PT-2024-32788

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.58 Description The issue is related to the firmware loader in the Linux kernel, where certain code paths construct firmware file names from string components passed through from devices or semi-privileged...

CVE-2024-38859 XSS in view page with SLA column

XSS in the view page with the SLA column configured in Checkmk versions prior to 2.3.0p14, 2.2.0p33, 2.1.0p47 and 2.0.0 EOL allowed malicious users to execute arbitrary scripts by injecting HTML elements into the SLA column title. These scripts could be executed when the view page was cloned by...

AZL-47835 CVE-2024-42284 affecting package kernel for versions less than 5.15.167.1-1

In the Linux kernel, the following vulnerability has been resolved: tipc: Return non-zero value from tipcudpaddr2str on error tipcudpaddr2str should return non-zero value if the UDP media address is invalid. Otherwise, a buffer overflow access can occur in tipcmediaaddrprintf. Fix this by returni...

PT-2024-30540 · Unknown · Calamares-Nixos-Extensions

Name of the Vulnerable Software and Affected Versions: calamares-nixos-extensions versions prior to 0.3.17 Description: The issue affects users who installed NixOS through the graphical installer using manual disk partitioning, where the system boots via legacy BIOS, some disk partitions are...

Delphix Data Control Tower 安全漏洞

Delphix Data Control Tower Delphix DCT is a data control plane from Delphix, Inc. A security vulnerability exists in Delphix Data Control Tower versions prior to 19.0.0 that stems from the application's enable-scale-testing feature breaking authentication...

PT-2024-7563 · Google +4 · Google Chrome +4

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 130.0.6723.58 Microsoft Edge affected versions not specified Description: The issue is related to a use after free vulnerability in the Dawn component, which can be exploited by a remote attacker using a crafte...

PT-2024-28958 · Vodozemac · Vodozemac

Name of the Vulnerable Software and Affected Versions: vodozemac versions prior to 0.7.0 Description: The issue is related to the use of a non-constant time base64 implementation in vodozemac for importing key material for Megolm group sessions and PkDecryption Ed25519 secret keys. This flaw migh...

AZL-48322 CVE-2024-21165 affecting package mysql for versions less than 8.0.40-1

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Pluggable Auth. Supported versions that are affected are 8.0.37 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successfu...

WordPress CM Email Registration Blacklist and Whitelist plugin < 1.4.9 - Add/Delete Emails via CSRF Add and delete any item from blacklist/whitelist vulnerability

Add/Delete Emails via CSRF Add and delete any item from blacklist/whitelist vulnerability discovered by Felipe Caon in WordPress Plugin CM Email Registration Blacklist and Whitelist versions 1.4.9...

PT-2024-37369 · WordPress · Wp-Cart-For-Digital-Products

Name of the Vulnerable Software and Affected Versions: wp-cart-for-digital-products versions prior to 8.5.5 Description: The issue is related to a Reflected Cross-Site Scripting problem, where a parameter is not properly sanitised and escaped before being outputted back in the page. This could be...

CVE-2024-5715

The wp-eMember WordPress plugin before 10.6.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

Ping Identity PingFederate Security Vulnerability

Ping Identity PingFederate is a flagship software-based federation server in the United States. It is used for identity management. Ping Identity A security vulnerability exists in PingFederate versions prior to 12.0.1 that stems from the presence of a potential JSON injection attack vector using...

7-Zip Multiple Vulnerabilities - Windows

7zip is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:7-zip:7-zip"; ifdescription...

PT-2024-28454 · Mendelson · Mendelson As4

Name of the Vulnerable Software and Affected Versions: MENDELSON AS4 versions prior to 2024 B376 Description: The issue arises when a trading partner provides prepared XML data, exploiting a client-side vulnerability. This allows files to be written to the computer running the client process when...

PT-2024-28249 · Typo3 · Friendlycaptcha Official

Name of the Vulnerable Software and Affected Versions: friendlycaptcha official extension versions prior to 0.1.4 for TYPO3 Description: The issue allows a remote user to bypass the captcha check due to the extension's failure to verify the captcha field in submitted form data. This specifically...

FreeFrom Security Vulnerabilities

FreeFrom is an application from FreeFrom, Inc. dedicated to bringing privacy and free speech back to SNSs. A security vulnerability exists in FreeFrom versions prior to 1.3.5, which stems from improper application cryptographic signature validation that fails to detect event data with invalid...

CVE-2024-3429 Path Traversal in parisneo/lollms

A path traversal vulnerability exists in the parisneo/lollms application, specifically within the sanitizepathfromendpoint and sanitizepath functions in lollmscore\lollms\security.py. This vulnerability allows for arbitrary file reading when the application is running on Windows. The issue arises...

PT-2024-21311 · Parisneo · Lollms-Webui

Name of the Vulnerable Software and Affected Versions: parisneo/lollms-webui versions prior to 9.4 Description: A path traversal and arbitrary file upload vulnerability exists in the parisneo/lollms-webui application, specifically within the /switch personal path endpoint in ./lollms-webui/lollms...

Foxit PDF Editor < 13.1.2 Vulnerability

According to its version, the Foxit PDF Editor application previously named Foxit PhantomPDF installed on the remote Windows host is prior to 13.1.2. It is, therefore affected by vulnerability: - A privilege escalation vulnerability exists in the Foxit Reader 2024.2.0.25138. The vulnerability...

PT-2024-4242 · Google +6 · Google Chrome +6

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 126.0.6478.54 Microsoft Edge affected versions not specified Description: The issue is related to a use after free in the Dawn component, which can be exploited by a remote attacker using a crafted HTML page to...