PT-2024-6016 · Adobe · Indesign

Name of the Vulnerable Software and Affected Versions: Adobe InDesign Desktop versions ID18.5.2, ID19.3 and earlier Description: The issue is related to an out-of-bounds read that could lead to disclosure of sensitive memory. An attacker could leverage this to bypass mitigations such as ASLR...

PT-2024-26282 · Unknown · Fme Modules For Prestashop

Name of the Vulnerable Software and Affected Versions: FME Modules for PrestaShop helpdesk module versions up to 2.4.0 Description: The issue allows attackers to obtain sensitive information and cause other impacts. It is related to the Tickets::getsearchedtickets function. Recommendations: For...

CVE-2023-37898 Safe mode Cross-site Scripting (XSS) vulnerability in Joplin

Joplin is a free, open source note taking and to-do application. A Cross-site Scripting XSS vulnerability allows an untrusted note opened in safe mode to execute arbitrary code. packages/renderer/MarkupToHtml.ts renders note content in safe mode by surrounding it with and , without escaping any...

PT-2024-27958 · Lnd · Lnd

Name of the Vulnerable Software and Affected Versions: Lightning Network Daemon lnd versions prior to 0.17.0 Description: A parsing vulnerability in lnd's onion processing logic leads to a denial of service vector due to excessive memory allocation. Recommendations: For versions prior to 0.17.0,...

PT-2024-27488 · Unknown · Absolute Secure Access

Name of the Vulnerable Software and Affected Versions: Absolute Secure Access versions prior to 13.06 Description: There is a cross-site scripting issue in the Secure Access administrative UI. Attackers can pass a limited-length script to the administrative UI, which is then stored where an...

AZL-59699 CVE-2024-37891 affecting package python3 for versions less than 3.9.19-13

urllib3 is a user-friendly HTTP client library for Python. When using urllib3's proxy support with ProxyManager, the Proxy-Authorization header is only sent to the configured proxy, as expected. However, when sending HTTP requests without using urllib3's proxy support, it's possible to accidental...

DEBIAN-CVE-2024-37891

urllib3 is a user-friendly HTTP client library for Python. When using urllib3's proxy support with ProxyManager, the Proxy-Authorization header is only sent to the configured proxy, as expected. However, when sending HTTP requests without using urllib3's proxy support, it's possible to accidental...

[SECURITY] [DLA 3829-1] sendmail security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3829-1 [email protected] https://www.debian.org/lts/security/ Bastien Roucariès June 15, 2024 https://wiki.debian.org/LTS -...

CVE-2024-37313 Nextcloud server allows the by-pass the second factor

Nextcloud server is a self hosted personal cloud system. Under some circumstance it was possible to bypass the second factor of 2FA after successfully providing the user credentials. It is recommended that the Nextcloud Server is upgraded to 26.0.13, 27.1.8 or 28.0.4 and Nextcloud Enterprise Serv...

PT-2024-14190 · Unknown · Awesome Support

Name of the Vulnerable Software and Affected Versions: Awesome Support versions n/a through 6.1.5 Description: The issue is related to a Missing Authorization vulnerability in Awesome Support Team Awesome Support. Recommendations: For versions n/a through 6.1.5, update to a version later than 6.1...

Uncontrolled Resource Consumption ('Resource Exhaustion')

Overview Affected versions of this package are vulnerable to Uncontrolled Resource Consumption 'Resource Exhaustion' through the data transfer process. An attacker can disrupt service by sending specially crafted network requests. Remediation Upgrade Microsoft.Azure.Storage.DataMovement to versio...

PT-2024-26658 · Unknown · The Plus Addons For Elementor Page Builder

Name of the Vulnerable Software and Affected Versions: The Plus Addons for Elementor Page Builder Lite versions through 5.5.4 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS...

PT-2024-26650 · Unknown · Propertyhive

Name of the Vulnerable Software and Affected Versions: PropertyHive versions n/a through 2.0.13 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS, which allows Stored XSS. This means that an attacker can inject...

PT-2024-26683 · Unknown · Kenta Gutenberg Blocks

Name of the Vulnerable Software and Affected Versions: Kenta Gutenberg Blocks Responsive Blocks and block templates library for Gutenberg Editor versions 1.3.9 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site...

PT-2024-26358 · Unknown · Jupyter Server

Name of the Vulnerable Software and Affected Versions: Jupyter Server versions prior to 2.14.1 Description: The Jupyter Server on Windows has a vulnerability that lets unauthenticated attackers leak the NTLMv2 password hash of the Windows user running the Jupyter server. An attacker can crack thi...

SUSE CVE-2023-28998

The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server. Starting with version 3.0.0 and prior to version 3.6.5, a malicious server administrator can gain full access to an end-to-end encrypted folder. They can decrypt files, recover the folder structure, and add new...

PT-2024-27113 · WordPress · Brizy

Name of the Vulnerable Software and Affected Versions: Brizy – Page Builder plugin for WordPress versions up to, and including, 2.4.43 Description: The issue is related to Stored Cross-Site Scripting via the Link To field of multiple widgets due to insufficient input sanitization and output...

SUSE CVE-2024-24814

modauthopenidc is an OpenID Certifiedtm authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. In affected versions missing input validation on modauthopenidcsessionchunks cookie value makes the server vulnerable to a...

PT-2024-26583

Name of the Vulnerable Software and Affected Versions Church Admin versions n/a through 4.3.6 Description The issue is a Server-Side Request Forgery SSRF vulnerability. This means an attacker can potentially trick the server into making unauthorized requests, leading to various malicious outcomes...

CVE-2024-35196 Slack integration leaks sensitive information in logs in Sentry

Sentry is a developer-first error tracking and performance monitoring platform. Sentry's Slack integration incorrectly records the incoming request body in logs. This request data can contain sensitive information, including the deprecated Slack verification token. With this verification token, i...