PT-2024-4729 · Webmin +1 · Webmin +1

Name of the Vulnerable Software and Affected Versions: Webmin versions prior to 2.003 Description: The issue is related to improper handling of insufficient permissions or privileges in the ajaxterm module of Webmin. This could allow an unauthorized user to hijack a console session, potentially...

Citrix Systems Provisioning Security Vulnerability

Citrix Systems Provisioning is a software streaming technology push technology from Citrix Systems, Inc. It is used to deliver patches, updates, and other configuration information to multiple virtual desktop endpoints via a shared desktop image. A security vulnerability exists in versions prior ...

PT-2024-5861 · Glpi +2 · Glpi +2

Name of the Vulnerable Software and Affected Versions: GLPI versions prior to 10.0.16 Description: The issue is related to incorrect access control in the GLPI system, which provides ITIL Service Desk features, licenses tracking, and software auditing. An authenticated user can attach a document ...

WordPress Jobmonster theme < 4.7.5 - Unauthenticated Arbitrary File Deletion vulnerability

Unauthenticated Arbitrary File Deletion vulnerability discovered by Dave Jong Patchstack in WordPress Theme Jobmonster versions 4.7.5...

CVE-2024-39871

A vulnerability has been identified in SINEMA Remote Connect Server All versions V3.2 SP1. Affected applications do not properly separate the rights to edit device settings and to edit settings for communication relations. This could allow an authenticated attacker with the permission to manage...

DEBIAN-CVE-2024-5569

A Denial of Service DoS vulnerability exists in the jaraco/zipp library, affecting all versions prior to 3.19.1. The vulnerability is triggered when processing a specially crafted zip file that leads to an infinite loop. This issue also impacts the zipfile module of CPython, as features from the...

DEBIAN-CVE-2024-6383

The bsonstringappend function in MongoDB C Driver may be vulnerable to a buffer overflow where the function might attempt to allocate too small of buffer and may lead to memory corruption of neighbouring heap memory. This issue affects libbson versions prior to 1.27.1...

Artifex Ghostscript Security Vulnerability

Artifex Ghostscript is a set of free software compiled by Artifex, Inc. based on Adobe, PostScript, and the Page Description Language for Portable Document Format PDL. A security vulnerability exists in Artifex Ghostscript prior to version 10.03.0, which is caused by a stack-based buffer overflow...

CVE-2024-34597

Improper input validation in Samsung Health prior to version 6.27.0.113 allows local attackers to write arbitrary document files to the sandbox of Samsung Health. User interaction is required for triggering this vulnerability...

AZL-42996 CVE-2024-37371 affecting package krb5 for versions less than 1.21.3-1

In MIT Kerberos 5 aka krb5 before 1.21.3, an attacker can cause invalid memory reads during GSS message token handling by sending message tokens with invalid length fields...

CVE-2024-5736

Server Side Request Forgery SSRF vulnerability in AdmirorFrames Joomla! extension in afGdStream.php script allows to access local files or server pages available only from localhost. This issue affects AdmirorFrames: before 5.0...

CVE-2024-1153

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Talya Informatics Travel APPS allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Travel APPS: before v17.0.68...

Canonical Ubuntu Advantage Desktop Daemon Security Vulnerability

Canonical Ubuntu Advantage Desktop Daemon is a daemon from Canonical UK that allows desktop applications to interact with Ubuntu Advantage. A security vulnerability exists in Canonical Ubuntu Advantage Desktop Daemon versions prior to 1.12, which originated from passing the Pro token as a paramet...

Talya Informatics Travel APPS SQL Injection Vulnerability

Talya Informatics Travel APPS is a travel software from the Turkish company Talya Informatics. A SQL injection vulnerability exists in Talya Informatics Travel APPS prior to version v17.0.68, which stems from a vulnerability that allows an attacker to bypass authentication using misconfigured...

PT-2024-37585 · Canonical +1 · Ubuntu Advantage Desktop Daemon +2

Name of the Vulnerable Software and Affected Versions: Ubuntu Advantage Desktop Daemon versions prior to 1.12 Description: The Ubuntu Advantage Desktop Daemon leaks the Pro token to unprivileged users by passing the token as an argument in plaintext. Recommendations: For versions prior to 1.12,...

CVE-2024-5015

In WhatsUp Gold versions released before 2023.1.3, an authenticated SSRF vulnerability in Wug.UI.Areas.Wug.Controllers.SessionControler.Update allows a low privileged user to chain this SSRF with an Improper Access Control vulnerability. This can be used to escalate privileges to Admin...

CVE-2024-37107

Improper Privilege Management vulnerability in Membership Software WishList Member X allows Privilege Escalation.This issue affects WishList Member X: from n/a before 3.26.7...

WordPress Responsive video embed plugin < 0.5.1 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Felipe Caon in WordPress Plugin Responsive video embed versions 0.5.1...

PT-2024-27073 · Almela · Obx

Name of the Vulnerable Software and Affected Versions: almela obx versions prior to 0.0.4 Description: The issue allows arbitrary code execution via the obx/build/index.js component, specifically through the reduce function at @almela/obx/build/index.js:470 and Object.set at obx/build/index.js:26...

Shenzhen Guoxin Synthesis image system security vulnerability

Shenzhen Guoxin Synthesis image system is an image system from Shenzhen Guoxin Synthesis, a company based in Shenzhen, China. A security vulnerability exists in Shenzhen Guoxin Synthesis image system versions prior to 8.3.0, which stems from a default password of 123456Qw...