PT-2024-16390 · WordPress · Wpforms

Name of the Vulnerable Software and Affected Versions: WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More plugin for WordPress versions up to, and including, 1.9.1.6 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect...

XXE vulnerability in ivytrigger

ivytrigger 1.01 and earlier bundles versions of Apache Ivy vulnerable to CVE-2022-46751. This allows attackers able to control the input files for the "IvyTrigger - Poll with an Ivy script" build trigger to have Jenkins parse a crafted XML document that uses external entities for extraction of...

SUSE-SU-2024:3976-1 Security update for pcp

This update for pcp fixes the following issues: pcp was updated from version 3.11.9 to version 6.2.0 jscPED-8192, jscPED-8389: - Security issues fixed: CVE-2024-45770: Fixed a symlink attack that allows escalating from the pcp to the root user bsc1230552 CVE-2024-45769: Fixed a heap corruption...

PT-2024-32648

Name of the Vulnerable Software and Affected Versions Netty versions prior to 4.1.115 Description The issue is related to an unsafe reading of environment files, potentially causing a denial of service in Netty. When loaded on a Windows application, Netty attempts to load a file that does not...

PT-2024-8450

Name of the Vulnerable Software and Affected Versions Laravel versions 6.20.45 through 11.31.0 Description The issue is related to the register argc argv php directive being set to on, allowing users to change the environment used by the framework when handling requests with a special crafted que...

PT-2024-39875 · WordPress · Rss Feed Widget

Name of the Vulnerable Software and Affected Versions: RSS Feed Widget WordPress plugin versions prior to 3.0.1 Description: The issue arises from the failure to escape the REQUEST URI parameter before outputting it back in an attribute. This could lead to Reflected Cross-Site Scripting in old we...

PT-2024-39876 · WordPress · Rss Feed Widget

Name of the Vulnerable Software and Affected Versions: RSS Feed Widget WordPress plugin versions prior to 3.0.0 Description: The issue concerns the RSS Feed Widget WordPress plugin, which does not validate and escape some of its shortcode attributes before outputting them back in a page/post wher...

PT-2024-9111

Name of the Vulnerable Software and Affected Versions: GNOME GLib versions prior to 2.82.1 Description: The issue is related to an off-by-one error and resultant buffer overflow in the gio/gsocks4aproxy.c component of GNOME GLib. This occurs because SOCKS4 CONN MSG LEN is not sufficient for a...

openSUSE 15 Security Update : qbittorrent (openSUSE-SU-2024:0358-1)

The remote openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2024:0358-1 advisory. - Update to version 5.0.1 fixes boo1232731 CVE-2024-51774 Added features: Add 'Simple pread/pwrite' disk IO type Bug fixes: Don't ignore SSL errors...

CVE-2024-47719 affecting package kernel for versions less than 6.6.56.1-5

CVE-2024-47719 affecting package kernel for versions less than 6.6.56.1-5. An upgraded version of the package is available that resolves this issue...

CVE-2024-51989

The CVE-2024-51989 entry describes a cross-site scripting (XSS) vulnerability in PasswordPusher, affecting versions v1.41.1 through v1.48.0. The root cause is an unsanitized parameter that enables injection of malicious JavaScript. Affected deployments include self-hosted PasswordPusher installat...

Security update for go1.23-openssl

This update for go1.23-openssl fixes the following issues: This update ships go1.23-openssl version 1.23.2.2. jscSLE-18320 go1.23.2 released 2024-10-01 includes fixes to the compiler, cgo, the runtime, and the maps, os, os/exec, time, and unique packages. go69119 os: double close pidfd if caller...

PT-2024-9996

Name of the Vulnerable Software and Affected Versions: Hashicorp Nomad versions prior to 1.9.2 Hashicorp Nomad versions prior to 1.8.7 Hashicorp Nomad versions prior to 1.7.15 Description: The issue is related to the Container Storage Interface CSI component of the Nomad application orchestrator,...

RHEL 8 : java-1.8.0-ibm (RHSA-2024:6595)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:6595 advisory. IBM Java SE version 8 includes the IBM Java Runtime Environment and the IBM Java Software Development Kit. This update upgrades IBM Java SE 8 to...

Fedora 40 : thunderbird (2024-d1ba38d9a6)

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-d1ba38d9a6 advisory. Update to 128.4.0 https://www.thunderbird.net/en-US/thunderbird/128.4.0esr/releasenotes/...

PT-2024-39949 · WordPress · Wp Image Zoom

Name of the Vulnerable Software and Affected Versions: Wp-ImageZoom WordPress plugin versions prior to 1.1.1 Description: The Wp-ImageZoom WordPress plugin does not sanitise and escape some parameters before outputting them back in a page, leading to a Reflected Cross-Site Scripting issue. This...

PT-2024-34616 · Jatos · Jatos

Name of the Vulnerable Software and Affected Versions: JATOS version 3.9.3 Description: A Cross-Site Request Forgery CSRF issue allows attackers to perform actions reserved for administrators, including creating admin accounts. This flaw can lead to unauthorized activities, compromising the...

Stable Channel Update for Desktop

The Stable channel has been updated to 130.0.6723.116/.117 for Windows, Mac and 130.0.6723.116 for Linux which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log. The Extended Stable channel has been updated to 130.0.6723.117 for Windows and Mac...

AZL-52195 CVE-2024-51744 affecting package application-gateway-kubernetes-ingress for versions less than 1.7.7-1

golang-jwt is a Go implementation of JSON Web Tokens. Unclear documentation of the error behavior in ParseWithClaims can lead to situation where users are potentially not checking errors in the way they should be. Especially, if a token is both expired and invalid, the errors returned by...

PT-2024-73: Unlimited session lifetime in Password Pusher

The vulnerability was identified in Password Pusher versions prior to 1.48.0. The application does not limit the storage time of the session identifier or credentials, or this time is excessively long. An attacker can reuse old credentials or session identifiers to log in as another user and gain...