CVE-2024-56327 Malicious plugin names, recipients, or identities can cause arbitrary binary execution in pyrage

pyrage is a set of Python bindings for the rage file encryption library age in Rust. pyrage uses the Rust age crate for its underlying operations, and age is vulnerable to GHSA-4fg7-vxc8-qx5w. All details of GHSA-4fg7-vxc8-qx5w are relevant to pyrage for the versions specified in this advisory. S...

PT-2024-10166

Name of the Vulnerable Software and Affected Versions: CyberPanel versions before f0cf648 Description: The issue is related to a lack of protection for the web page structure in the CyberPanel web hosting control panel. This can be exploited by a remote attacker to conduct cross-site scripting...

Important: ghostscript

Issue Overview: PS interpreter - check the type of the Pattern Implementation NOTE: https://bugs.ghostscript.com/showbug.cgi?id=707991 NOTE: https://cgit.ghostscript.com/cgi-bin/cgit.cgi/ghostpdl.git/commit/?id=f49812186baa7d1362880673408a6fbe8719b4f8 NOTE:...

PT-2024-9200 · Abb · Abb Aspect +2

Name of the Vulnerable Software and Affected Versions: ABB ASPECT - Enterprise version 3.08.02 NEXUS Series version 3.08.02 MATRIX Series version 3.08.02 Description: Cross Site Request Forgery vulnerabilities were found, providing a potential for exposing sensitive information or changing system...

PT-2024-35900 · Unknown · Random Banner

Name of the Vulnerable Software and Affected Versions: vinoth06 Random Banner versions 4.2.9 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows Stored XSS, which means an attacker can inject...

PT-2024-8816 · Intel · Intel Acat

Name of the Vulnerable Software and Affected Versions: IntelR ACAT software versions prior to 3.11.0 Description: The issue is related to an uncontrolled search path in the Intel Assistive Context-Aware Toolkit ACAT for Windows, which may allow an authenticated user to potentially enable escalati...

RHEL 7 : qemu-kvm-rhev (RHSA-2015:0643)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2015:0643 advisory. KVM Kernel-based Virtual Machine is a full virtualization solution for Linux on AMD64 and Intel 64 systems. The qemu-kvm-rhev package provides the...

RHEL 6 : openstack-swift (RHSA-2014:0367)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2014:0367 advisory. OpenStack Object Storage swift provides object storage in virtual containers, which allows users to store and retrieve files arbitrary data. The...

PT-2024-30818 · Unknown · Memberpress

Name of the Vulnerable Software and Affected Versions: Memberpress versions 1.11.34 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows accessing functionality not properly constrained by ACLs. Recommendations: For versions 1.11.34 and earlier,...

PT-2024-30336 · Unknown · Amp For Wp

Name of the Vulnerable Software and Affected Versions: AMP for WP versions 1.0.96.1 and earlier Description: The issue affects AMP for WP due to a Missing Authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. Recommendations: For versions...

Medium: python3.11-pip

Issue Overview: urllib3 is a user-friendly HTTP client library for Python. When using urllib3's proxy support with ProxyManager, the Proxy-Authorization header is only sent to the configured proxy, as expected. However, when sending HTTP requests without using urllib3's proxy support, it's possib...

Important: oath-toolkit

Issue Overview: oath-toolkit: Local root exploit in a PAM module CVE-2024-47191 Affected Packages: oath-toolkit Issue Correction: Run dnf update oath-toolkit --releasever 2023.6.20241010 or dnf update --advisory ALAS2023-2024-722 --releasever 2023.6.20241010 to update your system. More informatio...

Vulnerabilities fixed in Ivanti Cloud Services Appliance

Ivanti has fixed vulnerabilities in Cloud Services Appliance v 4.6. A malicious party could exploit the vulnerabilities to execute a command-injection via path-traversal, allowing the system to be operated and possibly taken over without prior authentication. Ivanti says it has information that t...

Medium: ruby3.2

Issue Overview: ruby: RCE vulnerability with .rdocoptions in RDoc CVE-2024-27281 ruby: Arbitrary memory address read vulnerability with Regex search CVE-2024-27282 Affected Packages: ruby3.2 Issue Correction: Run dnf update ruby3.2 --releasever 2023.5.20240819 or dnf update --advisory...

PT-2024-9038 · Totolink · Totolink X18

Name of the Vulnerable Software and Affected Versions: TOTOLINK X18 version 9.1.0cu.2024 B20220329 Description: A critical issue has been found in the TOTOLINK X18, affecting some unknown functionality of the file /cgi-bin/cstecgi.cgi. The manipulation of the enable argument leads to os command...

PT-2024-24827 · Johnson Controls · Kt1 +2

Name of the Vulnerable Software and Affected Versions: KT1, KT2, and KT400 controllers affected versions not specified Description: The issue concerns the broadcasting of sensitive information when the controller is in factory reset mode. Specifically, the controller broadcasts its MAC address,...

PT-2024-5462 · Google +6 · Google Chrome +6

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 126.0.6478.182 Microsoft Edge affected versions not specified Description: The issue is related to a use after free in the Media Stream component, which could allow a remote attacker to exploit heap corruption...

Low: postgresql

Issue Overview: postgresql: PostgreSQL pgstatsext and pgstatsextexprs lack authorization checks CVE-2024-4317 Affected Packages: postgresql Note: This advisory is applicable to Amazon Linux 2 - Postgresql14 Extra. Visit this page to learn more about Amazon Linux 2 AL2 Extras and this FAQ section...

Multiple vulnerabilities in "FreeFrom - the nostr client" App

Overview "FreeFrom - the nostr client" App provided by FreeFrom K.K. contains multiple vulnerabilities listed below. Improper verification of cryptographic signature CWE-347 - CVE-2024-36277 Reliance on obfuscation or encryption of security-relevant inputs without integrity checking CWE-649 -...

UBUNTU-CVE-2024-35226

Smarty is a template engine for PHP, facilitating the separation of presentation HTML/CSS from application logic. In affected versions template authors could inject php code by choosing a malicious file name for an extends-tag. Sites that cannot fully trust template authors should update asap. Al...