JVN#42445661: Multiple vulnerabilities in Smart-tab

Smart-tab provided by TECHNO SUPPORT COMPANY is a multi-functional guest room tablet system for hotels and other accommodation facilities. Smart-tab contains multiple vulnerabilities listed below. Active debug code CWE-489 CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Base Score 6.8 CVE-2024-41999...

CKEditor 40.x < 43.1.1 XSS Vulnerability

CKEditor 5 is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

PT-2024-29643 · Unknown · Mf Teacher Performance Management System

Name of the Vulnerable Software and Affected Versions: MF Teacher Performance Management System version 6 Description: A cross-site scripting issue exists, allowing an arbitrary script to be executed on the user's web browser if exploited. This can occur when a user accesses the website using the...

PT-2024-31819 · Facebook · Facebook Thrift

Name of the Vulnerable Software and Affected Versions: Facebook Thrift versions v2024.09.09.00 through v2024.09.23.00 Description: A null-dereference vulnerability involving parsing requests specifying invalid protocols can cause the application to crash or potentially result in other undesirable...

Fedora 39 : chromium (2024-e60359f212)

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-e60359f212 advisory. Update to 129.0.6668.70 High CVE-2024-9120: Use after free in Dawn High CVE-2024-9121: Inappropriate implementation in V8 High CVE-2024-9122: Type...

PT-2024-9621 · Gstreamer +7 · Gstreamer +7

Name of the Vulnerable Software and Affected Versions: GStreamer versions prior to 1.24.10 Description: A vulnerability has been discovered in the qtdemux merge sample table function within qtdemux.c, which is part of the GStreamer library. This issue is related to an out-of-bounds OOB read in...

PHP < 8.1.30, 8.2.x < 8.2.24, 8.3.x < 8.3.12 Multiple Vulnerabilities - Windows

PHP is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:php:php"; if description...

CVE-2024-45838

The goTenna Pro ATAK Plugin does not encrypt callsigns in messages. It is advised to not use sensitive information in callsigns when using this and previous versions of the plugin. Update to current plugin version which uses AES-256 encryption for callsigns in encrypted operation...

PT-2024-32454 · Agnai · Agnai

Name of the Vulnerable Software and Affected Versions: Agnai versions prior to 1.0.330 Description: A vulnerability in Agnai permits attackers to read arbitrary JSON files at attacker-chosen locations on the server, leading to unauthorized access to sensitive information and exposure of...

PT-2024-32527 · Givewp · Givewp

Name of the Vulnerable Software and Affected Versions: GiveWP versions prior to 3.15.2 Description: A Cross-Site Request Forgery CSRF issue affects GiveWP, allowing unauthorized actions to be performed on behalf of a user without their knowledge. Recommendations: For versions prior to 3.15.2,...

Tenable Nessus Network Monitor < 6.5.0 Multiple Vulnerabilities (TNS-2024-17)

Tenable Nessus Network Monitor is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Ubuntu: Security Advisory (USN-7030-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2024-39268 · WordPress · Bulk Noindex & Nofollow Toolkit

Name of the Vulnerable Software and Affected Versions: The Bulk NoIndex & NoFollow Toolkit plugin for WordPress versions up to, and including, 2.15 Description: The issue is related to Reflected Cross-Site Scripting due to the use of remove query arg without appropriate escaping on the URL. This...

kernel: dm: call the resume method on internal suspend

A flaw was found in the Linux kernel’s device-mapper dm component. The issue arises during internal suspend operations where the resume method is not correctly called. This issue leads to problems such as list corruption, specifically observed when running the lvm2 test suite. The problem occurs...

PT-2024-39218 · WordPress · Beam Me Up Scotty – Back To Top Button

Name of the Vulnerable Software and Affected Versions: Beam me up Scotty – Back to Top Button plugin for WordPress versions up to, and including, 1.0.21 Description: The issue is related to Reflected Cross-Site Scripting due to the use of add query arg without proper escaping on the URL. This...

PT-2024-39011 · Themehunk · Easy Mega Menu Plugin

Name of the Vulnerable Software and Affected Versions: Easy Mega Menu Plugin for WordPress – ThemeHunk plugin versions up to, and including, 1.0.9 Description: The issue arises from a missing capability check on several functions hooked via AJAX, allowing authenticated attackers with...

PT-2024-39318 · WordPress · Anwp Football Leagues

Name of the Vulnerable Software and Affected Versions: AnWP Football Leagues plugin for WordPress versions up to, and including, 0.16.7 Description: The issue is related to Stored Cross-Site Scripting via SVG File uploads due to insufficient input sanitization and output escaping. This allows...

Security Bulletin: Vulnerability in jackson-databind affects IBM watsonx.data

Summary FasterXML jackson-databind could allow a remote attacker to execute arbitrary code on the system and could allow a remote attacker to obtain sensitive information. This can affect watsonx.data. This can affect IBM watsonx.data Vulnerability Details CVEID:CVE-2019-12384 DESCRIPTION:...

PT-2024-12235

Name of the Vulnerable Software and Affected Versions CoreDNS versions 1.10.1 and earlier Description The issue allows attackers to achieve DNS cache poisoning and inject fake responses via a birthday attack, enabling them to manipulate DNS responses. Recommendations For CoreDNS versions 1.10.1 a...

PT-2024-12164 · Unknown · Technitium

Name of the Vulnerable Software and Affected Versions: Technitium versions through 11.0.2 Description: An issue in the software enables attackers to launch amplification attacks, potentially causing denial-of-service DoS with an amplification factor three times higher than other software like BIN...