OESA-2024-1545 ruby security update

Ruby is a fast and easy interpreted scripting language for object-oriented programming. It has many functions for processing text Files and perform system management tasks such as Perl. Security Fixes: An issue was discovered in Ruby 3.x through 3.3.0. If attacker-supplied data is provided to the...

PT-2024-28847 · National Instruments · Ni Instrumentstudio +1

Name of the Vulnerable Software and Affected Versions: NI FlexLogger versions prior to 2024 Q1 NI InstrumentStudio versions prior to 2024 Q1 Description: A deserialization of untrusted data issue exists in common code used by FlexLogger and InstrumentStudio, potentially resulting in remote code...

PT-2024-11571 · Nuki · Nuki Smart Lock 2.0 +1

Name of the Vulnerable Software and Affected Versions: Nuki Smart Lock 3.0 versions 3.0 through 3.3.4 Nuki Smart Lock 2.0 versions 2.0 through 2.12.3 Description: An issue was discovered on certain Nuki Home Solutions devices, where some BLE commands could be called from unprivileged accounts,...

PT-2024-33781 · Gitlab · Gitlab Ce/Ee

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 16.1.0 through 16.11.4 GitLab CE/EE versions 17.0.0 through 17.0.2 GitLab CE/EE versions 17.1.0 Description: An issue has been discovered in GitLab CE/EE that allowed for a CSRF attack on GitLab's GraphQL API, leading to...

PT-2024-3040 · WordPress · Forminator

Name of the Vulnerable Software and Affected Versions: Forminator versions prior to 1.29.0 Description: The issue is related to an unrestricted upload of files with dangerous types in the Forminator plugin for WordPress. This could allow a remote attacker to upload arbitrary files to the server,...

CVE-2024-32463 phlex makes Cross-site Scripting (XSS) possible due to improper sanitisation of `href` attributes on `<a>` tags

phlex is an open source framework for building object-oriented views in Ruby. There is a potential cross-site scripting XSS vulnerability that can be exploited via maliciously crafted user data. The filter to detect and prevent the use of the javascript: URL scheme in the href attribute of an tag...

PT-2024-15170 · WordPress · The Pods – Custom Content Types/Fields

Name of the Vulnerable Software and Affected Versions: The Pods – Custom Content Types and Fields plugin for WordPress versions prior to 3.0.11, excluding versions 2.7.31.2, 2.8.23.2, and 2.9.19.2 Description: The issue allows authenticated attackers with contributor level access or higher to...

PT-2024-20411 · Mattermost · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost versions 8.1.x through 8.1.10 Mattermost versions 9.3.x through 9.3.2 Mattermost versions 9.4.x through 9.4.3 Mattermost versions 9.5.x through 9.5.1 Description: The issue is related to the failure of Mattermost to authenticate th...

PT-2024-22574 · Ibm · Ibm Application Gateway +1

Name of the Vulnerable Software and Affected Versions: IBM Security Verify Access versions 10.0.0 through 10.0.7 IBM Application Gateway versions 20.01 through 24.03 Description: The issue allows a remote attacker to obtain highly sensitive private information or cause a denial of service using a...

PT-2024-18764 · Samsung +1 · Samsung Camera +3

Name of the Vulnerable Software and Affected Versions: Samsung Camera versions prior to 12.1.0.31 in Android 12 Samsung Camera versions prior to 13.1.02.07 in Android 13 Samsung Camera versions prior to 14.0.01.06 in Android 14 Description: The issue is related to improper handling of insufficien...

PT-2024-22315 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions prior to 16.8.5 GitLab CE/EE versions 16.9.0 through 16.9.2 GitLab CE/EE versions 16.10.0 Description: An issue has been discovered in GitLab CE/EE that allows an attacker to cause a denial of service using a maliciously...

Vulnerabilities fixed in SugarCRM

Vulnerabilities have been fixed in SugarCRM. A malicious party could exploit the vulnerabilities to launch cross-site scripting or SQL injection attacks, manipulate data or execute code execute code. No CVE IDs have yet been disclosed for the vulnerabilities. SugarCRM has released updates to fix...

PT-2024-2427

Name of the Vulnerable Software and Affected Versions Moby versions prior to 23.0.11 Moby versions prior to 25.0.4 Moby versions prior to 26.0.0 Description The issue is related to the networking implementation in Moby, which allows for the creation of custom networks with their own IP address...

PT-2024-2617 · Apple · Ipados +5

Name of the Vulnerable Software and Affected Versions: macOS Sonoma versions prior to 14.4 visionOS versions prior to 1.1 iOS versions prior to 17.4 iPadOS versions prior to 17.4 watchOS versions prior to 10.4 iOS versions prior to 16.7.6 iPadOS versions prior to 16.7.6 tvOS versions prior to 17....

BIT-ENVOY-2023-27488 Envoy gRPC client produces invalid protobuf when an HTTP header with non-UTF8 value is received.

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to versions 1.26.0, 1.25.3, 1.24.4, 1.23.6, and 1.22.9, escalation of privileges is possible when failuremodeallow: true is configured for extauthz filter. For affected components that are used for loggin...

PT-2024-2153

Name of the Vulnerable Software and Affected Versions HashiCorp Vault versions prior to 1.14.10 HashiCorp Vault versions prior to 1.15.5 Description The issue is related to errors in the procedure for confirming the authenticity of certificates. An attacker may be able to craft a malicious...

PT-2024-40180 · Unknown · @Nfid/Embed Sdk +2

Name of the Vulnerable Software and Affected Versions: @nfid/embed SDK versions prior to 0.10.1-alpha.6 @dfinity/auth-client versions prior to 1.0.1 @dfinity/identity versions prior to 1.0.1 Description: The issue affects user sessions in the @nfid/embed SDK that utilize Ed25519 keys, due to a...

PT-2024-1972 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab EE versions 12.0 through 16.7.6 GitLab EE versions 16.8 through 16.8.2 GitLab EE versions 16.9 through 16.9.0 Description: The issue discovered in GitLab EE is related to insufficient access control, allowing for the bypassing of 'grou...

CVE-2024-23114 Apache Camel: Camel-CassandraQL: Unsafe Deserialization from CassandraAggregationRepository

Deserialization of Untrusted Data vulnerability in Apache Camel CassandraQL Component AggregationRepository which is vulnerable to unsafe deserialization. Under specific conditions it is possible to deserialize malicious payload.This issue affects Apache Camel: from 3.0.0 before 3.21.4, from 3.22...

PT-2024-21322 · Liferay · Liferay Dxp +1

Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.2.0 through 7.4.3.37 Liferay DXP versions prior to 7.4 update 38 Liferay DXP versions prior to 7.3 update 11 Liferay DXP versions prior to 7.2 fix pack 20 Description: A cross-site scripting XSS issue in the Frontend...