CVE-2024-53856 rPGP Panics on Malformed Untrusted Input

rPGP is a pure Rust implementation of OpenPGP. Prior to 0.14.1, rPGP allows an attacker to trigger rpgp crashes by providing crafted data. This vulnerability is fixed in 0.14.1...

Important: Red Hat Security Advisory: RHOAI 2.16.0 - Red Hat OpenShift AI

Updated images are now available for Red Hat OpenShift AI. Release of RHOAI 2.16.0 provides these changes:...

Fedora 40 : thunderbird (2024-515180fdb3)

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-515180fdb3 advisory. Update to 128.5.0 https://www.thunderbird.net/en-US/thunderbird/128.5.0esr/releasenotes/...

PT-2024-36396

Name of the Vulnerable Software and Affected Versions socat versions prior to 1.8.0.2 Description The issue is related to the readline.sh file in socat, which relies on the /tmp/$USER/stderr2 file. This can lead to an arbitrary file overwrite via a predictable /tmp directory. Recommendations For...

PT-2024-36005

Name of the Vulnerable Software and Affected Versions: Mobile Security Framework MobSF versions prior to 4.2.9 Description: The application allows users to upload files with scripts in the filename parameter. As a result, a malicious user can upload a script file to the system. When users in the...

PT-2024-9532 · Hitachi · Hitachi Ops Center Common Services +1

Name of the Vulnerable Software and Affected Versions: Hitachi Ops Center Common Services versions 10.9.3-00 through 11.0.3-00 Hitachi Ops Center OVA versions 10.9.3-00 through 11.0.2-01 Description: The issue is related to the use of default credentials in Hitachi Ops Center Common Services, whi...

PT-2024-17004 · WordPress · Wordpress Pinterest Plugin

Name of the Vulnerable Software and Affected Versions: WordPress Pinterest Plugin versions up to, and including, 1.8.8 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'gs pin widget' shortcode due to insufficient input sanitization and output escaping on...

PT-2024-35862 · Berg Informatik · Berg Informatik Stripe Donation

Name of the Vulnerable Software and Affected Versions: Berg Informatik Stripe Donation versions 1.2.5 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows stored cross-site scripting XSS. This means that an attacker can inject...

PT-2024-35879 · Unknown · Content Audit Exporter

Name of the Vulnerable Software and Affected Versions: Content Audit Exporter versions 1.1 and earlier Description: The issue allows exposure of sensitive system information to an unauthorized control sphere, enabling the retrieval of embedded sensitive data. This is due to a vulnerability in the...

PT-2024-35439 · Dcme-320 +3 · Dcme-320 +3

Name of the Vulnerable Software and Affected Versions: DCME-320 versions prior to 7.4.12.90 DCME-520 versions prior to 9.25.5.11 DCME-320-L versions prior to 9.3.5.26 DCME-720 versions prior to 9.1.5.11 Description: The issue allows for Remote Code Execution and Privilege Escalation via the...

PT-2024-16540 · WordPress · The Restaurant & Cafe Addon For Elementor

Name of the Vulnerable Software and Affected Versions: The Restaurant & Cafe Addon for Elementor plugin for WordPress versions up to, and including, 1.5.9 Description: The issue allows authenticated attackers with Contributor-level access and above to extract data from private or draft posts...

[SECURITY] [DSA 5821-1] thunderbird security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5821-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff November 27, 2024 https://www.debian.org/security/faq -...

Slackware Linux 15.0 / current mozilla-firefox Multiple Vulnerabilities (SSA:2024-331-01)

The version of mozilla-firefox installed on the remote host is prior to 128.5.0esr. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2024-331-01 advisory. New mozilla-firefox packages are available for Slackware 15.0 and -current to fix security issues. Tenable has...

F5 Networks BIG-IP : Qt vulnerability (K000148690)

The version of F5 Networks BIG-IP installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the K000148690 advisory. In Qt before 5.15.14, 6.0.x through 6.2.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1, QtSvg QSvgFont munitsPer...

PT-2024-16718 · WordPress · Parsi Date

Name of the Vulnerable Software and Affected Versions: Parsi Date plugin for WordPress versions up to, and including, 5.1.1 Description: The issue arises from the use of add query arg without proper escaping on the URL, allowing unauthenticated attackers to inject arbitrary web scripts in pages...

Slackware Linux 15.0 / current mozilla-thunderbird Multiple Vulnerabilities (SSA:2024-331-02)

The version of mozilla-thunderbird installed on the remote host is prior to 128.5.0esr. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2024-331-02 advisory. New mozilla-thunderbird packages are available for Slackware 15.0 and -current to fix security issues...

PT-2024-37590 · WordPress · The Photo Gallery

Name of the Vulnerable Software and Affected Versions: The Photo Gallery, Sliders, Proofing and WordPress plugin versions prior to 3.59.5 Description: The issue is related to the lack of sanitization and escaping of some Images settings in the plugin, which could allow high privilege users, such ...

Microsoft Edge (Chromium) < 131.0.2903.63 Multiple Vulnerabilities

The version of Microsoft Edge installed on the remote Windows host is prior to 131.0.2903.63. It is, therefore, affected by multiple vulnerabilities as referenced in the November 21, 2024 advisory. - Type Confusion in V8 in Google Chrome prior to 131.0.6778.85 allowed a remote attacker to...

PT-2024-16614 · WordPress · Jobboardwp

Name of the Vulnerable Software and Affected Versions: JobBoardWP – Job Board Listings and Submissions plugin for WordPress versions up to, and including, 1.3.0 Description: The issue is related to Reflected Cross-Site Scripting due to the use of add query arg and remove query arg without proper...

PT-2024-35445 · Deno · Deno Standard Library

Name of the Vulnerable Software and Affected Versions: Deno Standard Library versions prior to 1.0.11 Description: The issue affects the Deno Standard Library, specifically the http/file-server module's serveDir function when used with the showDirListing: true option. This setup is vulnerable to...