PT-2024-27605 · Vcita · Vcita Online Booking & Scheduling Calendar

Name of the Vulnerable Software and Affected Versions: vCita Online Booking & Scheduling Calendar for WordPress by vcita versions through 4.4.2 Description: The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as a Path Traversal vulnerability. This...

Installing Teams 2.x in an App Layering

Teams will not work properly in an image if it was installed in an App Layer using any version for App Layering prior to 2403.2...

PT-2024-6617

Name of the Vulnerable Software and Affected Versions: Botan versions prior to 2.19.5 Botan versions prior to 3.5.0 Description: A bug in the parsing of name constraint extensions in X.509 certificates meant that if the extension included both permitted subtrees and excluded subtrees, only the...

SUSE SLES12 Security Update : go1.21 (SUSE-SU-2024:2294-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:2294-1 advisory. Updated to version 1.21.12 bsc1212475: - CVE-2024-24791: Fixed a potential denial of service due to improper handling of HTTP 100-continue...

PT-2024-37620 · Mattermost · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost versions 9.5.x through 9.5.5 Mattermost versions 9.6.x through 9.6.2 Mattermost versions 9.7.x through 9.7.4 Mattermost version 9.8.0 Description: The issue allows an attacker to specify both a remoteId and the user ID when creatin...

PT-2024-37512

Name of the Vulnerable Software and Affected Versions: github.com/google/nftables version 0.1.0 Description: The issue arises from IP addresses being encoded in the wrong byte order, resulting in an nftables configuration that does not work as intended. This could lead to either blocking or not...

PT-2024-37104 · WordPress · Animated Al List Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Animated AL List WordPress plugin versions 1.0.0 through 1.0.6 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back in t...

PT-2024-37584

Name of the Vulnerable Software and Affected Versions libbson versions prior to 1.27.1 Description The issue is related to a potential buffer overflow in the bson string append function, which may lead to memory corruption of neighbouring heap memory. This occurs when the function attempts to...

PT-2024-27331 · Dell · Dell Powerprotect Dd

Name of the Vulnerable Software and Affected Versions: Dell PowerProtect DD versions prior to 8.0 Dell PowerProtect DD LTS 7.13.1.0 Dell PowerProtect DD LTS 7.10.1.30 Dell PowerProtect DD LTS 7.7.5.40 Description: The issue is an open redirect vulnerability that could be exploited by a remote low...

KLA69718 SB vulnerability in LibreOffice

Improper certificate validation vulnerability was found in LibreOffice. Malicious users can exploit this vulnerability to bypass security restrictions. Original advisories TLS certificate are not properly verified when utilizing LibreOfficeKit Exploitation Public exploits exist for this...

go-retryablehttp can leak basic auth credentials to log files

Summary go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file. This could lead to go-retryablehttp writing sensitive HTTP basic auth credentials to its log file. This vulnerability, CVE-2024-6104, was fixed in go-retryablehttp 0.7.7. Background go-retryablehttp i...

CVE-2024-38359

The CVE-2024-38359 vulnerability affects the Lightning Network Daemon (lnd) in its onion processing logic, causing a Denial-of-Service due to excessive memory allocation. It has been patched in lnd v0.17.0; upgrading to a version greater than 0.17.0 mitigates the issue. As a partial mitigation, u...

CVE-2024-38351

Pocketbase is an open source web backend written in go. In affected versions a malicious user may be able to compromise other user accounts. In order to be exploited users must have both OAuth2 and Password auth methods enabled. A possible attack scenario could be: 1. a malicious actor register...

CVE-2024-38351 Password auth and OAuth2 unverified email linking

Pocketbase is an open source web backend written in go. In affected versions a malicious user may be able to compromise other user accounts. In order to be exploited users must have both OAuth2 and Password auth methods enabled. A possible attack scenario could be: 1. a malicious actor register...

PT-2024-4825 · Jetbrains · Youtrack

Name of the Vulnerable Software and Affected Versions: JetBrains YouTrack versions prior to 2024.2.34646 Description: The issue is related to insufficient protection of registration data in the Access Token Handler component. This could allow a remote attacker to gain unauthorized access to...

PT-2024-6343 · Google +5 · Google Chrome +5

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 128.0.6613.84 Microsoft Edge affected versions not specified Description: The issue is related to an inappropriate implementation in Permissions, allowing a remote attacker to perform UI spoofing via a crafted...

OPENSUSE-SU-2024:11264-1 python36-pyzmq-22.2.1-1.4 on GA media

These are all security issues fixed in the python36-pyzmq-22.2.1-1.4 package on the GA media of openSUSE Tumbleweed...

PT-2024-25: Improper Authorization leads to sensitive data access in UniPORT E-slip

The vulnerability was identified in UniPORT E-slip 1.4.0.0 and lower. The discovered vulnerability is caused by insufficient input data validation. It can be exploited by an attacker to gain access to sensitive application data. The vulnerability is unexploitable in versions 1.4.0.0 and higher...

PT-2024-34698 · WordPress · Inquiry Cart Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Inquiry cart WordPress plugin versions 3.4.2 and earlier Description: The issue concerns the lack of CSRF checks in some areas of the plugin, as well as missing sanitization and escaping. This could allow attackers to make logged-in admins ad...

Rocky Linux 9 : tomcat (RLSA-2024:3307)

The remote Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:3307 advisory. Apache Tomcat: HTTP/2 header handling DoS CVE-2024-24549 Apache Tomcat: WebSocket DoS with incomplete closing handshake CVE-2024-23672 Bug Fixes and...