PT-2024-9996

Name of the Vulnerable Software and Affected Versions: Hashicorp Nomad versions prior to 1.9.2 Hashicorp Nomad versions prior to 1.8.7 Hashicorp Nomad versions prior to 1.7.15 Description: The issue is related to the Container Storage Interface CSI component of the Nomad application orchestrator,...

Fedora 40 : thunderbird (2024-d1ba38d9a6)

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-d1ba38d9a6 advisory. Update to 128.4.0 https://www.thunderbird.net/en-US/thunderbird/128.4.0esr/releasenotes/...

PT-2024-39949 · WordPress · Wp Image Zoom

Name of the Vulnerable Software and Affected Versions: Wp-ImageZoom WordPress plugin versions prior to 1.1.1 Description: The Wp-ImageZoom WordPress plugin does not sanitise and escape some parameters before outputting them back in a page, leading to a Reflected Cross-Site Scripting issue. This...

Stable Channel Update for Desktop

The Stable channel has been updated to 130.0.6723.116/.117 for Windows, Mac and 130.0.6723.116 for Linux which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log. The Extended Stable channel has been updated to 130.0.6723.117 for Windows and Mac...

PT-2024-34616 · Jatos · Jatos

Name of the Vulnerable Software and Affected Versions: JATOS version 3.9.3 Description: A Cross-Site Request Forgery CSRF issue allows attackers to perform actions reserved for administrators, including creating admin accounts. This flaw can lead to unauthorized activities, compromising the...

AZL-52195 CVE-2024-51744 affecting package application-gateway-kubernetes-ingress for versions less than 1.7.7-1

golang-jwt is a Go implementation of JSON Web Tokens. Unclear documentation of the error behavior in ParseWithClaims can lead to situation where users are potentially not checking errors in the way they should be. Especially, if a token is both expired and invalid, the errors returned by...

PT-2024-73: Unlimited session lifetime in Password Pusher

The vulnerability was identified in Password Pusher versions prior to 1.48.0. The application does not limit the storage time of the session identifier or credentials, or this time is excessively long. An attacker can reuse old credentials or session identifiers to log in as another user and gain...

PT-2024-30305 · Wpmu Dev · Wpmu Dev Hummingbird

Name of the Vulnerable Software and Affected Versions: WPMU DEV Hummingbird versions 3.9.1 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: For WPMU DEV Hummingbi...

PT-2024-27303 · Unknown · Wishlist Member

Name of the Vulnerable Software and Affected Versions: WishList Member X versions 3.26.6 and earlier Description: The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as 'Path Traversal'. This allows unauthorized access to files and directories outsid...

[SECURITY] [DLA 3942-1] openssl security update

Debian LTS Advisory DLA-3942-1 [email protected] https://www.debian.org/lts/security/ Sean Whitton October 31, 2024 https://wiki.debian.org/LTS Package : openssl Version : 1.1.1n-0+deb11u6 CVE ID : CVE-2023-5678 CVE-2024-0727 CVE-2024-2511 CVE-2024-4741 CVE-2024-5535 CVE-2024-9143 Debia...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : go1.21-openssl (SUSE-SU-2024:3809-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3809-1 advisory. - CVE-2024-34158: Fixed stack exhaustion in Parse in go/build/constraint bsc1230254. -...

PT-2024-37656 · WordPress · Sip Reviews Shortcode

Name of the Vulnerable Software and Affected Versions: SIP Reviews Shortcode for WooCommerce plugin for WordPress versions up to, and including, 1.2.3 Description: The issue is related to Stored Cross-Site Scripting via the no of reviews attribute in the "woocommerce reviews" shortcode. This is d...

Amazon Linux 2023 : python3-urllib3 (ALAS2023-2024-747)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-747 advisory. urllib3 is a user-friendly HTTP client library for Python. When using urllib3's proxy support with ProxyManager, the Proxy-Authorization header is only sent to the configured proxy, as expected. However...

SUSE-SU-2024:3809-1 Security update for go1.21-openssl

This update for go1.21-openssl fixes the following issues: - CVE-2024-34158: Fixed stack exhaustion in Parse in go/build/constraint bsc1230254. - CVE-2024-34156: Fixed stack exhaustion in Decoder.Decode in encoding/gob bsc1230253. - CVE-2024-34155: Fixed stack exhaustion in all Parse functions...

PT-2024-8325

Name of the Vulnerable Software and Affected Versions Eclipse Mosquitto versions 1.3.2 through 2.0.18 Description The issue is related to a buffer overflow in dynamic memory. If a malicious broker sends a crafted SUBACK packet with no reason codes, a client using libmosquitto may make out of boun...

PT-2024-8622 · Hashicorp +4 · Hashicorp Consul +5

Name of the Vulnerable Software and Affected Versions: Consul affected versions not specified Consul Enterprise affected versions not specified Description: A vulnerability exists in Consul due to the lack of protection of the web page structure, allowing a remote attacker to conduct a cross-site...

Slackware Linux 15.0 / current mozilla-firefox Multiple Vulnerabilities (SSA:2024-304-02)

The version of mozilla-firefox installed on the remote host is prior to 128.4.0esr. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2024-304-02 advisory. New mozilla-firefox packages are available for Slackware 15.0 and -current to fix security issues. Tenable has...

Slackware Linux 15.0 / current xorg-server Vulnerability (SSA:2024-304-04)

The version of xorg-server installed on the remote host is prior to 1.20.14 / 21.1.14 / 21.1.4 / 24.1.4. It is, therefore, affected by a vulnerability as referenced in the SSA:2024-304-04 advisory. New xorg-server packages are available for Slackware 15.0 and -current to fix security issues...

PT-2024-34154

Name of the Vulnerable Software and Affected Versions: I, Librarian versions prior to 5.11.2 Description: The issue arises from a broken logic in handling Supplemental Files, allowing unsafe files with Javascript to be executed within the application context. An attacker can exploit this by...

PT-2024-34219 · Postx · Postx

Name of the Vulnerable Software and Affected Versions: PostX versions prior to 4.1.13 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS attacks. Recommendations: For versions prior t...