Medium: dovecot

Issue Overview: Dovecot reports: A DoS is possible with a large number of address headers or abnormally large email headers. CVE-2024-23185 Affected Packages: dovecot Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL2 Cor...

Google Chrome Security Update (stable-channel-update-for-desktop_18-2024-12) - Linux

Google Chrome is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:google:chrome"; ifdescription...

Fedora 40 : ColPack (2024-dd633679a9)

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-dd633679a9 advisory. - Fix for CVE-2024-55566. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...

GHSA-2P6P-9RC9-62J9 Craft CMS has potential RCE when PHP `register_argc_argv` config setting is enabled

Impact You are affected if your php.ini configuration has registerargcargv enabled. Patches Update to 3.9.14, 4.13.2, or 5.5.2. Workarounds If you can't upgrade yet, and registerargcargv is enabled, you can disable it to mitigate the issue...

PT-2024-11634 · Microsoft · Windows 11 +1

Name of the Vulnerable Software and Affected Versions: Windows 11 version 10.0.22000.593 Windows Server 2022 version 10.0.20348.643 Description: An access violation vulnerability exists in the DirectComposition functionality of the win32kbase.sys driver. A specially-crafted set of syscalls can le...

openSUSE Security Advisory (SUSE-SU-2024:4358-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2024-16215 · Unknown · Elementsready Addons For Elementor

Name of the Vulnerable Software and Affected Versions: ElementsReady Addons for Elementor versions up to, and including, 6.4.8 Description: The issue allows authenticated attackers, with Contributor-level access and above, to extract sensitive private, pending, and draft template data due to...

Debian: Security Advisory (DSA-5832-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

KLA78282 Multiple vulnerabilities in Foxit Reader

Multiple vulnerabilities were found in Foxit Reader. Malicious users can exploit these vulnerabilities to execute arbitrary code, cause denial of service, gain privileges. Below is a complete list of vulnerabilities: 1. Use after free vulnerability can be exploited to cause denial of service or...

PT-2024-36160 · Unknown · Wp-Nerd Toolkit

Name of the Vulnerable Software and Affected Versions: WP-NERD Toolkit versions n/a through 1.1 Description: The issue is related to the exposure of sensitive system information to an unauthorized control sphere. This problem affects the WP-NERD Toolkit, allowing unauthorized access to confidenti...

JVN#08430039: "Shonen Jump+" App for Android fails to restrict custom URL schemes properly

"Shonen Jump+" App for Android provided by SHUEISHA INC. provides the function to access a requested URL using Custom URL Scheme. The App does not restrict access to the function properly CWE-939 which may be exploited to direct the App to access any sites. Impact A remote attacker may lead a use...

PT-2024-36272 · Unknown · Push Monkey Pro – Web Push Notifications +1

Name of the Vulnerable Software and Affected Versions: Push Monkey Pro – Web Push Notifications and WooCommerce Abandoned Cart versions n/a through 3.9 Description: The issue is a Cross-Site Request Forgery CSRF problem, which allows for Cross Site Request Forgery. This means an attacker can tric...

Fedora: Security Advisory (FEDORA-2024-8f83d0ed92)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2024-36328 · Unknown · Gaxx Keywords

Name of the Vulnerable Software and Affected Versions: Gaxx Keywords versions n/a through 0.2 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web application,...

NVIDIA Drivers: Privilege Escalation

Background NVIDIA Drivers are NVIDIA's accelerated graphics driver. Description A vulnerability has been discovered in NVIDIA Drivers. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifier for details. Workaround There is no known...

Exploit for Path Traversal in Ghost

Proof of Concept PoC for CVE-2023-40028 CVE-2023-40028 is a...

PT-2024-17661 · WordPress · Svg Shortcode

Name of the Vulnerable Software and Affected Versions: SVG Shortcode plugin for WordPress versions up to, and including, 1.0.1 Description: The issue is related to Stored Cross-Site Scripting via SVG File uploads due to insufficient input sanitization and output escaping. This allows...

PT-2024-12457 · WordPress · Easy Social Icons

Name of the Vulnerable Software and Affected Versions: Easy Social Icons versions 3.2.4 and earlier Description: A broken access control vulnerability has been identified in the Easy Social Icons plugin for WordPress. This issue allows exploiting incorrectly configured access control security...

PT-2024-36184 · Unknown · Yalla Ya! Simple Payment

Name of the Vulnerable Software and Affected Versions: yalla ya! Simple Payment versions 2.3.7 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Reflected XSS, where an attacker can...

PT-2024-12830 · Supsystic · Popup By Supsystic

Name of the Vulnerable Software and Affected Versions: Popup by Supsystic versions 1.10.19 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. This exposes broken access control,...