GHSA-R275-J57C-7MF2 Race condition in Endorsements

Impact A race condition in the endorsement of resources for instance, a proposal allows a user to make more than once endorsement. To exploit this vulnerability, the request to set an endorsement must be sent several times in parallel. Workarounds Disable the Endorsement feature in the components...

Race Condition

Overview Affected versions of this package are vulnerable to Race Condition in the endorsement of resources, such as a proposal, which allows a user to make more than one endorsement by sending the request to set an endorsement several times in parallel. Workaround This vulnerability can be...

Race condition in Endorsements

Impact A race condition in the endorsement of resources for instance, a proposal allows a user to make more than once endorsement. To exploit this vulnerability, the request to set an endorsement must be sent several times in parallel. Workarounds Disable the Endorsement feature in the components...

SUSE CVE-2024-23807

The Apache Xerces C++ XML parser on versions 3.0.0 before 3.2.5 contains a use-after-free error triggered during the scanning of external DTDs. Users are recommended to upgrade to version 3.2.5 which fixes the issue, or mitigate the issue by disabling DTD processing. This can be accomplished via...

PT-2024-19579 · Timo · Timo

Name of the Vulnerable Software and Affected Versions: Timo version 2.0.3 Description: The issue allows a remote attacker to execute arbitrary code via the filetype restrictions in the UploadController.java component. Recommendations: For Timo version 2.0.3, consider disabling the...

PT-2024-15628 · WordPress · The Royal Elementor Addons/Templates

Name of the Vulnerable Software and Affected Versions: The Royal Elementor Addons and Templates plugin for WordPress versions up to, and including, 1.3.87 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the add to wishlist function...

PT-2024-17953 · WordPress · Imagerecycle

Name of the Vulnerable Software and Affected Versions: ImageRecycle pdf & image compression plugin for WordPress versions up to, and including, 3.1.13 Description: The issue is due to missing or incorrect nonce validation on the disableOptimization function, making it possible for unauthenticated...

PT-2024-2141 · Zeek · Icsnpp - Ethercat Zeek Plugin

Name of the Vulnerable Software and Affected Versions: Industrial Control Systems Network Protocol Parsers ICSNPP - Ethercat Zeek Plugin versions d78dda6 and prior Description: The issue is related to an out-of-bounds write in the primary analyses function for Ethercat communication packets. This...

PT-2024-16285 · WordPress · Customer Reviews For Woocommerce

Name of the Vulnerable Software and Affected Versions: Customer Reviews for WooCommerce plugin for WordPress versions up to, and including, 5.38.12 Description: The issue allows unauthorized modification of data due to a missing capability check on the submit review function. This enables...

PT-2024-19062 · Biosig +1 · Libbiosig +1

Name of the Vulnerable Software and Affected Versions: The Biosig Project libbiosig versions 2.5.0 through Master Branch ab0ee111 Description: A heap-based buffer overflow vulnerability exists in the .egi parsing functionality. A specially crafted .egi file can lead to arbitrary code execution. A...

PT-2024-21248 · Openolat · Openolat

Name of the Vulnerable Software and Affected Versions: OpenOlat versions 18.1.5 and lower Description: The issue is a stored Cross-Site Scripting XSS vulnerability. It allows authenticated users to upload files within the Media Center without additional rights. Although file types are limited, an...

Race condition in Endorsements

Impact A race condition in the endorsement of resources for instance, a proposal allows a user to make more than once endorsement. To exploit this vulnerability, the request to set an endorsement must be sent several times in parallel. Workarounds Disable the Endorsement feature in the components...

PT-2024-13669 · Projeqtor · Projeqtor

Name of the Vulnerable Software and Affected Versions: ProjeQtOr version 11.0.2 Description: A Cross Site Scripting XSS issue allows a remote attacker to execute arbitrary code via a crafted script to the checkvalidHtmlText function in the ack.php and security.php files. This enables the attacker...

PT-2024-2170 · Libbiosig +1 · Libbiosig +1

Name of the Vulnerable Software and Affected Versions: libbiosig versions 2.5.0 through Master Branch ab0ee111 Description: A use-after-free vulnerability exists in the sopen FAMOS read functionality. This issue can be triggered by a specially crafted .famos file, potentially leading to arbitrary...

PT-2024-13464 · Decidim · Decidim

Name of the Vulnerable Software and Affected Versions: Decidim versions 0.10.0 through 0.26.8 Decidim versions 0.27.0 through 0.27.4 Decidim versions 0.28.0 is not affected, but versions prior to 0.28.0 are affected, so the correct range is: Decidim versions 0.10.0 through 0.27.4 and version 0.28...

PT-2024-20903 · Unknown · Libiec61850

Name of the Vulnerable Software and Affected Versions: libiec61850 versions 1.4.0 Description: The issue allows a remote attacker to cause a denial of service via the mmsServer handleGetNameListRequest function to the mms getnamelist service component. Recommendations: For version 1.4.0, consider...

PT-2024-13238 · Unknown · Weston Embedded Uc-Http

Name of the Vulnerable Software and Affected Versions: Weston Embedded uC-HTTP version 80d4004 Description: A heap-based buffer overflow vulnerability exists in the HTTP Server functionality. A specially crafted network packet can lead to arbitrary code execution. An attacker can send a malicious...

PT-2024-18096 · WordPress · Wp Database Reset

Name of the Vulnerable Software and Affected Versions: Database Reset plugin for WordPress versions up to, and including, 3.22 Description: The issue is due to missing or incorrect nonce validation on the install wpr function, making it possible for unauthenticated attackers to install the WP Res...

PT-2024-18181 · Bl2 · Bl2

Name of the Vulnerable Software and Affected Versions: Bootloader versions c2f286820471ed276c57e603762bd831873e5a17 and later Description: The issue occurs during the secure boot process, where the second stage of the bootloader, bl2, loops over images defined in the table "bl2 mem params descs"...

GHSA-CW9J-Q3VF-HRRV Scrapy authorization header leakage on cross-domain redirect

Impact When you send a request with the Authorization header to one domain, and the response asks to redirect to a different domain, Scrapy’s built-in redirect middleware creates a follow-up redirect request that keeps the original Authorization header, leaking its content to that second domain...