PT-2024-34367 · Digi · Digi Connectport Lts

Name of the Vulnerable Software and Affected Versions: Digi ConnectPort LTS versions prior to 1.4.12 Description: A Privilege Escalation issue exists in the file upload feature of Digi ConnectPort LTS. This allows an attacker on the local area network, with specific permissions, to upload and...

Django 4.x < 4.2.17, 5.0.x < 5.0.10, 5.1.x < 5.1.4 Multiple Vulnerabilities - Windows

Django is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:djangoproject:django"; if descriptio...

GHSA-3HPF-FF72-J67P shared_preferences_android vulnerability

Impact Due to some data types not being natively representable for the available storage options, sharedpreferencesandroid serializes and deserializes special string prefixes to store these unrepresentable data types. This allows arbitrary classes to be deserialized leading to arbitrary code...

CVE-2024-50389

A SQL injection vulnerability has been reported to affect QuRouter. If exploited, the vulnerability could allow remote attackers to inject malicious code. We have already fixed the vulnerability in the following version: QuRouter 2.4.5.032 and later...

SUSE-SU-2024:4079-2 Security update for webkit2gtk3

This update for webkit2gtk3 fixes the following issues: Update to version 2.46.3 bsc1232747: - CVE-2024-44244: Processing maliciously crafted web content may lead to an unexpected process crash. - CVE-2024-44296: Processing maliciously crafted web content may prevent Content Security Policy from...

CVE-2024-54137

liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms. A correctness error has been identified in the reference implementation of the HQC key encapsulation mechanism. Due to an indexing error, part of the secret key is incorrectly treat...

CVE-2023-40548 affecting package shim-unsigned-aarch64 for versions less than 15.8-5

CVE-2023-40548 affecting package shim-unsigned-aarch64 for versions less than 15.8-5. An upgraded version of the package is available that resolves this issue...

CVE-2023-40549 affecting package shim for versions less than 15.8-5

CVE-2023-40549 affecting package shim for versions less than 15.8-5. An upgraded version of the package is available that resolves this issue...

CVE-2024-54141 phpMyFAQ Generates an Error Message Containing Sensitive Information if database server is not available

phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. Prior to 4.0.0, phpMyFAQ exposes the database ie postgreSQL server's credential when connection to DB fails. This vulnerability is fixed in 4.0.0...

CVE-2024-52798

path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. The regular expression that is vulnerable to backtracking can be generated in the 0.1.x release of path-to-regexp. Upgra...

CVE-2024-53856 rPGP Panics on Malformed Untrusted Input

rPGP is a pure Rust implementation of OpenPGP. Prior to 0.14.1, rPGP allows an attacker to trigger rpgp crashes by providing crafted data. This vulnerability is fixed in 0.14.1...

Important: Red Hat Security Advisory: RHOAI 2.16.0 - Red Hat OpenShift AI

Updated images are now available for Red Hat OpenShift AI. Release of RHOAI 2.16.0 provides these changes:...

Fedora 40 : thunderbird (2024-515180fdb3)

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-515180fdb3 advisory. Update to 128.5.0 https://www.thunderbird.net/en-US/thunderbird/128.5.0esr/releasenotes/...

PT-2024-36396

Name of the Vulnerable Software and Affected Versions socat versions prior to 1.8.0.2 Description The issue is related to the readline.sh file in socat, which relies on the /tmp/$USER/stderr2 file. This can lead to an arbitrary file overwrite via a predictable /tmp directory. Recommendations For...

PT-2024-17004 · WordPress · Wordpress Pinterest Plugin

Name of the Vulnerable Software and Affected Versions: WordPress Pinterest Plugin versions up to, and including, 1.8.8 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'gs pin widget' shortcode due to insufficient input sanitization and output escaping on...

PT-2024-9532 · Hitachi · Hitachi Ops Center Common Services +1

Name of the Vulnerable Software and Affected Versions: Hitachi Ops Center Common Services versions 10.9.3-00 through 11.0.3-00 Hitachi Ops Center OVA versions 10.9.3-00 through 11.0.2-01 Description: The issue is related to the use of default credentials in Hitachi Ops Center Common Services, whi...

PT-2024-36005

Name of the Vulnerable Software and Affected Versions: Mobile Security Framework MobSF versions prior to 4.2.9 Description: The application allows users to upload files with scripts in the filename parameter. As a result, a malicious user can upload a script file to the system. When users in the...

PT-2024-36926

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.12.0-rc2-0.0.0-devel-00004-g8b1b79e88956 Description A vulnerability in the Linux kernel has been resolved, related to the pmdomain: imx: gpcv2: Adjust delay after power up handshake. The udelay5 is not enough,...

PT-2024-35862 · Berg Informatik · Berg Informatik Stripe Donation

Name of the Vulnerable Software and Affected Versions: Berg Informatik Stripe Donation versions 1.2.5 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows stored cross-site scripting XSS. This means that an attacker can inject...

PT-2024-36955

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.12.0 Description A NULL pointer dereference vulnerability was found in the Linux kernel's modify prefix route function, caused by a fib6 info without a fib6 table pointer set. This can happen for net-ipv6.fib6...