PT-2024-40180 · Unknown · @Nfid/Embed Sdk +2

Name of the Vulnerable Software and Affected Versions: @nfid/embed SDK versions prior to 0.10.1-alpha.6 @dfinity/auth-client versions prior to 1.0.1 @dfinity/identity versions prior to 1.0.1 Description: The issue affects user sessions in the @nfid/embed SDK that utilize Ed25519 keys, due to a...

PT-2024-1972 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab EE versions 12.0 through 16.7.6 GitLab EE versions 16.8 through 16.8.2 GitLab EE versions 16.9 through 16.9.0 Description: The issue discovered in GitLab EE is related to insufficient access control, allowing for the bypassing of 'grou...

CVE-2024-23114 Apache Camel: Camel-CassandraQL: Unsafe Deserialization from CassandraAggregationRepository

Deserialization of Untrusted Data vulnerability in Apache Camel CassandraQL Component AggregationRepository which is vulnerable to unsafe deserialization. Under specific conditions it is possible to deserialize malicious payload.This issue affects Apache Camel: from 3.0.0 before 3.21.4, from 3.22...

PT-2024-21322 · Liferay · Liferay Dxp +1

Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.2.0 through 7.4.3.37 Liferay DXP versions prior to 7.4 update 38 Liferay DXP versions prior to 7.3 update 11 Liferay DXP versions prior to 7.2 fix pack 20 Description: A cross-site scripting XSS issue in the Frontend...

SUSE-SU-2024:0460-1 Security update for rekor

This update for rekor fixes the following issues: update to 1.3.5 jscSLE-23476: - Additional unique index correction - Remove timestamp from checkpoint - Drop conditional when verifying entry checkpoint - Fix panic for DSSE canonicalization - Change Redis value for locking mechanism - give log...

Vulnerabilities fixed in Fortinet FortiOS

Fortinet has fixed vulnerabilities in FortiOS. A unauthenticated malicious party could exploit the vulnerabilities to cause a denial-of-service, or to execute arbitrary code execute arbitrary code on the vulnerable system. Also, a malicious party could potentially gain access to the FortiLink...

PT-2024-1785

Name of the Vulnerable Software and Affected Versions Django versions 3.2 before 3.2.24 Django versions 4.2 before 4.2.10 Django versions 5.0 before 5.0.2 Description The issue is related to a potential denial-of-service attack when the intcomma template filter is used with very long strings. Thi...

Important: redis6

Issue Overview: Redis is an in-memory database that persists on disk. Redis incorrectly handles resizing of memory buffers which can result in integer overflow that leads to heap overflow and potential remote code execution. This issue has been patched in version 7.0.15 and 7.2.4. CVE-2023-41056...

PT-2024-11056 · Meinberg · Meinberg Lantime-Firmware

Name of the Vulnerable Software and Affected Versions: Meinberg LANTIME-Firmware versions prior to 6.24.029 Meinberg LANTIME-Firmware versions 7 prior to 7.04.008 Description: An issue was discovered in the LTOS-Web-Interface of Meinberg LANTIME-Firmware, where an admin can delete required user...

Atlassian Confluence 8.0 < 8.5.4 (CONFSERVER-93833) (Direct Check)

Binary data confluencecve202322527.nbin...

Vulnerabilities fixed in GitLab Enterprise Edition and Community Edition

GitLab has fixed vulnerabilities in GitLab Enterprise Edition EE and Community Edition CE. A malicious party could vulnerabilities to exploit attacks that can result in the following categories of damage: Denial-of-Service DoS. Manipulation of data Remote code execution Administrator/Root rights...

PT-2024-1477 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 12.7 through 16.6.5 GitLab CE/EE versions 16.7 through 16.7.3 GitLab CE/EE versions 16.8 through 16.8.0 Description: An issue has been discovered in GitLab CE/EE, where it is possible for an attacker to trigger a Regular...

SUSE-SU-2024:0075-1 Security update for LibreOffice

This update for LibreOffice fixes the following issues: libreoffice: - Version update from 7.3.6.2 to 7.5.4.1 jscPED-3561, jscPED-3550, jscPED-1785: For the highlights of changes of version 7.5 please consult the official release notes: https://wiki.documentfoundation.org/ReleaseNotes/7.5 For the...

PT-2024-40333 · Teleport · Teleport

Name of the Vulnerable Software and Affected Versions: Teleport versions prior to 12.4.31 Teleport versions prior to 13.4.13 Teleport versions prior to 14.2.4 Description: An authenticated attacker with valid credentials can make non-blind Server-Side Request Forgery SSRF through the proxy and/or...

PT-2023-24733 · Stormshield · Stormshield Network Security

Name of the Vulnerable Software and Affected Versions: Stormshield Network Security SNS versions 1.0.0 through 3.7.36 Stormshield Network Security SNS versions 3.8.0 through 3.11.24 Stormshield Network Security SNS versions 4.0.0 through 4.3.18 Stormshield Network Security SNS versions 4.4.0...

PT-2023-30140 · Github · Github Enterprise Server

Name of the Vulnerable Software and Affected Versions: GitHub Enterprise Server versions 3.7 through 3.7.18 GitHub Enterprise Server versions 3.8 through 3.8.11 GitHub Enterprise Server versions 3.9 through 3.9.6 GitHub Enterprise Server versions 3.10 through 3.10.3 GitHub Enterprise Server...

PT-2023-32755 · Github · Github Enterprise Server

Name of the Vulnerable Software and Affected Versions: GitHub Enterprise Server versions prior to 3.7.19 GitHub Enterprise Server versions prior to 3.8.12 GitHub Enterprise Server versions prior to 3.9.7 GitHub Enterprise Server versions prior to 3.10.4 GitHub Enterprise Server versions prior to...

Vulnerability fixed in Google Chrome

Google has fixed a vulnerability in Chrome. The vulnerability is located in WebRTC, and a malicious person could exploit it to execute arbitrary code in the context of the browser. Google reports being aware that exploit code is being shared in limited shared. This exploit code is not yet publicl...

PT-2023-31716 · Redpanda · Redpanda

Name of the Vulnerable Software and Affected Versions: Redpanda versions prior to 23.1.21 Redpanda versions 23.2.x prior to 23.2.18 Description: The issue is related to missing authorization checks in the "Transactions API". This could potentially allow unauthorized access or actions...

PT-2023-12746 · Insyde · Insydeh2O

Name of the Vulnerable Software and Affected Versions: InsydeH2O versions 5.2 before 05.27.29 InsydeH2O versions 5.3 before 05.36.29 InsydeH2O versions 5.4 before 05.44.13 InsydeH2O versions 5.5 before 05.52.13 Description: A TOCTOU race-condition issue allows an attacker to alter data and code...