RHSA-2016:1929 Red Hat Security Advisory: Red Hat Virtualization Manager (RHV) bug fix 3.6.9

Bulletin has no description...

RHSA-2009:1198 Red Hat Security Advisory: java-1.6.0-ibm security update

Bulletin has no description...

CVE-2024-43793 Halo's editor has a stored XSS vulnerability

Halo is an open source website building tool. A security vulnerability has been identified in versions prior to 2.19.0 of the Halo project. This vulnerability allows an attacker to execute malicious scripts in the user's browser through specific HTML and JavaScript code, potentially leading to a...

PT-2024-7963 · Eclipse +1 · Eclipse Glassfish +1

Name of the Vulnerable Software and Affected Versions: Eclipse Glassfish versions prior to 7.0.10 Description: A URL redirection issue to untrusted sites exists, caused by a vulnerability in the included Apache code. This issue only affects applications explicitly deployed to the root context '/'...

PT-2024-28305 · WordPress · Gallery Plugin

Name of the Vulnerable Software and Affected Versions: The Gallery Plugin for WordPress versions prior to 1.8.15 Description: The issue is related to the lack of sanitization and escaping of some image settings in the plugin, which could allow users with post-writing privileges, such as Authors, ...

[SECURITY] [DLA 3885-1] redis security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3885-1 [email protected] https://www.debian.org/lts/security/ Chris Lamb September 10, 2024 https://wiki.debian.org/LTS -...

PT-2024-6310

Name of the Vulnerable Software and Affected Versions Ruby-SAML versions prior to 1.17.0 Ruby-SAML versions 1.13.0 through 1.16.0 GitLab versions prior to 17.3.3, 17.2.7, 17.1.8, 17.0.8, and 16.11.10 Description The vulnerability is related to the Ruby SAML library, which is used for implementing...

PT-2024-9671 · Synology · Synology Router Manager

Name of the Vulnerable Software and Affected Versions: Synology Router Manager SRM versions prior to 1.3.1-9346-10 Description: The issue is related to improper neutralization of input during web page generation, also known as 'Cross-site Scripting'. This allows remote authenticated users with...

PT-2024-38935 · WordPress · Wp Adcenter

Name of the Vulnerable Software and Affected Versions: WP AdCenter – Ad Manager & Adsense Ads plugin for WordPress versions up to, and including, 2.5.6 Description: The issue is related to Stored Cross-Site Scripting via the ad alignment attribute due to insufficient input sanitization and output...

Remote Code Execution Vulnerability via SSTI in Fides Webserver Jinja Email Templating Engine

Summary The Email Templating feature uses Jinja2 without proper input sanitization or rendering environment restrictions, allowing for Server-Side Template Injection that grants Remote Code Execution to privileged users. A privileged user refers to an Admin UI user with the default Owner or...

PT-2024-32008

Name of the Vulnerable Software and Affected Versions HTMLDOC version 1.9.18 Description The issue is related to a buffer overflow in the parse pre function, located in the ps-pdf.cxx file at line 5681. Recommendations For version 1.9.18, update to a newer version that contains a fix for this iss...

PT-2024-30196 · Unknown · Limesurvey

Name of the Vulnerable Software and Affected Versions: LimeSurvey versions 6.6.2 and earlier Description: An issue in the js localize.php function allows attackers to execute arbitrary code via injecting a crafted payload into the lng parameter of the js localize.php function. This issue enables...

SUSE SLES15 / openSUSE 15 Security Update : 389-ds (SUSE-SU-2024:3082-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3082-1 advisory. Security issues fixed: - CVE-2024-3657: Fixed potential denial of service via specially crafted kerberos AS-REQ reque...

PT-2024-7789

Name of the Vulnerable Software and Affected Versions Artifex Ghostscript versions prior to 10.04.0 Description A buffer overflow issue exists in the pdf/pdf xref.c file of Artifex Ghostscript, related to the handling of a PDF XRef stream and W array values. This issue can be exploited by a remot...

PT-2024-10884 · Netiq · Netiq Advance Authentication

Name of the Vulnerable Software and Affected Versions: NetIQ Advance Authentication versions prior to 6.3.5.1 Description: A vulnerability identified in NetIQ Advance Authentication does not enforce account lockout when a brute force attack is performed on API-based login. This issue may lead to...

PT-2024-5807 · Moodle +2 · Moodle +2

Name of the Vulnerable Software and Affected Versions: Moodle versions prior to 4.4.2 Moodle versions prior to 4.3.6 Moodle versions prior to 4.2.9 Moodle versions prior to 4.1.12 Description: A flaw was found in Moodle, allowing remote code execution due to incomplete sanitization in the...

PT-2024-10074

Name of the Vulnerable Software and Affected Versions GNOME libsoup versions prior to 3.6.1 Description The issue is related to a buffer overflow in the soup header parse param list strict function of the GNOME libsoup library. This overflow occurs in dynamic memory and is associated with...

PT-2024-6339

Name of the Vulnerable Software and Affected Versions libexpat versions prior to 2.6.3 Description An issue was discovered in libexpat, where the nextScaffoldPart function in xmlparse.c can have an integer overflow for m groupSize on 32-bit platforms. This can allow a remote attacker to cause a...

PT-2024-77: Time-based SQL Injection in Netcat CMS (module comments)

The vulnerability was identified in Netcat CMS module comments, version 6.4 Extra. The discovered vulnerability allows an attacker to read information from the database. Vulnerability status: Confirmed by vendor Date of vulnerability remediation: 20.08.2024 Recommendations: Update to version or...

PT-2024-84: Reflected Cross-Site Scripting (XSS) in Netcat CMS (netshop module)

The vulnerability was identified in Netcat netshop module, version 6.4 Extra. The discovered vulnerability allows an authorized attacker with the administrator role to execute arbitrary JavaScript code in the browser of the attacked user. Vulnerability status: Confirmed by vendor Date of...