Improper Neutralization

Overview std/net/mail is a Go standard library package std/net/mail Affected versions of this package are vulnerable to Improper Neutralization. Go Vulnerability Report: The ParseAddressList function incorrectly handles comments text within parentheses within display names. Since this is a...

PT-2024-22154 · Atahualpa · Atahualpa

Name of the Vulnerable Software and Affected Versions: Atahualpa versions 3.7.24 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web application that the us...

PT-2024-40388 · Pypi · Pypop

Name of the Vulnerable Software and Affected Versions: PyPop versions prior to 1.0.2 Description: Code scanning revealed a possible issue in C extensions for PyPop, involving incorrect function calls, such as missing arguments or wrongly typed arguments, and redundant null pointers...

PT-2024-21639 · Kirby · Kirby

Name of the Vulnerable Software and Affected Versions: Kirby versions prior to 4.1.1 Description: Kirby is a content management system. The new link field introduced in Kirby 4 allows several different link types that each validate the entered link to the relevant URL format. It also includes a...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the /convert/html endpoint when a request is made to a file via localhost, such as . By exploiting this vulnerability, an attacker can achieve local file inclusion, allowing of sensitive files read o...

Apache Answer Race Condition vulnerability

Concurrent Execution using Shared Resource with Improper Synchronization 'Race Condition' vulnerability in Apache Answer. This issue affects Apache Answer through 1.2.1. Repeated submission during registration resulted in the registration of the same user. When users register, if they rapidly...

PT-2024-14103 · Hertzbeat · Hertzbeat

Name of the Vulnerable Software and Affected Versions: Hertzbeat versions prior to 1.4.1 Description: Hertzbeat is a real-time monitoring system. In CalculateAlarm.java, AviatorEvaluator is used to directly execute the expression function, and no security policy is configured, resulting in...

PT-2024-21302

Name of the Vulnerable Software and Affected Versions mjml versions 0.10.0 through 0.10.x mjml version 0.11.0 is not affected, as it contains the fix for this issue. However, versions prior to 0.10.0 are also not affected. Description The issue affects users of the mjml-python library who insert...

PT-2024-21295 · Xwiki · Xwiki Application Licensing

Name of the Vulnerable Software and Affected Versions: XWiki Application Licensing versions prior to 1.24.2 Description: The XWiki licensor application includes a public document Licenses.Code.LicenseJSON that exposes sensitive information, including the instance's id, first and last name, and...

Server-Side Request Forgery (SSRF)

Overview decidim-templates is a This module provides a solution to create templates for different Decidim models, such as Proposals and Questionnaires. Affected versions of this package are vulnerable to Server-Side Request Forgery SSRF due to the authenticity token check being disabled for the...

Insecure Default Initialization of Resource

Overview com.liferay.portal:com.liferay.portal.impl is a package part of Liferay. Affected versions of this package are vulnerable to Insecure Default Initialization of Resource via the Liferay-Portal response header. An attacker can obtain sensitive version information by sending crafted HTTP...

Open Redirect

Overview com.liferay.portal:com.liferay.portal.impl is a package part of Liferay. Affected versions of this package are vulnerable to Open Redirect via the redirect, FORWARDURL, noSuchEntryRedirect, and other parameters that rely on the HtmlUtil.escapeRedirect process. An attacker can redirect...

Open Redirect

Overview Affected versions of this package are vulnerable to Open Redirect via the comliferayaddresswebinternalportletCountriesManagementAdminPortletredirect parameter. An attacker can cause users to be redirected to arbitrary external URLs by enticing them to visit a crafted link. Remediation...

SUSE CVE-2024-26308

Allocation of Resources Without Limits or Throttling vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.21 before 1.26. Users are recommended to upgrade to version 1.26, which fixes the issue...

PT-2024-18002 · WordPress · Paid Membership Subscriptions

Name of the Vulnerable Software and Affected Versions: Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress versions up to, and including, 2.11.1 Description: The issue is related to unauthorized modification of data due to a missin...

AZL-43564 CVE-2024-25710 affecting package apache-commons-compress 1.19-3

Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.3 through 1.25.0. Users are recommended to upgrade to version 1.26.0 which fixes the issue...

Medium: jsoup

Issue Overview: jsoup is a Java HTML parser, built for HTML editing, cleaning, scraping, and cross-site scripting XSS safety. jsoup may incorrectly sanitize HTML including javascript: URL expressions, which could allow XSS attacks when a reader subsequently clicks that link. If the non-default...

UBUNTU-CVE-2024-24750

Undici is an HTTP/1.1 client, written from scratch for Node.js. In affected versions calling fetchurl and not consuming the incoming body or consuming it very slowing will lead to a memory leak. This issue has been addressed in version 6.6.1. Users are advised to upgrade. Users unable to upgrade...

Code Injection

Overview Affected versions of this package are vulnerable to Code Injection due to incorrect handling of certain XML files. An attacker can achieve remote code execution by crafting malicious XML files that exploit the vulnerability. Note: This CVE was released to notify about the release of a fi...

Resource Exhaustion

Overview Microsoft.AspNetCore.App.Runtime.win-x64 is a package providing a default set of APIs for building an ASP.NET Core application. Contains assets used for self-contained deployments. Affected versions of this package are vulnerable to Resource Exhaustion due to improper handling of certain...