patches for Apple Watch, iOS, and iPadOS are four vulnerabilities in Siri. While your device is...