UBUNTU-CVE-2023-49582

Lax permissions set by the Apache Portable Runtime library on Unix platforms would allow local users read access to named shared memory segments, potentially revealing sensitive application data. This issue does not affect non-Unix platforms, or builds with APRUSESHMEMSHMGET=1 apr.h Users are...

PT-2024-28349

Name of the Vulnerable Software and Affected Versions Gnuboard versions 6.0.4 and below Description An Open Redirect issue exists in Gnuboard. The issue is due to a flaw in the url parameter within the login path. This allows an attacker to redirect users to a malicious website. The vulnerable...

PT-2024-30176

Name of the Vulnerable Software and Affected Versions fastapi-admin pro version 0.1.4 Description A cross-site scripting XSS vulnerability in the Config-Create function allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Product Name parameter...

PT-2024-5853 · Hitachi · Hitachi Ops Center Common Services

Name of the Vulnerable Software and Affected Versions: Hitachi Ops Center Common Services versions 10.9.3-00 through 11.0.2-01 Description: The issue is related to an authentication bypass in Hitachi Ops Center Common Services, which could allow an attacker to bypass the authentication process...

PT-2024-38840 · Sourcecodester · Sourcecodester Qr Code Bookmark System

Name of the Vulnerable Software and Affected Versions: SourceCodester QR Code Bookmark System version 1.0 Description: A vulnerability was found in the system, affecting some unknown processing of the file /endpoint/delete-bookmark.php. The manipulation of the bookmark argument leads to cross-sit...

PT-2024-38831 · Sourcecodester · Sourcecodester Daily Calories Monitoring Tool

Name of the Vulnerable Software and Affected Versions: SourceCodester Daily Calories Monitoring Tool version 1.0 Description: A vulnerability was found in the SourceCodester Daily Calories Monitoring Tool. This issue affects the file /endpoint/delete-calorie.php and is related to the manipulation...

AZL-48156 CVE-2024-43398 affecting package rubygem-rexml for versions less than 3.3.9-1

REXML is an XML toolkit for Ruby. The REXML gem before 3.3.6 has a DoS vulnerability when it parses an XML that has many deep elements that have same local name attributes. If you need to parse untrusted XMLs with tree parser API like REXML::Document.new, you may be impacted to this vulnerability...

PT-2024-5977 · Microsoft · Edge

Name of the Vulnerable Software and Affected Versions: Microsoft Edge Chromium-based versions up to 128.0.2739.41 Description: The vulnerability in Microsoft Edge Chromium-based is related to insufficient input validation. Exploitation of this issue may allow an attacker to execute arbitrary code...

PT-2024-35729

Name of the Vulnerable Software and Affected Versions Ultimate Store Kit Elementor Addons, Woocommerce Builder, EDD Builder, Elementor Store Builder, Product Grid, Product Table, Woocommerce Slider plugin versions up to 1.6.4 Description The issue concerns PHP Object Injection via deserialization...

PT-2024-5878

Name of the Vulnerable Software and Affected Versions Flatpak versions prior to 1.14.0 and 1.15.10 Description The issue is related to how Flatpak handles persistent directories, allowing a malicious or compromised Flatpak app to access and write files outside of its intended sandbox. This is...

Cleartext Transmission of Sensitive Information

Overview Affected versions of this package are vulnerable to Cleartext Transmission of Sensitive Information via the TlsStream process. An attacker can gain access to sensitive information by intercepting unencrypted data. Remediation Upgrade Microsoft.NETCore.App.Runtime.linux-x64 to version 8.0...

CVE-2024-29831 Apache DolphinScheduler: RCE by arbitrary js execution

Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server. If you are using the switch task plugin, please upgrade to version 3.2.2...

Medium: thunderbird

Issue Overview: A heap overflow vulnerability exists in libvpx - Encoding a frame that has larger dimensions than the originally configured size with VP9 may result in a heap overflow in libvpx. We recommend upgrading to version 1.13.1 or above CVE-2023-6349 Affected Packages: thunderbird Note:...

OESA-2024-1918 avro security update

Apache Avro is a data serialization system. Security Fixes: When deserializing untrusted or corrupted data, it is possible for a reader to consume memory beyond the allowed constraints and thus lead to out of memory on the system. This issue affects Java applications using Apache Avro Java SDK up...

Insertion of Sensitive Information into Log File

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File when utilizing multiple Eureka server service URLs with basic auth and encountering an issue with fetching the service registry. An attacker can gain access to credentials by examining th...

PT-2024-28355 · Roundup · Roundup

Name of the Vulnerable Software and Affected Versions: Roundup versions prior to 2.4.0 Description: The issue allows for cross-site scripting XSS via a SCRIPT element in an HTTP Referer header. Recommendations: For versions prior to 2.4.0, update to version 2.4.0 or later to resolve the issue...

PYSEC-2024-66

dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. When a user installs a package in dbt, it has the ability to override macros, materializations, and other core components of dbt. This is by design, as it...

Cookie Tossing

Overview Affected versions of this package are vulnerable to Cookie Tossing due to a missing Host- prefix on the gitpodiojwt2 session cookie. This allows an adversary who controls a subdomain to set the value of the cookie on the Gitpod control plane, which can be assigned to an attacker’s own JW...

Cookie Tossing

Overview Affected versions of this package are vulnerable to Cookie Tossing due to a missing Host- prefix on the gitpodiojwt2 session cookie. This allows an adversary who controls a subdomain to set the value of the cookie on the Gitpod control plane, which can be assigned to an attacker’s own JW...

PT-2024-28731 · Npm · @Jmondi/Url-To-Png

Name of the Vulnerable Software and Affected Versions: @jmondi/url-to-png versions prior to 2.1.2 Description: The issue arises from the lack of sanitization of the ImageId input in the code, leading to a path traversal vulnerability. This allows an attacker to store an image in an arbitrary...