PT-2024-35797 · Unknown · Phpgurukul Covid19 Testing Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul COVID 19 Testing Management System version 1.0 Description: A Reflected Cross Site Scripting XSS issue was found in the /covid-tms/patient-search-report.php endpoint, which allows remote attackers to execute arbitrary code via the...

PT-2024-29281 · Unknown · Contiki-Ng

Name of the Vulnerable Software and Affected Versions: Contiki-NG affected versions not specified Description: An out-of-bounds read of 1 byte can be triggered when sending a packet to a device running the Contiki-NG operating system with SNMP enabled. The issue exists in the...

GHSA-7P9F-6X8J-GXXP CRI-O: Maliciously structured checkpoint file can gain arbitrary node access

Impact Patches 1.31.1, 1.30.6, 1.29.8 Workarounds set enablecriusupport = false References Are there any links users can visit to find out more?...

PT-2024-35775 · Taiga · Taiga

Name of the Vulnerable Software and Affected Versions: Taiga version 6.8.1 Description: A CSV injection issue allows attackers to execute arbitrary code via uploading a crafted CSV file. This is achieved by loading a specifically manipulated CSV file, enabling the execution of arbitrary code...

PT-2024-9475 · Advantech · Advantech Eki-6333Ac-2G +1

Name of the Vulnerable Software and Affected Versions: Advantech EKI-6333AC-2G versions 1.6.3 and earlier Advantech EKI-6333AC-2GD versions 1.6.3 and earlier Advantech EKI-6333AC-1GPO versions 1.2.1 and earlier Description: A vulnerability was discovered in the "edgserver" service of Advantech's...

PT-2024-35793 · Spip · Spip

Name of the Vulnerable Software and Affected Versions: SPIP version 4.3.3 Description: The issue concerns an authenticated arbitrary file upload vulnerability in the Documents module. This allows attackers to execute arbitrary code by uploading a crafted PDF file. There is no information provided...

kernel:4.18.0 security update

4.18.0-553.30.110.OL8 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and...

The vulnerability of the powerpc/64s/interrupt components in the Linux operating system’s kernel allows a hacker to trigger a service failure.

The vulnerability of the powerpc/64s/interrupt components in the Linux operating system’s kernel is related to errors in resource management in the exitmustharddisable function. Exploiting this vulnerability could allow an attacker to cause a service failure...

CVE-2024-53258 download_all_submissions allows student to download another student's submissions in Autolab

Autolab is a course management service that enables auto-graded programming assignments. From Autolab versions v.3.0.0 onward students can download all assignments from another student, as long as they are logged in, using the downloadallsubmissions feature. This can allow for leakage of...

CVE-2024-53258 download_all_submissions allows student to download another student's submissions in Autolab

Autolab is a course management service that enables auto-graded programming assignments. From Autolab versions v.3.0.0 onward students can download all assignments from another student, as long as they are logged in, using the downloadallsubmissions feature. This can allow for leakage of...

Malware Exploits Trusted Avast Anti-Rootkit Driver to Disable Security Software

Malware exploits legitimate Avast anti-rootkit driver to disable security software. Trellix researchers uncover the attack and provide mitigation steps...

PT-2024-40108 · Github Actions · Dawidd6/Action-Download-Artifact

Name of the Vulnerable Software and Affected Versions: dawidd6/action-download-artifact versions prior to v6 Description: The issue allows an unprivileged attacker to introduce compromised artifacts into a privileged workflow context by exploiting the default behavior of searching a repository's...

PT-2024-8791 · Dell · Dell Wyse Management Suite

Name of the Vulnerable Software and Affected Versions: Dell Wyse Management Suite versions WMS 4.4 and before Description: The issue is related to an authentication bypass vulnerability in the Dell Wyse Management Suite, which could allow a remote attacker to cause a denial of service. A...

PT-2024-17156 · Unknown · 1000 Projects Beauty Parlour Management System

Name of the Vulnerable Software and Affected Versions: 1000 Projects Beauty Parlour Management System version 1.0 Description: A critical issue has been found in the 1000 Projects Beauty Parlour Management System. This issue affects an unknown part of the file /admin/add-customer.php. The...

PT-2024-35785 · Unknown · Lafelabs Chaos

Name of the Vulnerable Software and Affected Versions: LafeLabs Chaos version 0.0.1 Description: A cross-site scripting XSS issue exists in the "/scroll.php" endpoint, allowing attackers to execute arbitrary web scripts or HTML via a crafted payload. This could potentially lead to unauthorized...

PT-2024-9998 · NetGear · Netgear R6900P

Name of the Vulnerable Software and Affected Versions: Netgear R6900 version 1.0.1.26 1.0.20 Description: A critical vulnerability has been found in the Netgear R6900 router, affecting an unknown functionality of the file upgrade check.cgi in the HTTP Header Handler component. The manipulation of...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: USB: core: Fix access violation during port device removal Testing with KASAN and syzkaller revealed a bug in the port.c file: the disablestore function can return NULL if the hub to which the port belongs is removed concurrently...

SUSE CVE-2024-53094

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Add sendpageok check to disable MSGSPLICEPAGES While running ISER over SIW, the initiator machine encounters a warning from skbsplicefromiter indicating that a slab page is being used in sendpage. To address this, it is...

PT-2024-17140 · Unknown · Macrozheng Mall

Name of the Vulnerable Software and Affected Versions: macrozheng mall versions up to 1.0.3 Description: A problematic issue has been found in the JWT Token Handler component, leading to the use of a default cryptographic key. The complexity of an attack is rather high, and exploitation is known ...

PT-2024-35418 · Totolink · Totolink X6000R

Name of the Vulnerable Software and Affected Versions: TOTOLINK X6000R version 9.4.0cu.1041 B20240224 Description: The issue arises from the use of the Uci Set function without strict parameter filtering in the shttpd file. This allows an attacker to achieve arbitrary command execution by...