PT-2024-17151 · WordPress · Accessibility By Allaccessible

Name of the Vulnerable Software and Affected Versions: Accessibility by AllAccessible plugin for WordPress versions up to, and including, 1.3.4 Description: The Accessibility by AllAccessible plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege...

PT-2024-17454 · Horilla · Horilla

Name of the Vulnerable Software and Affected Versions: horilla versions up to 1.2.1 Description: A critical vulnerability was found in horilla, affecting the function request new/get employee shift/create reimbursement/key result current value update/create meetings/create skills. The manipulatio...

Synapse Matrix has a partial room state leak via Sliding Sync

Impact The Sliding Sync feature on Synapse versions between 1.113.0rc1 and 1.120.0 can leak partial room state changes to users no longer in a room. Non-state events, like messages, are unaffected. Patches Synapse version 1.120.1 fixes the problem. Workarounds Disable Sliding Sync. References...

PT-2024-20701 · Ibm · Ibm Cognos Controller

Name of the Vulnerable Software and Affected Versions: IBM Cognos Controller versions 11.0.0 through 11.0.1 Description: The issue concerns a malicious file upload vulnerability due to the lack of validation of the type of file uploaded to Journal entry attachments. Attackers can exploit this...

PT-2024-35965

Name of the Vulnerable Software and Affected Versions: Synapse versions 1.113.0rc1 through 1.120.0 Description: The Sliding Sync feature in Synapse can leak partial room state changes to users who are no longer in a room. This issue does not affect non-state events, such as messages...

PT-2024-9566 · Ruijie · Ruijie Reyee Os

Name of the Vulnerable Software and Affected Versions: Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x Description: The issue is related to a premature resource release during its usage, which can be exploited by a remote attacker to interrupt a legitimate user's session and caus...

PT-2024-35463

Name of the Vulnerable Software and Affected Versions Synapse versions prior to 1.120.1 Description Synapse is an open-source Matrix homeserver. The issue arises from the failure to properly validate invites received over federation, allowing a malicious server to send a specially crafted invite...

How to Disable Boot Prompt in Veeam Agent for Windows Recovery Media

Version Requirement Requires Veeam Agent for Microsoft Windows version 6.3, which is included with Veeam Backup & Replication 12.3. Purpose This article documents how to disable the 'Press any key to boot from CD or DVD... " prompt that appears when booting from the Veeam Agent for Microsoft...

PT-2024-32080 · Infodrom · Infodom Performa 365

Name of the Vulnerable Software and Affected Versions: InfoDom Performa 365 version 4.0.1 Description: The issue is related to an authenticated arbitrary file upload vulnerability in the "/documentCache/upload" endpoint. This allows attackers to execute arbitrary code by uploading a crafted SVG...

PT-2024-9571 · Ruijie · Ruijie Reyee Os

Name of the Vulnerable Software and Affected Versions: Ruijie Reyee OS versions 2.206.x through 2.320.x Description: The issue is related to the Ruijie MQTT broker in Ruijie Reyee OS, where an attacker could subscribe to partial possible topics and receive partial messages being sent to and from...

CLSA-2024-1733141124 squid: Fix of CVE-2024-45802

CVE-2024-45802: Fix DoS by a trusted server by disabling ESI...

Multiple vulnerabilities in UNIVERGE IX/IX-R/IX-V series routers

Overview UNIVERGE IX/IX-R/IX-V series routers provided by NEC Corporation contain multiple vulnerabilities listed below. Command injection CWE-77 - CVE-2024-11013 Cross-site request forgery WE-352 - CVE-2024-11014 RyotaK of Flatt Security Inc. reported these vulnerabilities to NEC Corporation and...

PT-2024-40073 · Apache +1 · Apache +1

Name of the Vulnerable Software and Affected Versions: ibexa post-install versions prior to the patched versions Description: The issue is related to the BREACH vulnerability, which affects HTTP compression and can allow secrets to be extracted through carefully crafted requests. This is due to...

PT-2024-35902 · Advance · Advanced

Name of the Vulnerable Software and Affected Versions: Advanced What should we write next about versions n/a through 1.0.3 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions o...

PT-2024-40372 · Varnish +1 · Varnish +1

Name of the Vulnerable Software and Affected Versions: ezplatform-http-cache affected versions not specified Description: The issue is related to the BREACH vulnerability, which affects HTTP compression and can allow secrets to be extracted through carefully crafted requests. This is due to...

PT-2024-35979 · Victure · Victure Rx1800 Wifi 6 Router

Name of the Vulnerable Software and Affected Versions: Victure RX1800 WiFi 6 Router version EN V1.0.0 r12 110933 Description: A problem was discovered in Victure RX1800 WiFi 6 Router devices where the TELNET service is enabled by default with admin/admin as default credentials and is exposed over...

PT-2024-35860 · Unknown · Maeve Lander Paypal Responder

Name of the Vulnerable Software and Affected Versions: Maeve Lander PayPal Responder versions n/a through 1.2 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web...

PT-2024-36956

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.12.0-rc6-00077-g2e1b3cc9d7f7 Description A vulnerability in the Linux kernel has been resolved, which could trigger an ip rt bug when an arp link failure occurs while xfrm is enabled. The issue arises from the...

CVE-2024-53848

check-jsonschema is a CLI and set of pre-commit hooks for jsonschema validation. The default cache strategy uses the basename of a remote schema as the name of the file in the cache, e.g. https://example.org/schema.json will be stored as schema.json. This naming allows for conflicts. If an attack...

CVE-2024-53848 check-jsonschema default caching for remote schemas allows for cache confusion

check-jsonschema is a CLI and set of pre-commit hooks for jsonschema validation. The default cache strategy uses the basename of a remote schema as the name of the file in the cache, e.g. https://example.org/schema.json will be stored as schema.json. This naming allows for conflicts. If an attack...