CVE-2024-43201

The CVE-2024-43201 entry covers the Planet Fitness Workouts mobile apps (iOS/Android) with an improper TLS certificate validation vulnerability. The underlying issue allows an attacker with network access to obtain session tokens and sensitive information from affected apps. The vulnerability aff...

Microsoft Visio graphic editors

The vulnerability of Microsoft Visio graphic editors, Microsoft Office programs, and 365 Apps for Enterprise is related to access control errors. Exploiting this vulnerability allows an attacker to execute arbitrary code, provided that the user opens a specially crafted file...

PT-2024-30367 · Planet Fitness · Planet Fitness Workouts

Name of the Vulnerable Software and Affected Versions: The Planet Fitness Workouts iOS and Android mobile apps versions prior to 9.8.12 Description: The issue is related to the failure of the Planet Fitness Workouts iOS and Android mobile apps to properly validate TLS certificates. This allows an...

Planet Fitness Workouts mobile apps do not properly validate TLS certificates

RISK EVALUATION The Planet Fitness Workouts iOS and Android mobile apps are vulnerable to network attacks due to improper TLS certificate validation, allowing an attacker to obtain session tokens and sensitive information. This issue was fixed in version 9.8.12. 2. RECOMMENDED PRACTICES Upgrade...

galaxy-app (>=23.0.4, <=23.2.1), galaxy-web-apps (>=23.0.4, <=23.2.1) +1 more potentially affected by CVE-2024-42346 via galaxy-data (23.2.1)

galaxy-data PYPI version 23.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on galaxy-data and may be impacted: - galaxy-app =23.0.4, =23.0.4, =21.9.0, =23.2.1 Source cves: CVE-2024-42346 Source advisory: OSV:PYSEC-2024-273...

galaxy-app (>=23.0.1, <=24.0.3), galaxy-job-execution (>=23.0.1, <=24.0.3) +4 more potentially affected by CVE-2024-42346 via galaxy-data (24.0.3)

galaxy-data PYPI version 24.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on galaxy-data and may be impacted: - galaxy-app =23.0.1, =23.0.1, =23.0.2, =22.1.1, =23.2.1, =24.0.3 Source cves: CVE-2024-42346 Source advisory: OSV:PYSEC-2024-273...

PT-2024-6335 · Microsoft · Office Visio +2

Name of the Vulnerable Software and Affected Versions: Microsoft Visio affected versions not specified Microsoft Office affected versions not specified Microsoft 365 Apps for Enterprise affected versions not specified Description: The issue is related to errors in access control, allowing an...

CVE-2024-45601

Mesop is a Python-based UI framework designed for rapid web apps development. A vulnerability has been discovered and fixed in Mesop that could potentially allow unauthorized access to files on the server hosting the Mesop application. The vulnerability was related to insufficient input validatio...

CVE-2024-45601 Local file Inclusion via static file serving functionality in Mesop

Mesop is a Python-based UI framework designed for rapid web apps development. A vulnerability has been discovered and fixed in Mesop that could potentially allow unauthorized access to files on the server hosting the Mesop application. The vulnerability was related to insufficient input validatio...

CVE-2024-45601 Local file Inclusion via static file serving functionality in Mesop

Mesop is a Python-based UI framework designed for rapid web apps development. A vulnerability has been discovered and fixed in Mesop that could potentially allow unauthorized access to files on the server hosting the Mesop application. The vulnerability was related to insufficient input validatio...

CVE-2024-45601 Local file Inclusion via static file serving functionality in Mesop

Mesop is a Python-based UI framework designed for rapid web apps development. A vulnerability has been discovered and fixed in Mesop that could potentially allow unauthorized access to files on the server hosting the Mesop application. The vulnerability was related to insufficient input validatio...

Binance Warns of Rising Clipper Malware Attacks Targeting Cryptocurrency Users

Cryptocurrency exchange Binance is warning of an "ongoing" global threat that's targeting cryptocurrency users with clipper malware with the goal of facilitating financial fraud. Clipper malware, also called ClipBankers, is a type of malware that Microsoft calls cryware, which comes with...

CVE-2024-40837

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15. An app may be able to access protected user data...

CVE-2024-40830

This issue was addressed with improved data protection. This issue is fixed in iOS 18 and iPadOS 18. An app may be able to enumerate a user's installed apps...

CVE-2024-40830

This issue was addressed with improved data protection. This issue is fixed in iOS 18 and iPadOS 18. An app may be able to enumerate a user's installed apps...

KLA73441 PE vulnerability in Microsoft Apps

An elevation of privilege vulnerability was found in Microsoft Apps. Malicious users can exploit this vulnerability to gain privileges. Original advisories CVE-2024-38183 Exploitation Related products GroupMe CVE list CVE-2024-38183 critical Solution Install necessary updates from the KB section,...

Apple iOS and Apple iPadOS security vulnerabilities

Apple iOS and Apple iPadOS are products of Apple Inc. Apple iOS is an operating system developed for mobile devices, and Apple iPadOS is an operating system for iPad tablets. A security vulnerability exists in Apple iOS version 17.7 and Apple iPadOS version 17.7, which originates from a...

CVE-2024-40830

This issue was addressed with improved data protection. This issue is fixed in iOS 18 and iPadOS 18. An app may be able to enumerate a user's installed apps...

Malicious code in discord-api (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 3b55230c05e2303e965a53322d83ead8df66e188c696755b26efefd96192a144 Package suggests being an api for discord. On importing the module, it attempts to find and exfiltrate leveldb databases from Discord apps and Chrome ---...

CVE-2024-45833

Mattermost Mobile Apps versions =2.18.0 fail to disable autocomplete during login while typing the password and visible password is selected, which allows the password to get saved in the dictionary when the user has Swiftkey as the default keyboard, the masking is off and the password contains a...