PT-2024-22781 · Dell · Dell Powerprotect Data Domain

Name of the Vulnerable Software and Affected Versions: Dell PowerProtect Data Domain versions prior to 7.13.0.0 Dell PowerProtect Data Domain LTS 7.7.5.40 Dell PowerProtect Data Domain LTS 7.10.1.30 Description: The issue is related to a weak cryptographic algorithm. A remote unauthenticated...

CVE-2024-3561 Custom Field Suite <= 2.6.7 - Authenticated (Contributor+) SQL Injection via Term Custom Field

The Custom Field Suite plugin for WordPress is vulnerable to SQL Injection via the the 'Term' custom field in all versions up to, and including, 2.6.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible f...

CVE-2024-3561: Improper Neutralization of Special Elements used in an SQL Command

The Custom Field Suite plugin for WordPress is vulnerable to SQL Injection via the the 'Term' custom field in all versions up to, and including, 2.6.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible f...

PT-2024-26568 · WordPress · Custom Field Suite

Name of the Vulnerable Software and Affected Versions: Custom Field Suite plugin for WordPress versions up to, and including, 2.6.7 Description: The issue allows authenticated attackers with contributor-level access and above to perform SQL Injection via the Term custom field. This is due to...

CVE-2024-5661

An issue has been identified in both XenServer 8 and Citrix Hypervisor 8.2 CU1 LTSR which may allow a malicious administrator of a guest VM to cause the host to become slow and/or unresponsive...

Deciphering LilacSquid’s Strategies for Long-Term Data Theft

...

PT-2024-35110

Name of the Vulnerable Software and Affected Versions scikit-learn versions up to and including 1.4.1.post1 Description A sensitive data leakage issue was identified in scikit-learn's TfidfVectorizer. The vulnerability arises from the unexpected storage of all tokens present in the training data...

Security Bulletin: IBM App Connect Enterprise Certified Container Dashboard and DesignerAuthoring operands are vulnerable to arbitrary code execution due to [CVE-2024-29651]

Summary Node.js module @apidevtools/json-schema-ref-parser is used by IBM App Connect Enterprise Certified Container for processing JSON schemas defining the App Connect Enterprise administration API. IBM App Connect Enterprise Certified Container Dashboard and DesignerAuthoring operands are...

EulerOS 2.0 SP12 : python-paramiko (EulerOS-SA-2024-1750)

According to the versions of the python-paramiko package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to...

Huawei EulerOS: Security Advisory for python-paramiko (EulerOS-SA-2024-1773)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2024-40783 · Git +1 · Ghostscript

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a crash type of UNKNOWN READ, with a crash state involving functions such as chunk free object, gs memory chunk unwrap, and gs j...

EulerOS Virtualization 2.11.0 : libssh2 (EulerOS-SA-2024-1629)

According to the versions of the libssh2 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attacke...

EulerOS Virtualization 2.11.0 : python-paramiko (EulerOS-SA-2024-1635)

According to the versions of the python-paramiko package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote...

CVE-2024-4434

The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to time-based SQL Injection via the ‘termid’ parameter in versions up to, and including, 4.2.6.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...

GHSA-8XFC-GM6G-VGPV Bouncy Castle certificate parsing issues cause high CPU usage during parameter evaluation.

An issue was discovered in ECCurve.java and ECCurve.cs in Bouncy Castle Java BC Java before 1.78, BC Java LTS before 2.73.6, BC-FJA before 1.0.2.5, and BC C .Net before 2.3.1. Importing an EC certificate with crafted F2m parameters can lead to excessive CPU consumption during the evaluation of th...

PT-2024-31134

Name of the Vulnerable Software and Affected Versions LearnPress – WordPress LMS Plugin versions up to, and including, 4.2.6.5 Description The issue allows for time-based SQL Injection due to insufficient escaping on the user-supplied term id parameter and lack of sufficient preparation on the...

PVS | StreamService cannot access vDisks after reboot

Intermittent problems with the StreamService of the PVS servers. Infrequently, when the PVS server boots, the StreamService is unable to access the vDisks. The event logs show the error message "Login failed error code: 2 for device : Server : vDisk file access permission denied". Two short-term...

USN-6754-2 nghttp2 vulnerability

USN-6754-1 fixed vulnerabilities in nghttp2. This update provides the corresponding update for Ubuntu 24.04 LTS. Original advisory details: It was discovered that nghttp2 incorrectly handled the HTTP/2 implementation. A remote attacker could possibly use this issue to cause nghttp2 to consume...

[SECURITY] Debian 10 LTS will reach end-of-life on June 30th, 2024

Dear Debian LTS users, This is a gentle reminder that Debian 10 "buster" will reach end of support as the LTS release on June 30, 2024. Users are encouraged to upgrade to Debian 11 "bullseye". Starting in July, Debian will not provide further security updates for Debian 10. A subset of buster...

[SECURITY] Debian 10 LTS will reach end-of-life on June 30th, 2024

Dear Debian LTS users, This is a gentle reminder that Debian 10 "buster" will reach end of support as the LTS release on June 30, 2024. Users are encouraged to upgrade to Debian 11 "bullseye". Starting in July, Debian will not provide further security updates for Debian 10. A subset of buster...