PYSEC-2024-226

Pymatgen Python Materials Genomics is an open-source Python library for materials analysis. A critical security vulnerability exists in the JonesFaithfulTransformation.fromtransformationstr method within the pymatgen library prior to version 2024.2.20. This method insecurely utilizes eval for...

PT-2024-15241 · Openvpn +1 · Openvpn +1

Name of the Vulnerable Software and Affected Versions: OpenVPN versions prior to 2.6.9 Description: The OpenVPN GUI installer did not set proper access control restrictions to the installation directory of OpenVPN binaries when using a non-standard installation path. This allows an attacker to...

PT-2024-20566 · Unknown · Soninow Team Debug

Name of the Vulnerable Software and Affected Versions: SoniNow Team Debug versions 1.10 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web application that...

PT-2024-16346 · WordPress · Event Tickets/Registration

Name of the Vulnerable Software and Affected Versions: Event Tickets and Registration plugin for WordPress versions up to, and including, 5.8.1 Description: The issue is related to a missing capability check on the email action, allowing authenticated attackers with contributor-level access and...

PT-2024-6085

Name of the Vulnerable Software and Affected Versions Botan versions prior to 2.19.4 and 3.3.0 Description The issue is related to the parsing of X.509 certificates with explicit encoding of elliptic curve parameters. An attacker can present a certificate with very large parameters, causing...

PT-2024-3058 · Qemu +5 · Qemu +5

Name of the Vulnerable Software and Affected Versions: QEMU versions prior to 8.2.0 Description: The issue is related to an integer underflow and a resultant buffer overflow in QEMU, which can occur through a TI command when the expected non-DMA transfer length is less than the length of the...

CVE-2024-25619 Destroying OAuth Applications doesn't notify Streaming of Access Tokens being destroyed in mastodon

Mastodon is a free, open-source social network server based on ActivityPub. When an OAuth Application is destroyed, the streaming server wasn't being informed that the Access Tokens had also been destroyed, this could have posed security risks to users by allowing an application to continue...

PT-2024-1911 · Intel · Intel Mpi Library

Name of the Vulnerable Software and Affected Versions: IntelR MPI Library Software versions prior to 2021.11 Description: The issue is related to an uncontrolled search path in the IntelR MPI Library Software, which may allow an authenticated user to potentially enable escalation of privilege via...

PT-2024-1964 · Siemens · Simcenter Femap

Name of the Vulnerable Software and Affected Versions: Simcenter Femap versions prior to V2401.0000 Simcenter Femap versions prior to V2306.0001 Description: A vulnerability has been identified in Simcenter Femap that is related to an out of bounds read past the end of an allocated structure whil...

Intel® SSU Software Advisory

Summary: A potential security vulnerability in some Intel® System Support Utility SSU software may allow escalation of privilege. Intel is releasing software updates to mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2023-40156 Description: Uncontrolled search path elemen...

CVE-2024-23833 OpenRefine JDBC Attack Vulnerability

OpenRefine is a free, open source power tool for working with messy data and improving it. A jdbc attack vulnerability exists in OpenRefineversion=3.7.7 where an attacker may construct a JDBC query which may read files on the host filesystem. Due to the newer MySQL driver library in the latest...

SUSE-SU-2024:0441-1 Security update for kubevirt, virt-api-container, virt-controller-container, virt-exportproxy-container, virt-exportserver-container, virt-handler-container, virt-launcher-container, virt-libguestfs-tools-container, virt-operator-container, virt-pr-helper-container

This update for kubevirt, virt-api-container, virt-controller-container, virt-exportproxy-container, virt-exportserver-container, virt-handler-container, virt-launcher-container, virt-libguestfs-tools-container, virt-operator-container, virt-pr-helper-container fixes the following issues: Update ...

PT-2024-40234 · Unknown +1 · Vng-Api-Common +1

Name of the Vulnerable Software and Affected Versions: vng-api-common versions prior to 1.12.2 Description: This issue is related to a privilege escalation vulnerability, although its impact is negligible and entirely theoretical. It involves the verification of client-supplied JSON Web Tokens JW...

PT-2024-20635 · Unknown · Yannick Lefebvre Link Library

Name of the Vulnerable Software and Affected Versions: Yannick Lefebvre Link Library versions n/a through 7.5.13 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. Recommendations: For...

PT-2024-20603 · Unknown · Audrasjb Gdpr Data Request Form

Name of the Vulnerable Software and Affected Versions: Audrasjb GDPR Data Request Form versions n/a through 1.6 Description: The issue is related to improper neutralization of input during web page generation, which allows stored cross-site scripting XSS. This means that an attacker can inject...

PT-2024-12874

Name of the Vulnerable Software and Affected Versions Atos Unify OpenScape Voice Trace Manager versions prior to V8 R0.9.11 Description The issue allows authenticated path traversal in the user interface. Recommendations For versions prior to V8 R0.9.11, update to V8 R0.9.11 or later to resolve t...

CVE-2024-23673 Apache Sling Servlets Resolver: Malicious code execution via path traversal

Malicious code execution via path traversal in Apache Software Foundation Apache Sling Servlets Resolver.This issue affects all version of Apache Sling Servlets Resolver before 2.11.0. However, whether a system is vulnerable to this attack depends on the exact configuration of the system. If the...

PT-2024-33940

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.6.61 Description: The issue is related to the Linux kernel, where a problem with the dmub psr enable function and Parade 08-01 TCON causes black screens and kernel WARNING traces at bootup and during fullscree...

CVE-2023-41277 QTS, QuTS hero, QuTScloud

A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vulnerability in the following versions:...

PT-2024-20466 · Unknown · Stereoscope

Name of the Vulnerable Software and Affected Versions: stereoscope versions prior to 0.0.1 Description: It is possible to craft an OCI tar archive that, when stereoscope attempts to unarchive the contents, will result in writing to paths outside of the unarchive temporary directory. This issue is...