SUSE CVE-2020-8911

A padding oracle vulnerability exists in the AWS S3 Crypto SDK for GoLang versions prior to V2. The SDK allows users to encrypt files with AES-CBC without computing a Message Authentication Code MAC, which then allows an attacker who has write access to the target's S3 bucket and can observe...

PT-2024-16401 · WordPress · Wp Travel Engine

Name of the Vulnerable Software and Affected Versions: The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress versions prior to 6.2.2 Description: The issue is related to a missing capability check on the wpte onboard save function callback function, allowing...

"Kura Sushi Official App Produced by EPARK" for Android uses a hard-coded cryptographic key

Overview "Kura Sushi Official App Produced by EPARK" for Android provided by EPARK, Inc. uses a hard-coded cryptographic key CWE-321. Nishimura Reiji of LAC Co., Ltd. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership...

Fedora 37 : freerdp (2022-076b1c9978)

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-076b1c9978 advisory. Update to 2.9.0 CVE-2022-39316, CVE-2022-39317, CVE-2022-39318, CVE-2022-39319, CVE-2022-39320, CVE-2022-41877 and CVE-2022-39347. Tenable has...

Fedora 41 : chromium (2024-8008ddbd4e)

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-8008ddbd4e advisory. Update to 129.0.6668.70 High CVE-2024-9120: Use after free in Dawn High CVE-2024-9121: Inappropriate implementation in V8 High CVE-2024-9122: Type...

Fedora 41 : syncthing (2024-aa6e72c713)

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-aa6e72c713 advisory. Update to version 1.28.0. Release notes: https://github.com/syncthing/syncthing/releases/tag/v1.28.0 Tenable has extracted the preceding description...

Mozilla Thunderbird ESR Security Update (MFSA2024-61) - Windows

Mozilla Thunderbird ESR is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Fedora 41 : thunderbird (2024-2b2993a69d)

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-2b2993a69d advisory. Update to 128.4.0 https://www.thunderbird.net/en-US/thunderbird/128.4.0esr/releasenotes/...

Fedora 37 : pgadmin4 (2022-2d5a6f48e1)

The remote Fedora 37 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2022-2d5a6f48e1 advisory. Fix compatibility with newer python-azure-mgmt-rdbms. ---- Update to pgadmin4-6.17, see https://www.pgadmin.org/docs/pgadmin4/development/releasenotes617.htm...

Intel® MAS Software Advisory

Summary: A potential security vulnerability in some Intel® Memory and Storage Tool Intel® MAS software may allow escalation of privilege. Intel is releasing software updates to mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2024-34164 Description: Uncontrolled search pat...

OpenJDK: integer truncation issue in Xalan-J (JAXP, 8285407)

The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are recommended to update to version 2.7.3 o...

PT-2024-16565 · Unknown · Phpgurukul Hospital Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Hospital Management System version 4.0 Description: A vulnerability was found in the PHPGurukul Hospital Management System, affecting some unknown processing of the file hms/doctor/search.php. The manipulation of the argument...

PT-2024-23522 · Unknown · Chamilo Lms

Name of the Vulnerable Software and Affected Versions: Chamilo LMS version 1.11.26 Description: The issue is related to Incorrect Access Control, allowing non-admin users to manipulate sensitive profile information via the "main/auth/profile" endpoint. This poses a significant risk to data...

PT-2024-37655 · WordPress · Sip Reviews Shortcode

Name of the Vulnerable Software and Affected Versions: SIP Reviews Shortcode for WooCommerce plugin for WordPress versions up to, and including, 1.2.3 Description: The issue is related to SQL Injection via the no of reviews attribute in the "woocommerce reviews" shortcode. This occurs due to...

Security update for go1.21-openssl

This update for go1.21-openssl fixes the following issues: CVE-2024-34158: Fixed stack exhaustion in Parse in go/build/constraint bsc1230254. CVE-2024-34156: Fixed stack exhaustion in Decoder.Decode in encoding/gob bsc1230253. CVE-2024-34155: Fixed stack exhaustion in all Parse functions...

PT-2024-34223 · Yith · Yith Woocommerce Product Add-Ons

Name of the Vulnerable Software and Affected Versions: YITH WooCommerce Product Add-Ons versions prior to 4.14.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Reflected XSS. Recommendations...

PT-2024-9136 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 15.10 through 17.3.5 GitLab CE/EE versions 17.4 through 17.4.2 GitLab CE/EE versions 17.5 through 17.5.0 Description: An issue has been discovered in GitLab CE/EE that could allow an attacker to inject HTML into the Glob...

PT-2024-39498 · WordPress · Wordpress Social Share Buttons

Name of the Vulnerable Software and Affected Versions: WordPress Social Share Buttons plugin versions up to, and including, 1.19 Description: The WordPress Social Share Buttons plugin is vulnerable to Reflected Cross-Site Scripting due to the use of add query arg without appropriate escaping on t...

PT-2025-8840

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.9.0-rc6+ Description A vulnerability in the Linux kernel has been identified, specifically in the nvkm module. The issue arises when handling large RPC requests, where the r535 gsp cmdq push function waits for...

PT-2024-30992 · Apple · Itunes +1

Name of the Vulnerable Software and Affected Versions: Apple TV versions prior to 1.5.0.152 iTunes versions prior to 12.13.3 Description: A stack buffer overflow issue was addressed through improved input validation. Parsing a maliciously crafted video file may lead to unexpected system...