KLA64772 Multiple vulnerabilities in Google Chrome

Multiple vulnerabilities were found in Google Chrome. Malicious users can exploit these vulnerabilities to execute arbitrary code, cause denial of service. Below is a complete list of vulnerabilities: 1. Out of bounds memory access vulnerability in V8 can be exploited to cause denial of service. ...

Medium: gnutls

Issue Overview: A vulnerability was found in GnuTLS. The response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct PKCS1 v1.5 padding. This issue may allow a remote attacker to perform a timing side-channel attack in the RSA-PSK ke...

Medium: openexr

Issue Overview: Due to a failure in validating the number of scanline samples of a OpenEXR file containing deep scanline data, Academy Software Foundation OpenEX image parsing library version 3.2.1 and prior is susceptible to a heap-based buffer overflow vulnerability. CVE-2023-5841 Affected...

PT-2024-18746 · Samsung · Samsung Internet

Name of the Vulnerable Software and Affected Versions: Samsung Internet versions prior to 24.0.3.2 Description: The issue is related to an improper validation vulnerability that allows local attackers to execute arbitrary code. This vulnerability can be exploited by local attackers...

PT-2024-17936 · WordPress · Events Tickets Plus +1

Name of the Vulnerable Software and Affected Versions: Event Tickets and Registration WordPress plugin versions prior to 5.8.1 Events Tickets Plus WordPress plugin versions prior to 5.9.1 Description: The issue allows users with at least the contributor role to leak the existence of certain event...

Medium: wpa_supplicant

Issue Overview: wpasupplicant: potential authorization bypass CVE-2023-52160 Affected Packages: wpasupplicant Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories. Issue Correction: Run yum...

Important: cpio

Issue Overview: cpio 2.11, when using the --no-absolute-filenames option, allows local users to write to arbitrary files via a symlink attack on a file in an archive. CVE-2015-1197 Affected Packages: cpio Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ...

openSUSE: Security Advisory for python (SUSE-SU-2023:3972-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2024-22157

Name of the Vulnerable Software and Affected Versions Sirv Image Optimizer, Resizer and CDN versions through 7.2.0 Description A Missing Authorization issue affects the Image Optimizer, Resizer and CDN – Sirv. Recommendations For versions through 7.2.0, update to a version that contains a fix for...

PT-2024-12786 · Dell · Dell Update Package

Name of the Vulnerable Software and Affected Versions: Dell Update Package DUP versions prior to 4.9.10 Description: The issue allows a malicious user with local access to the system to potentially exploit it and run arbitrary code as admin. This is due to an Uncontrolled Search Path vulnerabilit...

PT-2024-14003 · WordPress · Melapress Wp Activity Log

Name of the Vulnerable Software and Affected Versions: Melapress WP Activity Log versions through 4.6.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can...

PT-2024-21224 · Woocommerce · Nuggethon Custom Order Statuses For Woocommerce

Name of the Vulnerable Software and Affected Versions: Nuggethon Custom Order Statuses for WooCommerce versions 1.5.2 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended...

Advisory ROSA-SA-2024-2359

software: postgresql 12.16 WASP: ROSA-CHROME packageevrstring: postgresql-12.16-1.src.rpm CVE-ID: CVE-2023-2454 BDU-ID: 2023-03247 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the Schema Handler component of the PostgreSQL database management system is related to access delimitation flaws...

PT-2024-20907 · Thesycon · Tusbaudio

Name of the Vulnerable Software and Affected Versions: Thesycon Software Solutions Gmbh & Co. KG TUSBAudio versions prior to 5.68.0 Description: An issue in TUSBAudio MSI-based installers allows a local attacker to execute arbitrary code via the msiexec.exe repair mode. This enables a local...

PT-2024-3141

Name of the Vulnerable Software and Affected Versions Tutor LMS versions up to, and including, 2.6.1 Description The issue is related to a SQL Injection vulnerability due to insufficient protection of the SQL query structure when handling the question id parameter. This allows a remote attacker t...

PT-2024-19442 · Gecko Sdk · Gecko Sdk

Name of the Vulnerable Software and Affected Versions: Gecko SDK versions through 4.4.0 Description: The issue arises from the use of a True Random Number Generator TRNG before its initialization by the ECDSA signing driver when exiting low-power modes EM2/EM3 on Virtual Secure Vault VSE devices...

PT-2024-17568 · WordPress · Essential Addons For Elementor

Name of the Vulnerable Software and Affected Versions: The Essential Addons for Elementor plugin for WordPress versions up to, and including, 5.9.8 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping in the label icon paramet...

PT-2024-21319 · Liferay · Liferay Dxp +1

Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.2.0 through 7.4.3.13 Liferay DXP 7.4 before update 10 Liferay DXP 7.3 before update 4 Liferay DXP 7.2 before fix pack 17 Liferay DXP older unsupported versions Liferay Portal older unsupported versions Description:...

PT-2024-17421 · WordPress · Wp Recipe Maker

Name of the Vulnerable Software and Affected Versions: WP Recipe Maker plugin for WordPress versions up to, and including, 9.1.2 Description: The issue allows authenticated attackers with subscriber-level access and above to perform SQL Injection via the recipes parameter due to insufficient...

Medium: lua

Issue Overview: In Lua 5.4.3, an erroneous finalizer called during a tail call leads to a heap-based buffer over-read. CVE-2021-45985 An issue in the component luaGrunerror of Lua v5.4.4 and below leads to a heap-buffer overflow when a recursive error occurs. CVE-2022-33099 Affected Packages: lua...