PT-2024-4134 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions 13.2.4 through 16.10.5 GitLab versions 16.11 through 16.11.2 GitLab versions 17.0 through 17.0.0 Description: An authorization issue exists where an authenticated attacker could utilize a crafted naming convention to bypass...

OPENSUSE-SU-2024:0135-1 Security update for gitui

This update for gitui fixes the following issues: - update to version 0.26.2: respect configuration for remote when fetching also applies to pulling add : character to sign-off trailer to comply with Conventional Commits standard support overriding builddate for reproducible builds - update...

PT-2024-24042 · Unknown · A-Blog Cms

Name of the Vulnerable Software and Affected Versions: a-blog cms versions 3.0.x through 3.0.31 a-blog cms versions 3.1.x through 3.1.11 Description: A code injection issue exists, allowing a user with administrator or higher privilege who can log in to the product to execute an arbitrary command...

PT-2024-3780 · Winrar · Winrar

Name of the Vulnerable Software and Affected Versions: WinRAR versions prior to 7.00 Description: The issue is related to errors in processing input data, which can be exploited by a remote attacker to cause a denial of service or spoof the screen output. This can be achieved through the use of...

PT-2024-4023 · Ivanti · Ivanti Secure Access Client For Linux

Name of the Vulnerable Software and Affected Versions: Ivanti Secure Access Client for Linux versions prior to 22.7R1 Description: A local privilege escalation issue allows a low-privileged user to execute code as root. The vulnerability is related to a buffer overflow in memory, which can be...

PT-2024-13725 · Zoho · Zoho Manageengine Adaudit Plus

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine ADAudit Plus versions below 7271 Description: The issue allows SQL injection while adding file shares. There is no information provided about the estimated number of potentially affected devices worldwide or real-world...

PT-2024-60: Path Traversal leads to Remote Code Execution (RCE) in VideoMost Server

The vulnerability was identified in VideoMost Server, versions before 9.0.0.1757. The discovered vulnerability can be exploited by an attacker to remotely execute arbitrary code. Vulnerability status: Confirmed by vendor Date of vulnerability remediation: 20.05.2024 Recommendations: Update to...

PT-2024-13728 · Zoho · Zoho Manageengine Adaudit Plus

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine ADAudit Plus versions below 7271 Description: The issue allows SQL injection while getting file server details. Recommendations: For Zoho ManageEngine ADAudit Plus versions below 7271, update to version 7271 or later to...

PT-2024-30180 · Mintplex · Anything-Llm

Name of the Vulnerable Software and Affected Versions: mintplex-labs/anything-llm versions prior to 1.0.0 Description: A denial of service DoS condition can be triggered through the modification of a user's id attribute to a value of 0. This can render a chosen account completely inaccessible,...

PT-2024-11680 · Wpmu Dev · Wpmu Dev Defender Security

Name of the Vulnerable Software and Affected Versions: WPMU DEV Defender Security versions n/a through 3.3.2 Description: The issue affects the storage of sensitive information, allowing access to screen temporary files that may contain sensitive data. This is a result of insecure storage practic...

PT-2024-12931 · WordPress · Wpvivid Backup/Migration

Name of the Vulnerable Software and Affected Versions: WPvivid Backup and Migration versions 0.9.90 and earlier Description: The issue is related to improper privilege management, allowing privilege escalation. This can be exploited, potentially leading to unauthorized access or control...

PT-2024-26987 · WordPress · Newsletter Popup

Name of the Vulnerable Software and Affected Versions: The Newsletter Popup WordPress plugin versions prior to 1.3 Description: The issue concerns a lack of CSRF check when deleting a subscriber, which could allow attackers to make logged-in admins perform such an action via a CSRF attack...

PT-2024-27588 · WordPress · Sp Project & Document Manager

Name of the Vulnerable Software and Affected Versions: SP Project & Document Manager WordPress plugin versions 4.71 and earlier Description: The issue is related to missing validation in the upload function of the plugin, allowing a user to manipulate the user id variable to make it appear that a...

CVE-2024-34717 Anonymous PrestaShop customer can download other customers' invoices

PrestaShop is an open source e-commerce web application. In PrestaShop 8.1.5, any invoice can be downloaded from front-office in anonymous mode, by supplying a random securekey parameter in the url. This issue is patched in version 8.1.6. No known workarounds are available...

PT-2024-3773 · Siemens · Simcenter Femap

Name of the Vulnerable Software and Affected Versions: Simcenter Femap versions prior to V2406 Description: A vulnerability has been identified that allows an attacker to execute code in the context of the current process by exploiting an out of bounds read past the end of an allocated structure...

PT-2024-24554 · WordPress · Ultimate Blocks

Name of the Vulnerable Software and Affected Versions: The Ultimate Blocks WordPress plugin versions prior to 3.1.7 Description: The issue allows users with the contributor role and above to perform Stored Cross-Site Scripting attacks due to the lack of validation and escaping of some block optio...

PT-2024-25523 · Linqi · Linqi

Name of the Vulnerable Software and Affected Versions: linqi versions prior to 1.4.0.1 Description: An issue was discovered in the software, specifically an LDAP injection. Recommendations: For versions prior to 1.4.0.1, update to version 1.4.0.1 or later to resolve the issue...

Important: flatpak

Issue Overview: Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. in versions before 1.10.9, 1.12.9, 1.14.6, and 1.15.8, a malicious or compromised Flatpak app could execute arbitrary code outside its sandbox. Normally, the --command argument of...

PT-2024-6609

Name of the Vulnerable Software and Affected Versions: Botan versions prior to 3.5.0 Botan versions prior to 2.19.5 Description: The issue is related to the processing of X.509 certificates in the Botan C++ cryptography library. Checking name constraints in these certificates is quadratic in the...

SUSE-SU-2024:1574-1 Security update for go1.21

This update for go1.21 fixes the following issues: Update to go1.21.10: - CVE-2024-24787: cmd/go: arbitrary code execution during build on darwin bsc1224017 - net/http: TestRequestLimit/h2 becomes significantly more expensive and slower after x/[email protected]...