PT-2024-27929 · Alcasar · Alcasar

Name of the Vulnerable Software and Affected Versions: ALCASAR versions prior to 3.6.1 Description: The issue allows for CSRF and remote code execution in the activity.php file. Recommendations: For versions prior to 3.6.1, update to version 3.6.1 or later to resolve the issue...

PT-2024-25509 · Pexip · Pexip Infinity

Name of the Vulnerable Software and Affected Versions: Pexip Infinity versions prior to 34.1 Description: The issue concerns improper access control, allowing individuals in a waiting room to view the conference roster list and perform certain actions before being admitted to the meeting...

PT-2024-5802

Name of the Vulnerable Software and Affected Versions FreeIPA versions prior to 4.12.2 Description A vulnerability was found in FreeIPA where a Kerberos TGS-REQ is encrypted using the client's session key. However, the ticket it contains is encrypted using the target principal key directly. For...

PT-2024-24865 · Wpmu Dev · Wpmu Dev Hummingbird

Name of the Vulnerable Software and Affected Versions: WPMU DEV Hummingbird versions 3.7.3 and earlier Description: The issue is related to a Missing Authorization vulnerability in WPMU DEV Hummingbird. Recommendations: For WPMU DEV Hummingbird versions 3.7.3 and earlier, update to a version late...

PT-2024-35360

Name of the Vulnerable Software and Affected Versions: GNOME libsoup versions prior to 3.6.0 Description: The issue allows HTTP request smuggling in some configurations because '0' characters at the end of header names are ignored. For example, a "Transfer-Encoding0: chunked" header is treated th...

PT-2024-26707 · Unknown · Templatesnext Onepager

Name of the Vulnerable Software and Affected Versions: TemplatesNext OnePager versions 1.3.3 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS in TemplatesNext OnePager...

PT-2024-19238 · Unknown · Codection Import/Export Users/Customers

Name of the Vulnerable Software and Affected Versions: Codection Import and export users and customers versions 1.24.6 and earlier Description: The issue is related to a Missing Authorization vulnerability in Codection Import and export users and customers. This vulnerability affects the import a...

PT-2024-26645 · Thimpress · Thimpress Eduma

Name of the Vulnerable Software and Affected Versions: ThimPress Eduma versions n/a through 5.4.7 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS, which allows Reflected XSS. Recommendations: For versions n/a...

PT-2024-4038

Name of the Vulnerable Software and Affected Versions: Cyrus IMAP versions prior to 3.8.3 Cyrus IMAP versions 3.10.x prior to 3.10.0-rc1 Description: The issue is related to a buffer overflow in memory, which can be exploited by sending several literals in a single command, potentially allowing a...

SUSE CVE-2022-23648

containerd is a container runtime available as a daemon for Linux and Windows. A bug was found in containerd prior to versions 1.6.1, 1.5.10, and 1.14.12 where containers launched through containerd's CRI implementation on Linux with a specially-crafted image configuration could gain access to...

SUSE CVE-2022-46174

efs-utils is a set of Utilities for Amazon Elastic File System EFS. A potential race condition issue exists within the Amazon EFS mount helper in efs-utils versions v1.34.3 and below. When using TLS to mount file systems, the mount helper allocates a local port for stunnel to receive NFS...

PT-2024-12885 · WordPress · Wp-Postratings

Name of the Vulnerable Software and Affected Versions: WP-PostRatings versions 1.91 and earlier Description: The issue is related to an Improper Control of Interaction Frequency vulnerability, allowing Functionality Misuse in WP-PostRatings. Recommendations: For WP-PostRatings versions 1.91 and...

PT-2024-32634 · WordPress · Wp-Emember

Name of the Vulnerable Software and Affected Versions: wp-eMember WordPress plugin versions prior to 10.3.9 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because the fieldId parameter is not properly sanitized and escaped before being outputted back in t...

PT-2024-27928

Name of the Vulnerable Software and Affected Versions qdrant/qdrant version 1.9.0-dev Description The issue allows for arbitrary file read and write during the snapshot recovery process. Attackers can exploit this by manipulating snapshot files to include symlinks, leading to arbitrary file read ...

SUSE-SU-2024:1872-1 Security update for python-tqdm

This update for python-tqdm fixes the following issues: Update to version 4.66.4: rich: fix completion cli: eval safety CVE-2024-34062, bsc1223880 pandas: add DataFrame.progressmap notebook: fix HTML padding keras: fix resuming training when verbose=2 fix formatnum negative fractions missing...

PT-2024-26755 · WordPress · Simple Like Page Plugin

Name of the Vulnerable Software and Affected Versions: The Simple Like Page Plugin for WordPress versions up to, and including, 1.5.2 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the plugin's shortcodes, allowing authenticat...

SUSE SLES15: warewulf4 / warewulf4-man / warewulf4-overlay / etc (SUSE-SU-2024:1838-1)

The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:1838-1 advisory. - fixed wwctl configure --all doesn't configure ssh bsc1225402 - update to 4.5.2 with following changes: Reorder dnsmasq config to put iPX...

SUSE-SU-2024:1815-1 Security Beta update for SUSE Manager Client Tools

This update fixes the following issues: grafana: - Packaging improvements: Changed deprecated disabled service mode to manual Drop golang-packaging macros Drop explicit mod=vendor as it is enabled automatically - Update to version 9.5.18: SECURITY CVE-2024-1313: Require same organisation when...

PT-2024-19517

Name of the Vulnerable Software and Affected Versions TCPDF versions 6.6.5 and earlier Description The issue arises when parsing an untrusted SVG file, leading to a ReDoS Regular Expression Denial of Service condition. This occurs due to the inefficient handling of regular expressions within the...

PT-2024-31574

Name of the Vulnerable Software and Affected Versions KKProgressbar2 Free WordPress plugin versions 1.1.4.2 and earlier Description The issue allows admin users to perform SQL injection attacks due to the lack of sanitization and escaping of a parameter before using it in a SQL statement...