PT-2024-11664 · Ibm · Ibm Aspera Console

Name of the Vulnerable Software and Affected Versions: IBM Aspera Console versions 3.4.0 through 3.4.4 Description: The issue is caused by the failure to set the HTTPOnly flag, allowing a remote attacker to obtain sensitive information from the cookie. This could be exploited by a remote attacker...

PT-2024-28923 · Unknown · Btstack Mesh

Name of the Vulnerable Software and Affected Versions: btstack mesh versions before v.864e2f2b6b7878c8fab3cf5ee84ae566e3380c58 Description: The issue allows a remote attacker to execute arbitrary code via the pb adv handle tranaction cont function in the src/mesh/pb adv.c component. This is a...

PT-2025-6048

Name of the Vulnerable Software and Affected Versions npm-serialize-javascript versions up to 6.0.1 Description The vulnerability occurs because the serialize-javascript module does not properly sanitize certain inputs, such as regex or other JavaScript object types, allowing an attacker to injec...

CVE-2024-8775

A flaw was found in Ansible, where sensitive information stored in Ansible Vault files can be exposed in plaintext during the execution of a playbook. This occurs when using tasks such as includevars to load vaulted variables without setting the nolog: true parameter, resulting in sensitive data...

RHSA-2022:0323 Red Hat Security Advisory: nginx:1.20 security update

Bulletin has no description...

RHSA-2016:1929 Red Hat Security Advisory: Red Hat Virtualization Manager (RHV) bug fix 3.6.9

Bulletin has no description...

RHSA-2009:1198 Red Hat Security Advisory: java-1.6.0-ibm security update

Bulletin has no description...

CVE-2024-43793 Halo's editor has a stored XSS vulnerability

Halo is an open source website building tool. A security vulnerability has been identified in versions prior to 2.19.0 of the Halo project. This vulnerability allows an attacker to execute malicious scripts in the user's browser through specific HTML and JavaScript code, potentially leading to a...

PT-2024-28305 · WordPress · Gallery Plugin

Name of the Vulnerable Software and Affected Versions: The Gallery Plugin for WordPress versions prior to 1.8.15 Description: The issue is related to the lack of sanitization and escaping of some image settings in the plugin, which could allow users with post-writing privileges, such as Authors, ...

PT-2024-7963 · Eclipse +1 · Eclipse Glassfish +1

Name of the Vulnerable Software and Affected Versions: Eclipse Glassfish versions prior to 7.0.10 Description: A URL redirection issue to untrusted sites exists, caused by a vulnerability in the included Apache code. This issue only affects applications explicitly deployed to the root context '/'...

[SECURITY] [DLA 3885-1] redis security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3885-1 [email protected] https://www.debian.org/lts/security/ Chris Lamb September 10, 2024 https://wiki.debian.org/LTS -...

PT-2024-6310 · Gitlab +2 · Gitlab +2

Name of the Vulnerable Software and Affected Versions: Ruby-SAML versions prior to 1.17.0 Ruby-SAML versions 1.13.0 through 1.16.0 GitLab versions prior to 17.3.3, 17.2.7, 17.1.8, 17.0.8, and 16.11.10 Description: The vulnerability is related to the Ruby SAML library, which is used for implementi...

PT-2024-9671 · Synology · Synology Router Manager

Name of the Vulnerable Software and Affected Versions: Synology Router Manager SRM versions prior to 1.3.1-9346-10 Description: The issue is related to improper neutralization of input during web page generation, also known as 'Cross-site Scripting'. This allows remote authenticated users with...

PT-2024-38935 · WordPress · Wp Adcenter

Name of the Vulnerable Software and Affected Versions: WP AdCenter – Ad Manager & Adsense Ads plugin for WordPress versions up to, and including, 2.5.6 Description: The issue is related to Stored Cross-Site Scripting via the ad alignment attribute due to insufficient input sanitization and output...

Remote Code Execution Vulnerability via SSTI in Fides Webserver Jinja Email Templating Engine

Summary The Email Templating feature uses Jinja2 without proper input sanitization or rendering environment restrictions, allowing for Server-Side Template Injection that grants Remote Code Execution to privileged users. A privileged user refers to an Admin UI user with the default Owner or...

PT-2024-32008

Name of the Vulnerable Software and Affected Versions HTMLDOC version 1.9.18 Description The issue is related to a buffer overflow in the parse pre function, located in the ps-pdf.cxx file at line 5681. Recommendations For version 1.9.18, update to a newer version that contains a fix for this iss...

PT-2024-30196 · Unknown · Limesurvey

Name of the Vulnerable Software and Affected Versions: LimeSurvey versions 6.6.2 and earlier Description: An issue in the js localize.php function allows attackers to execute arbitrary code via injecting a crafted payload into the lng parameter of the js localize.php function. This issue enables...

SUSE SLES15 / openSUSE 15 Security Update : 389-ds (SUSE-SU-2024:3082-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3082-1 advisory. Security issues fixed: - CVE-2024-3657: Fixed potential denial of service via specially crafted kerberos AS-REQ reque...

PT-2024-7789 · Artifex +7 · Artifex Ghostscript +7

Name of the Vulnerable Software and Affected Versions: Artifex Ghostscript versions prior to 10.04.0 Description: A buffer overflow issue exists in the pdf/pdf xref.c file of Artifex Ghostscript, related to the handling of a PDF XRef stream and W array values. This issue can be exploited by a...

PT-2024-5807 · Moodle +2 · Moodle +2

Name of the Vulnerable Software and Affected Versions: Moodle versions prior to 4.4.2 Moodle versions prior to 4.3.6 Moodle versions prior to 4.2.9 Moodle versions prior to 4.1.12 Description: A flaw was found in Moodle, allowing remote code execution due to incomplete sanitization in the...