PT-2024-21417 · Cimg +3 · Cimg +3

Name of the Vulnerable Software and Affected Versions: Clmg versions prior to 3.3.3 Description: A heap-based buffer overflow can occur via a crafted file to cimg library::CImg:: load analyze. This issue allows for potential exploitation. Recommendations: For versions prior to 3.3.3, update to...

PT-2024-20493 · Zoom · Zoom Rooms Client For Windows

Name of the Vulnerable Software and Affected Versions: Zoom Rooms Client for Windows versions prior to 5.17.5 Description: The issue is related to improper access control in the installer, which may allow an authenticated user to conduct a denial of service via local access. Recommendations: For...

PT-2024-22505 · Piwigo · Piwigo

Name of the Vulnerable Software and Affected Versions: Piwigo versions prior to 14.3.0 Description: A Cross Site Scripting issue exists due to missing sanitization in the create tag function in admin/include/functions.php. Recommendations: For versions prior to 14.3.0, update to version 14.3.0 or...

Driver Disk for Qlogic fastlinq 8.74.0.2 - For Citrix Hypervisor 8.2 LTSR

Who should install this driver disk? Customers running the Citrix Hypervisor 8.2 Cumulative Update 1 LTSR release who use Qlogic's fastlinq driver and wish to use the latest version of the following: Driver Module| Version ---|--- qed| 8.74.0.0 qede| 8.74.0.0 qedf| 8.74.0.2 qedi| 8.74.0.0 qedr|...

NetApp SnapCenter Improper Authorization Vulnerability - Lenovo Support US

No description provided...

PT-2024-2014 · Veritas · Veritas Netbackup Appliance +1

Name of the Vulnerable Software and Affected Versions: Veritas NetBackup versions prior to 8.1.2 Veritas NetBackup Appliance versions prior to 3.1.2 Description: The issue is related to inadequate validation of the file path by the BPCD process, allowing an unauthenticated attacker to upload and...

PT-2024-2626

Name of the Vulnerable Software and Affected Versions Nix versions prior to 2.3.18 Nix versions prior to 2.18.2 Nix versions prior to 2.19.4 Nix versions prior to 2.20.5 Description The issue is related to errors in synchronization when using a shared resource in the Nix package manager for Unix...

BIT-TENSORFLOW-2020-26266 Uninitialized memory access in Eigen types in TensorFlow

In affected versions of TensorFlow under certain cases a saved model can trigger use of uninitialized values during code execution. This is caused by having tensor buffers be filled with the default value of the type but forgetting to default initialize the quantized floating point types in Eigen...

BIT-TENSORFLOW-2021-29576 Heap buffer overflow in `MaxPool3DGradGrad`

TensorFlow is an end-to-end open source platform for machine learning. The implementation of tf.rawops.MaxPool3DGradGrad is vulnerable to a heap buffer overflow. The...

BIT-TENSORFLOW-2023-25674 TensorFlow has Null Pointer Error in RandomShuffle with XLA enable

TensorFlow is an open source machine learning platform. Versions prior to 2.12.0 and 2.11.1 have a null pointer error in RandomShuffle with XLA enabled. A fix is included in TensorFlow 2.12.0 and 2.11.1...

BIT-DISCOURSE-2023-48297 Discourse vulnerable to unlimited mentioned users in message serializer

Discourse is a platform for community discussion. The message serializer uses the full list of expanded chat mentions @all and @here which can lead to a very long array of users. This issue was patched in versions 3.1.4 and beta 3.2.0.beta5...

PT-2024-20544 · Unknown · Casaos-Userservice

Name of the Vulnerable Software and Affected Versions: CasaOS-UserService versions 0.4.4.3 through 0.4.6 Description: The CasaOS Login page has a username enumeration issue, allowing an attacker to enumerate CasaOS usernames using the application response. If the username is incorrect, the...

PT-2024-21167 · Foxit · Foxit Pdf Reader +1

Name of the Vulnerable Software and Affected Versions: Foxit PDF Reader versions prior to 2024.1 Foxit PDF Editor versions prior to 2024.1 Description: The issue allows code execution via JavaScript due to an unoptimized prompt message for users to review parameters of commands. Recommendations:...

PT-2024-21389 · Prestashop · Prestashop Product Designer Module

Name of the Vulnerable Software and Affected Versions: PrestaShop Product Designer module versions prior to 1.178.36 Description: A Server-Side Request Forgery SSRF issue allows remote attackers to cause a denial of service DoS and escalate privileges via the url parameter in the postProcess...

PT-2024-15952 · WordPress · Widget For Social Page Feeds

Name of the Vulnerable Software and Affected Versions: Widget for Social Page Feeds WordPress plugin versions prior to 6.4 Description: The issue concerns the Widget for Social Page Feeds WordPress plugin, which does not properly sanitise and escape some of its settings. This could allow high...

CVE-2024-27295 Directus MySQL accent insensitive email matching

Directus is a real-time API and App dashboard for managing SQL database content. The password reset mechanism of the Directus backend allows attackers to receive a password reset email of a victim user, specifically having it arrive at a similar email address as the victim with a one or more...

PT-2024-15332 · Hypr · Hypr Workforce Access

Name of the Vulnerable Software and Affected Versions: HYPR Workforce Access versions prior to 8.7.1 Description: The issue is related to an Improper Link Resolution Before File Access, also known as 'Link Following', which allows file manipulation in HYPR Workforce Access on MacOS...

PT-2024-20584 · Espocrm · Espocrm

Name of the Vulnerable Software and Affected Versions: EspoCRM versions prior to 8.1.2 Description: The issue allows an attacker to inject arbitrary IP or domain in the "Password Change" page, potentially redirecting the victim to a malicious page. This could lead to credential stealing or other...

PT-2024-21168 · Blesta · Blesta

Name of the Vulnerable Software and Affected Versions: Blesta versions prior to 5.9.2 Description: A path traversal vulnerability in the "/path/to/uploads/" directory allows attackers to takeover user accounts and execute arbitrary code. Recommendations: For versions prior to 5.9.2, update to...

PT-2024-15223 · WordPress · Wp Dashboard Notes

Name of the Vulnerable Software and Affected Versions: WP Dashboard Notes WordPress plugin versions prior to 1.0.11 Description: The issue allows authenticated users to delete private notes associated with different user accounts due to Insecure Direct Object References IDOR in the post id=...