Open Redirect

Overview com.liferay.portal:com.liferay.portal.impl is a package part of Liferay. Affected versions of this package are vulnerable to Open Redirect via the redirect, FORWARDURL, noSuchEntryRedirect, and other parameters that rely on the HtmlUtil.escapeRedirect process. An attacker can redirect...

Open Redirect

Overview Affected versions of this package are vulnerable to Open Redirect via the comliferayaddresswebinternalportletCountriesManagementAdminPortletredirect parameter. An attacker can cause users to be redirected to arbitrary external URLs by enticing them to visit a crafted link. Remediation...

SUSE CVE-2024-26308

Allocation of Resources Without Limits or Throttling vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.21 before 1.26. Users are recommended to upgrade to version 1.26, which fixes the issue...

PT-2024-18002 · WordPress · Paid Membership Subscriptions

Name of the Vulnerable Software and Affected Versions: Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress versions up to, and including, 2.11.1 Description: The issue is related to unauthorized modification of data due to a missin...

AZL-43564 CVE-2024-25710 affecting package apache-commons-compress 1.19-3

Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.3 through 1.25.0. Users are recommended to upgrade to version 1.26.0 which fixes the issue...

PT-2024-2688

Name of the Vulnerable Software and Affected Versions Apache Commons Compress versions 1.21 through 1.25 Description The issue is related to an uncontrolled resource consumption vulnerability in Apache Commons Compress, which can be exploited by an attacker to impact the availability of protected...

Medium: jsoup

Issue Overview: jsoup is a Java HTML parser, built for HTML editing, cleaning, scraping, and cross-site scripting XSS safety. jsoup may incorrectly sanitize HTML including javascript: URL expressions, which could allow XSS attacks when a reader subsequently clicks that link. If the non-default...

UBUNTU-CVE-2024-24750

Undici is an HTTP/1.1 client, written from scratch for Node.js. In affected versions calling fetchurl and not consuming the incoming body or consuming it very slowing will lead to a memory leak. This issue has been addressed in version 6.6.1. Users are advised to upgrade. Users unable to upgrade...

Code Injection

Overview Affected versions of this package are vulnerable to Code Injection due to incorrect handling of certain XML files. An attacker can achieve remote code execution by crafting malicious XML files that exploit the vulnerability. Note: This CVE was released to notify about the release of a fi...

Resource Exhaustion

Overview Microsoft.AspNetCore.App.Runtime.win-x64 is a package providing a default set of APIs for building an ASP.NET Core application. Contains assets used for self-contained deployments. Affected versions of this package are vulnerable to Resource Exhaustion due to improper handling of certain...

Denial of Service (DoS)

Overview Microsoft.AspNetCore.App.Runtime.linux-arm64 is a package providing a default set of APIs for building an ASP.NET Core application. Contains assets used for self-contained deployments. Affected versions of this package are vulnerable to Denial of Service DoS when parsing X509 certificate...

AZL-42537 CVE-2024-24814 affecting package mod_auth_openidc 2.4.14.2-2

modauthopenidc is an OpenID Certified™ authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. In affected versions missing input validation on modauthopenidcsessionchunks cookie value makes the server vulnerable to a...

PYSEC-2024-125

DIRAC is a distributed resource framework. In affected versions any user could get a token that has been requested by another user/agent. This may expose resources to unintended parties. This issue has been addressed in release version 8.0.37. Users are advised to upgrade. There are no known...

CVE-2024-24820 Icinga Director configuration is susceptible to Cross-Site Request Forgery

Icinga Director is a tool designed to make Icinga 2 configuration handling easy. Not any of Icinga Director's configuration forms used to manipulate the monitoring environment are protected against cross site request forgery CSRF. It enables attackers to perform changes in the monitoring...

PT-2024-17599 · Unknown · Concrete Cms

Name of the Vulnerable Software and Affected Versions: Concrete CMS version 9 before 9.2.5 Description: The issue concerns stored XSS in file tags and description attributes. Administrator-entered file attributes are not sufficiently sanitized in the Edit Attributes page, allowing a rogue...

GHSA-C57V-4VG5-CM2X Apache Pulsar SASL Authentication Provider observable timing discrepancy vulnerability

Observable timing discrepancy vulnerability in Apache Pulsar SASL Authentication Provider can allow an attacker to forge a SASL Role Token that will pass signature verification. Users are recommended to upgrade to version 2.11.3, 3.0.2, or 3.1.1 which fixes the issue. Users should also consider...

PT-2024-20114 · Truelayer · Truelayer.Client +1

Name of the Vulnerable Software and Affected Versions: TrueLayer.Client versions prior to v1.6.0 Description: The issue could potentially allow a malicious actor to gain control over the destination URL of the HttpClient used in the API classes. For applications using the SDK, requests to...

PT-2024-1421 · Jenkins +1 · Jenkins Gitlab Branch Source Plugin +2

Name of the Vulnerable Software and Affected Versions: Jenkins GitLab Branch Source Plugin versions 684.vea fa 7c1e2fe3 and earlier Description: The issue is related to a cross-site request forgery CSRF vulnerability. This vulnerability allows attackers to connect to an attacker-specified URL. Th...

PT-2024-19987 · Oracle · Jdk

Name of the Vulnerable Software and Affected Versions: SOFARPC versions prior to 5.12.0 Description: SOFARPC is a Java RPC framework that defaults to using the SOFA Hessian protocol to deserialize received data. The SOFA Hessian protocol uses a blacklist mechanism to restrict deserialization of...

PT-2024-20042 · Unknown · Embedchain

Name of the Vulnerable Software and Affected Versions: Embedchain versions prior to 0.1.57 Description: The issue allows a ReDoS regular expression denial of service via a long string to json.py. This occurs in the JSON loader of Embedchain. Recommendations: For versions prior to 0.1.57, update t...