Debian dsa-5817 : chromium - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5817 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-5817-1 [email protected] https://www.debian.org/securit...

CVE-2024-5875

IrfanView SHP File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of IrfanView. User interaction is required to exploit this vulnerability in that the target must visit a malicious pag...

USN-7116-1: Python vulnerability

It was discovered that Python incorrectly handled quoting path names when using the venv module. A local attacker able to control virtual environments could possibly use this issue to execute arbitrary code when the virtual environment is activated...

OESA-2024-2401 firefox security update

Mozilla Firefox is a standalone web browser, designed for standards compliance and performance. Its functionality can be enhanced via a plethora of extensions. Security Fixes: Memory safety bugs present in Firefox 127, Firefox ESR 115.12, and Thunderbird 115.12. Some of these bugs showed evidence...

Ivanti Endpoint Manager 2024 - November 2024 Security Update

The version of Ivanti Endpoint Manager 2024 running on the remote host lacking the November 2024 Hotfix. It is, therefore, affected by mutliple vulnerabilities: - Path traversal in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a local...

firefox: thunderbird: Memory safety bugs fixed in Firefox 132, Thunderbird 132, Firefox ESR 128.4, and Thunderbird 128.4

A flaw was found in Mozilla. The Mozilla Foundation's Security Advisory describes the following issue: Memory safety bugs present in Firefox 131, Firefox ESR 128.3, and Thunderbird 128.3. Some of these bugs showed evidence of memory corruption, and we presume that with enough effort, some of thes...

CVE-2024-27528

wasm3 139076a suffers from Invalid Memory Read, leading to DoS and potential Code Execution...

OESA-2024-2339 hdf5 security update

HDF5 is a data model, library, and file format for storing and managing data. It supports an unlimited variety of datatypes, and is designed for flexible and efficient I/O and for high volume and complex data. HDF5 is portable and is extensible, allowing applications to evolve in their use of HDF...

Autodesk Multiple Vulnerabilities (AutoCAD) (adsk-sa-2024-0019) (adsk-sa-2024-0021)

The version of Autodesk AutoCAD installed on the remote Windows host is a version prior to 2025.1.1. It is, therefore, affected by multiple vulnerabilities: - A maliciously crafted SLDPRT file when parsed in odxswdll.dll through Autodesk affected applications can force a Heap-Based Buffer Overflo...

Apple macOS CoreText Font Ligature Caret List Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Apple macOS. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of...

CVE-2024-0129

NVIDIA NeMo contains a vulnerability in SaveRestoreConnector where a user may cause a path traversal issue via an unsafe .tar file extraction. A successful exploit of this vulnerability may lead to code execution and data tampering...

PT-2024-6803 · Unknown · Angular-Base64-Upload

Name of the Vulnerable Software and Affected Versions: angular-base64-upload versions prior to v0.1.21 Description: The issue is related to the angular-base64-upload library, which has a vulnerability that allows an attacker to execute arbitrary code on the server by uploading a specially crafted...

Siemens Tecnomatix Plant Simulation Memory Corruption Vulnerability (CNVD-2024-40014)

Tecnomatix Plant Simulation allows the modeling, simulation, exploration and optimization of logistics systems and their processes. These models allow material flow, resource utilization and logistics analysis of all manufacturing plans from global production facilities to local plants and specif...

Siemens Tecnomatix Plant Simulation Out-of-Bounds Read Vulnerability (CNVD-2024-40023)

Tecnomatix Plant Simulation allows the modeling, simulation, exploration and optimization of logistics systems and their processes. These models allow material flow, resource utilization and logistics analysis of all manufacturing plans from global production facilities to local plants and specif...

Siemens Tecnomatix Plant Simulation Memory Corruption Vulnerability (CNVD-2024-40016)

Tecnomatix Plant Simulation allows the modeling, simulation, exploration and optimization of logistics systems and their processes. These models allow material flow, resource utilization and logistics analysis of all manufacturing plans from global production facilities to local plants and specif...

USN-7054-1: unzip vulnerability

It was discovered that unzip did not properly handle unicode strings under certain circumstances. If a user were tricked into opening a specially crafted zip file, an attacker could possibly use this issue to cause unzip to crash, resulting in a denial of service, or possibly execute arbitrary co...

PT-2025-4095 · Unknown · Pdf-Xchange Editor

Name of the Vulnerable Software and Affected Versions: PDF-XChange Editor affected versions not specified Description: This issue allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this, as the target...

PT-2024-6334 · Winzip · Winzip

Name of the Vulnerable Software and Affected Versions: WinZip versions prior to 29.0 Description: The issue is related to a Mark-of-the-Web Bypass Vulnerability in WinZip, allowing remote attackers to bypass the Mark-of-the-Web protection mechanism. This can be exploited when a user opens a...

PT-2024-8201 · Artifex +8 · Artifex Ghostscript +8

Name of the Vulnerable Software and Affected Versions: Artifex Ghostscript versions prior to 10.04.0 Description: The issue is related to an integer overflow in the base/gsdevice.c component of Artifex Ghostscript, which can result in path truncation and possible path traversal and code execution...

Ivanti Endpoint Manager GetSQLStatement SQL Injection Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Endpoint Manager. Authentication is required to exploit this vulnerability. The specific flaw exists within the implementation of the GetSQLStatement method. The issue results from the lack of...