PT-2024-26162 · WordPress · Integration For Contact Form 7/Salesforce

Name of the Vulnerable Software and Affected Versions: Integration for Contact Form 7 and Salesforce versions 1.3.9 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the specified software, allowing unauthorized actions to be performed on behalf of a user without their...

PT-2024-20625 · Boldgrid · Boldgrid Total Upkeep

Name of the Vulnerable Software and Affected Versions: BoldGrid Total Upkeep versions 1.15.8 and earlier Description: The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as a 'Path Traversal' vulnerability, which allows Relative Path Traversal in...

CVE-2023-7258

A denial of service exists in Gvisor Sandbox where a bug in reference counting code in mount point tracking could lead to a panic, making it possible for an attacker running as root and with permission to mount volumes to kill the sandbox. We recommend upgrading past...

Medium: freerdp

Issue Overview: FreeRDP is a set of free and open source remote desktop protocol library and clients. In affected versions an integer overflow in freerdpbitmapplanarcontextreset leads to heap-buffer overflow. This affects FreeRDP based clients. FreeRDP based server implementations and proxy are n...

PT-2024-6157

Name of the Vulnerable Software and Affected Versions wolfSSL versions prior to 5.7.0 Description An issue was discovered in wolfSSL that leads to ECDSA key disclosure via a safe-error attack using Rowhammer, known as FAULT+PROBE. When WOLFSSL CHECK SIG FAULTS is used in signing operations with...

Infinite loop

Overview std/net is a Go standard library package std/net Affected versions of this package are vulnerable to Infinite loop. Go Vulnerability Report:A malformed DNS message in response to a query can cause the Lookup functions to get stuck in an infinite loop. Remediation Upgrade std/net to versi...

PT-2024-30531 · Unknown · Trix Editor

Name of the Vulnerable Software and Affected Versions: Trix editor versions prior to 2.1.4 Description: The issue is related to a bypass of a previous fix, allowing an attacker to execute arbitrary JavaScript code within the context of the user's session when pasting malicious code. This occurs...

AZL-40285 CVE-2024-34062 affecting package python-tqdm for versions less than 4.66.2-2

tqdm is an open source progress bar for Python and CLI. Any optional non-boolean CLI arguments e.g. --delim, --buf-size, --manpath are passed through python's eval, allowing arbitrary code execution. This issue is only locally exploitable and had been addressed in release version 4.66.3. All user...

DEBIAN-CVE-2024-34062

tqdm is an open source progress bar for Python and CLI. Any optional non-boolean CLI arguments e.g. --delim, --buf-size, --manpath are passed through python's eval, allowing arbitrary code execution. This issue is only locally exploitable and had been addressed in release version 4.66.3. All user...

AZL-40307 CVE-2024-34062 affecting package python-tqdm for versions less than 4.63.1-3

tqdm is an open source progress bar for Python and CLI. Any optional non-boolean CLI arguments e.g. --delim, --buf-size, --manpath are passed through python's eval, allowing arbitrary code execution. This issue is only locally exploitable and had been addressed in release version 4.66.3. All user...

PT-2024-25674

Name of the Vulnerable Software and Affected Versions tqdm versions prior to 4.66.3 Description tqdm is an open source progress bar for Python and CLI. Any optional non-boolean CLI arguments e.g. --delim, --buf-size, --manpath are passed through python's eval, allowing arbitrary code execution...

PT-2024-25575 · Unknown · Happykite Ultimate Under Construction

Name of the Vulnerable Software and Affected Versions: HappyKite Ultimate Under Construction versions 1.9.3 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for stored cross-site scripting XSS. This means that an attacker c...

AZL-43369 CVE-2024-30251 affecting package python-aiohttp 3.6.2-3

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In affected versions an attacker can send a specially crafted POST multipart/form-data request. When the aiohttp server processes it, the server will enter an infinite loop and be unable to process any further request...

freerdp: Out-Of-Bounds Read in nsc_rle_decompress_data

FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. Affected versions are subject to an Out-Of-Bounds Read in the nscrledecompressdata function. The Out-Of-Bounds Read occurs because it processes context-Planes without checking if it contains da...

PT-2024-25429 · Veritas · Veritas Backup Exec

Name of the Vulnerable Software and Affected Versions: Veritas Backup Exec versions prior to 22.2 HotFix 917391 Description: An issue was discovered in the Veritas Backup Exec software, where the Backup Exec Deduplication Multi-threaded Streaming Agent can be used to perform arbitrary file deleti...

PT-2024-11637 · Aazztech · Aazztech Post Slider

Name of the Vulnerable Software and Affected Versions: Aazztech Post Slider versions 1.6.7 and earlier Description: The issue is related to a Missing Authorization vulnerability. This vulnerability affects Aazztech Post Slider, allowing potential unauthorized access. Recommendations: For versions...

PT-2024-25412 · Matthew Fries · Mf Gig Calendar

Name of the Vulnerable Software and Affected Versions: Matthew Fries MF Gig Calendar versions 1.2.1 and earlier Description: A Cross-Site Request Forgery CSRF issue has been identified. This type of issue allows an attacker to trick a user into performing unintended actions on a web application...

PT-2024-24998 · Unknown · Max Addons Pro For Bricks

Name of the Vulnerable Software and Affected Versions: Max Addons Pro for Bricks versions 1.6.1 and earlier Description: The issue is related to a Missing Authorization vulnerability. This vulnerability affects Max Addons Pro for Bricks, allowing unauthorized access. Recommendations: For Max Addo...

DEBIAN-CVE-2024-32460

FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based based clients using /bpp:32 legacy GDI drawing path with a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, use modern drawin...

PT-2024-24705 · 10Web · Photo Gallery

Name of the Vulnerable Software and Affected Versions: Photo Gallery by 10Web versions 1.8.21 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Reflected XSS. Recommendations: For...