SUSE CVE-2024-37885

The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with your computer. A code injection in Nextcloud Desktop Client for macOS allowed to load arbitrary code when starting the client with DYLDINSERTLIBRARIES set in the enviroment. It is recommended that the Nextcloud...

CVE-2024-37882

CVE-2024-37882 affects Nextcloud Server (and Enterprise Server per advisory) where a recipient of a share with read&share permissions could reshared the item with higher permissions. The NVD entry lists higher impact on confidentiality and integrity (C/H, I/H) but no availability impact, with net...

PT-2024-4412 · Nextcloud +1 · Nextcloud Notes +1

Name of the Vulnerable Software and Affected Versions: Nextcloud Notes versions prior to 4.9.3 Description: The issue is related to the possibility of sharing a folder called Notes/ with a newly created user before they log in, allowing a remote attacker to access confidential information...

PT-2024-5958 · Adobe · Experience Manager

Name of the Vulnerable Software and Affected Versions: Adobe Experience Manager versions 6.5.20 and earlier Description: The issue is related to a reflected Cross-Site Scripting XSS vulnerability, which may allow an attacker to execute malicious JavaScript content within the context of a victim's...

PT-2024-26647 · Hasthemes · Ht Feed

Name of the Vulnerable Software and Affected Versions: HasThemes HT Feed versions 1.2.8 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS in HasThemes HT Feed...

Observable Timing Discrepancy

Overview Affected versions of this package are vulnerable to Observable Timing Discrepancy due to the handling of RSA premaster secrets when an invalid secret is received. An attacker can potentially observe timing differences by exploiting the additional processing performed when the premaster...

Remote Code Execution (RCE)

Overview unisharp/laravel-filemanager is an A file upload/editor intended for use with Laravel 5 to 6 and CKEditor / TinyMCE. Affected versions of this package are vulnerable to Remote Code Execution RCE through using a valid mimetype and inserting the . character after the php file extension. Th...

PT-2024-36426

Name of the Vulnerable Software and Affected Versions The LearnPress – WordPress LMS Plugin plugin for WordPress versions up to, and including, 4.2.6.8 Description The issue is related to Sensitive Information Exposure due to the incorrect implementation of the get items permissions check functio...

Interpretation Conflict

Overview std/archive/zip is a Go standard library package std/archive/zip Affected versions of this package are vulnerable to Interpretation Conflict. Go Vulnerability Report: due to inconsistent handling of certain malformed zip files in the archive/zip process. An attacker can cause different...

Improper Check for Unusual or Exceptional Conditions

Overview std/net/netip is a Go standard library package std/net/netip Affected versions of this package are vulnerable to Improper Check for Unusual or Exceptional Conditions. Go Vulnerability Report:The various Is methods IsPrivate, IsLoopback, etc did not work as expected for IPv4-mapped IPv6...

PT-2024-26571 · Formwork · Formwork

Name of the Vulnerable Software and Affected Versions: Formwork versions prior to 1.13.0 Description: A cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Content field. Users with access to the administration panel wit...

PT-2024-26363 · Meshery · Meshery

Name of the Vulnerable Software and Affected Versions: Meshery versions prior to 0.7.22 Description: A SQL injection vulnerability may lead to arbitrary file write by using a SQL injection stacked queries payload, and the ATTACH DATABASE command. Attackers may be able to access and modify any dat...

OESA-2024-1601 youker-assistant security update

Integrated tool to aid in routine system maintenance tasks Kylin Assistant is a tool designed to help Ubuntu and Ubuntu Kylin desktop users manage and maintain many aspects of their working environment conveniently in a single application, providing a consistent user experience. Security Fixes: A...

PT-2024-40241 · Laravel · Laravel

Name of the Vulnerable Software and Affected Versions: Laravel versions prior to 4.1.29 Description: The issue concerns mass assignment vulnerabilities in Laravel when not using the fillable property on models or when using guarded and passing user-controlled arrays into update or save functions...

Heap-based Buffer Overflow

Overview Affected versions of this package are vulnerable to Heap-based Buffer Overflow due to a stack buffer overrun in the Double Parse routine. An attacker can execute arbitrary code by supplying a specially crafted input that triggers the buffer overrun. Remediation Upgrade...

Heap-based Buffer Overflow

Overview nokogiri is a gem for parsing HTML, XML, SAX, and Reader. Affected versions of this package are vulnerable to Heap-based Buffer Overflow through the xmlHTMLPrintFileContext function in xmllint.c. An attacker can read memory contents that may contain sensitive data by triggering a buffer...

Arbitrary Code Injection

Overview ngx-extended-pdf-viewer is a powerful, full-featured PDF viewer for Angular applications. Whether you're building enterprise tools or internal utilities, this library gives you the control and customization options you need, all while preserving a native-like viewing experience. Built on...

PT-2024-25511 · Logpoint · Logpoint

Name of the Vulnerable Software and Affected Versions: Logpoint versions prior to 7.4.0 Description: An issue was discovered in Logpoint where an attacker can enumerate a valid list of usernames by observing the response time at the "Forgot Password" endpoint. Recommendations: For versions prior ...

Integer Overflow to Buffer Overflow

Overview Affected versions of this package are vulnerable to Integer Overflow to Buffer Overflow in the ComposeQueryMallocExMm function. An attacker can exploit this vulnerability by supplying a long string to the function. Remediation Upgrade uriparser to version 0.9.8 or higher. References -...

CVE-2023-37244

The affected AutomationManager.AgentService.exe application contains a TOCTOU race condition vulnerability that allows standard users to create a pseudo-symlink at C:\ProgramData\N-Able Technologies\AutomationManager\Temp, which could be leveraged by an attacker to manipulate the process into...