CVE-2024-53809

CVE-2024-53809 : A Cross-Site Request Forgery (CSRF) vulnerability affects the WordPress plugin Namaste! LMS (Kiboko Labs) up to version 2.6.4.1. The CVE entry notes exposure across Namaste! LMS versions ≤ 2.6.4.1 and lists a MEDIUM (CVSS v3.1: 4.3) impact. Connected sources repeatedly describe t...

CVE-2024-11368 Splash Sync <= 2.0.7 - Reflected Cross-Site Scripting

The Splash Sync plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 2.0.7. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages tha...

FreeBSD : electron33 -- Inappropriate implementation in Extensions (8b6e97a9-804e-4366-9f75-d102b22a716d)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 8b6e97a9-804e-4366-9f75-d102b22a716d advisory. Electron developers report: This update fixes the following vulnerability: Tenable has extracted the...

CVE-2024-6119 affecting package hvloader for versions less than 1.0.1-5

CVE-2024-6119 affecting package hvloader for versions less than 1.0.1-5. A patched version of the package is available...

AZL-53486 CVE-2024-11234 affecting package php for versions less than 8.3.14-1

In PHP versions 8.1. before 8.1.31, 8.2. before 8.2.26, 8.3. before 8.3.14, when using streams with configured proxy and "requestfulluri" option, the URI is not properly sanitized which can lead to HTTP request smuggling and allow the attacker to use the proxy to perform arbitrary HTTP requests...

Kubernetes kubelet arbitrary command execution

The Kubernetes kubelet component allows arbitrary command execution via specially crafted gitRepo volumes.This issue affects kubelet: through 1.28.11, from 1.29.0 through 1.29.6, from 1.30.0 through 1.30.2...

RClone 1.59.x < 1.68.2 Privilege Escalation (macOS)

The version of rclone installed on the remote macOS / Mac OS X host is prior to 1.68.2. It is, therefore, affected by a privilege escalation vulnerability due to insecure handling of symlinks with --links and --metadata while copying to local disk. This vulnerability could allow unprivileged user...

Palo Alto Networks PAN-OS 10.1.x < 10.1.14 / 10.2.x < 10.2.11 / 11.0.x < 11.0.6 / 11.1.x < 11.1.4 Vulnerability

The version of Palo Alto Networks PAN-OS running on the remote host is 10.1.x prior to 10.1.14 or 10.2.x prior to 10.2.11 or 11.0.x prior to 11.0.6 or 11.1.x prior to 11.1.4. It is, therefore, affected by a vulnerability. A cross-site scripting XSS vulnerability in Palo Alto Networks PAN-OS...

Apache Tomcat 10.1.27 < 10.1.31 multiple vulnerabilities

The version of Tomcat installed on the remote host is prior to 10.1.31. It is, therefore, affected by multiple vulnerabilities as referenced in the fixedinapachetomcat10.1.31security-10 advisory. - Incorrect object re-cycling and re-use vulnerability in Apache Tomcat. Incorrect recycling of the...

BIT-POSTGRESQL-2024-10978 PostgreSQL SET ROLE, SET SESSION AUTHORIZATION reset to wrong user ID

Incorrect privilege assignment in PostgreSQL allows a less-privileged application user to view or change different rows from those intended. An attack requires the application to use SET ROLE, SET SESSION AUTHORIZATION, or an equivalent feature. The problem arises when an application query uses...

CVE-2024-10921 Improper neutralization of null bytes may lead to buffer over-reads in MongoDB Server

An authorized user may trigger crashes or receive the contents of buffer over-reads of Server memory by issuing specially crafted requests that construct malformed BSON in the MongoDB Server. This issue affects MongoDB Server v5.0 versions prior to 5.0.30 , MongoDB Server v6.0 versions prior to...

Apache RocketMQ < 4.9.6 / 5.0.x < 5.1.1 RCE

The version of Apache RocketMQ installed on the remote host is prior to 4.9.6 or 5.1.1. It is, therefore, affected by a remote code execution vulnerability. - For RocketMQ versions 5.1.0 and below, under certain conditions, there is a risk of remote command execution. Several components of...

Apache APISIX Dashboard < 2.10.1 Authentication Bypass

Apache APISIX Dashboard version prior to 2.10.1 suffers from a vulnerability allowing a remote attacker to bypass authentication and access sensitive resources via a specially forged request. No source data...

Amazon Linux 2 : kernel (ALASKERNEL-5.10-2024-073)

The version of kernel installed on the remote host is prior to 5.10.210-201.855. It is, therefore, affected by a vulnerability as referenced in the ALAS2KERNEL-5.10-2024-073 advisory. In the Linux kernel, the following vulnerability has been resolved: ext4: fix corruption during on-line resize...

CVE-2024-50015 affecting package kernel for versions less than 6.6.57.1-2

CVE-2024-50015 affecting package kernel for versions less than 6.6.57.1-2. An upgraded version of the package is available that resolves this issue...

CVE-2024-47686 affecting package kernel for versions less than 6.6.56.1-5

CVE-2024-47686 affecting package kernel for versions less than 6.6.56.1-5. An upgraded version of the package is available that resolves this issue...

CVE-2024-51055

An issue Hoosk v1.7.1 allows a remote attacker to execute arbitrary code via a crafted script to the config.php component...

Apache ZooKeeper 3.9.x < 3.9.3 Authentication Bypass

The version of Apache ZooKeeper listening on the remote host is 3.9.x prior to 3.9.3. It is, therefore, affected by an authentication bypass vulnerability: - When using IPAuthenticationProvider in ZooKeeper Admin Server there is a possibility of Authentication Bypass by Spoofing -- this only...

Ollama < 0.1.34 DoS

The version of Ollama installed on the remote host is prior to 0.1.34. It is, therefore, affected by a denial-of-service vulnerability: - An issue was discovered in Ollama before 0.1.34. The CreateModelHandler function uses os.Open to read a file until completion. The req.Path parameter is...

Mastodon 4.1.x < 4.1.2 LDAP injection

According to its self-reported version number, the version of Mastodon running on the remote host is 2.5.0 prior to 3.5.8 or 4.0.x prior to 4.0.4 or 4.1.x prior to 4.1.2. Therefore, it may be affected by a blind LDAP injection in login allows the attacker to leak arbitrary attributes from LDAP...