CVE-2024-35311

Yubico YubiKey 5 Series before 5.7.0, Security Key Series before 5.7.0, YubiKey Bio Series before 5.6.4, and YubiKey 5 FIPS before 5.7.2 have Incorrect Access Control...

WordPress Gianism plugin < 5.2.1 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Felipe Restrepo Rodriguez, Mateo Gutierrez Gomez in WordPress Plugin Gianism versions 5.2.1...

CVE-2024-22641

TCPDF version 6.6.5 and before is vulnerable to ReDoS Regular Expression Denial of Service if parsing an untrusted SVG file...

PT-2024-6103

Name of the Vulnerable Software and Affected Versions Requests versions prior to 2.32.0 Description The issue is related to the incorrect implementation of control flow in the Python Requests library, which can allow an attacker to access confidential data. When making requests through a Requests...

CVE-2019-9512 affecting package python-tensorboard for versions less than 2.16.2-1

CVE-2019-9512 affecting package python-tensorboard for versions less than 2.16.2-1. An upgraded version of the package is available that resolves this issue...

CVE-2024-24786 affecting package blobfuse2 for versions less than 2.1.2-7

CVE-2024-24786 affecting package blobfuse2 for versions less than 2.1.2-7. A patched version of the package is available...

CVE-2024-3851

The CVE-2024-3851 entry describes a stored XSS in the imartinez/privategpt repository due to improper validation of file uploads. Affected component: file upload validation mechanism; vulnerability arises when attackers upload malicious HTML/JavaScript files, which execute in the victim’s browser...

CVE-2024-32064

A vulnerability has been identified in Simcenter Femap All versions V2406. The affected applications contain an out of bounds read past the end of an allocated structure while parsing specially crafted IGS files. This could allow an attacker to execute code in the context of the current process...

CVE-2022-32502

An issue was discovered on certain Nuki Home Solutions devices. There is a buffer overflow over the encrypted token parsing logic in the HTTP service that allows remote code execution. This affects Nuki Bridge v1 before 1.22.0 and v2 before 2.13.2...

Apache Hive Code Injection Vulnerability

Apache Hive is a set of data warehouse software based on Hadoop Distributed Systems Infrastructure from the Apache Apache Foundation in the United States. The software provides a data integration approach and a high-level query language to support large-scale data analysis on Hadoop. A code...

PT-2024-22297

Name of the Vulnerable Software and Affected Versions Apache Superset versions prior to 3.1.2 Description An authenticated user could potentially access metadata for a datasource they are not authorized to view by submitting a targeted REST API request. Recommendations For versions prior to 3.1.2...

PT-2024-25677 · Pterodactyl · Pterodactyl Wings

Name of the Vulnerable Software and Affected Versions: Pterodactyl Wings versions prior to 1.11.12 Description: The issue allows an attacker to gain arbitrary file write and read access on a node if the Wings token is leaked, either by viewing the node configuration or posting it accidentally...

EUVD-2024-1373

xml-crypto is an xml digital signature and encryption library for Node.js. In affected versions the default configuration does not check authorization of the signer, it only checks the validity of the signature per section 3.2.2 of the w3 xmldsig-core-20080610 spec. As such, without additional...

CVE-2024-33764

lunasvg v2.3.9 was discovered to contain a stack-overflow at lunasvg/source/element.h...

AZL-40068 CVE-2024-3096 affecting package php for versions less than 8.1.28-1

In PHP version 8.1. before 8.1.28, 8.2. before 8.2.18, 8.3. before 8.3.5, if a password stored with passwordhash starts with a null byte \x00, testing a blank string as the password via passwordverify will incorrectly return true...

PT-2024-25430

Name of the Vulnerable Software and Affected Versions Veritas NetBackup versions prior to 10.4 Description An issue was discovered in Veritas NetBackup that allows the Multi-Threaded Agent to be used for arbitrary file deletion on protected files. Recommendations For versions prior to 10.4, updat...

GHSA-5X96-J797-5QQW Sensitive Information leak via Log File in Kubernetes

In Kubernetes clusters using Ceph RBD as a storage provisioner, with logging level of at least 4, Ceph RBD admin secrets can be written to logs. This occurs in kube-controller-manager's logs during provisioning of Ceph RBD persistent claims. This affects v1.19.3, v1.18.10, v1.17.13...

Privilege Escalation in Kubernetes

The Kubernetes kube-apiserver in versions v1.6-v1.15, and versions prior to v1.16.13, v1.17.9 and v1.18.7 are vulnerable to an unvalidated redirect on proxied upgrade requests that could allow an attacker to escalate privileges from a node compromise to a full cluster compromise...

FreeBSD : GLPI -- multiple vulnerabilities (bb49f1fa-00da-11ef-92b7-589cfc023192)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the bb49f1fa-00da-11ef-92b7-589cfc023192 advisory. - GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Servic...

CVE-2024-2440

A race condition in GitHub Enterprise Server allowed an existing admin to maintain permissions on a detached repository by making a GraphQL mutation to alter repository permissions while the repository is detached. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.13...