CVE-2024-23188

CVE-2024-23188 affects Open-Xchange App Suite; multiple connected sources describe a vulnerability where maliciously crafted E‑mail attachment names can temporarily execute script code in a user’s browser session, with common user interaction required. The Open-Xchange-related entries indicate af...

CVE-2024-23186

E-Mail containing malicious display-name information could trigger client-side script execution when using specific mobile devices. Attackers could perform malicious API requests or extract information from the users account. Please deploy the provided updates and patch releases. We now use safer...

PT-2024-19702 · Open Xchange Gmbh +1 · Ox App Suite

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: E-Mail containing malicious display-name information could trigger client-side script execution when using specific mobile devices. Attackers could...

Fedora 39 : ruby (2024-31cac8b8ec)

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-31cac8b8ec advisory. Upgrade to Ruby 3.2.4. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...

CVE-2023-6214

CVE-2023-6214 (HT Mega – Absolute Addons For Elementor) affects the WordPress plugin HT Mega up to version 2.4.6. The root issue is a data exposure in the purchased_products function, allowing unauthenticated access to the previous 7 days of order data and customer PII. The vulnerability is categ...

CVE-2024-3717 Drag and Drop Multiple File Upload – Contact Form 7 <= 1.3.7.7 - Sensitive Information Exposure

The Drag and Drop Multiple File Upload – Contact Form 7 plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.7.7 via the '/wp-content/uploads/wpdndcf7uploads/wpcf7-files' directory. This makes it possible for unauthenticated attackers to...

CVE-2024-28893

Certain HP software packages SoftPaqs are potentially vulnerable to arbitrary code execution when the SoftPaq configuration file has been modified after extraction. HP has released updated software packages SoftPaqs...

CVE-2024-28893

CVE-2024-28893 affects HP SoftPaqs. The issue enables potential arbitrary code execution when a SoftPaq configuration file is modified after extraction, as described by HP’s advisory. The underlying impact is high with local attack vector, requiring user interaction and elevated privileges, and c...

squashfs-tools: possible Directory Traversal via symbolic link

A directory traversal flaw was found in squashfs-tools. During extraction, a file can escape the destination directory by using a symbolic link, and a regular file with an identical name. This flaw allows a specially crafted squashfs archive to install or overwrite files outside of the destinatio...

CVE-2024-22405

XADMaster is an objective-C library for archive and file unarchiving and extraction. When extracting a specially crafted zip archive XADMaster may not apply quarantine attribute correctly. Such behaviour may circumvent Gatekeeper checks on the system. Only macOS installations are affected. This...

CVE-2024-22405

CVE-2024-22405 relates to the macOS-focused library XADMaster. The issue occurs during extraction of specially crafted ZIP archives, where the library may fail to apply the quarantine attribute correctly, potentially bypassing Gatekeeper checks. Affected: XADMaster versions prior to 1.10.8 on mac...

CVE-2024-22405 XADMaster may not apply quarantine attribute correctly to extracted files

XADMaster is an objective-C library for archive and file unarchiving and extraction. When extracting a specially crafted zip archive XADMaster may not apply quarantine attribute correctly. Such behaviour may circumvent Gatekeeper checks on the system. Only macOS installations are affected. This...

CVE-2024-1789

CVE-2024-1789 : The WP SMTP plugin for WordPress is affected by an SQL Injection via the 'search' parameter in versions 1.2–1.2.6, caused by insufficient escaping and lack of prepared statements. Exploitation requires authenticated admin-level access or higher, enabling an attacker to append addi...

Ubuntu 20.04 LTS / 22.04 LTS / 23.10 : FreeRDP vulnerabilities (USN-6749-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6749-1 advisory. It was discovered that FreeRDP incorrectly handled certain context resets. If a user were tricked into connecting to a malicious...

GHSA-MQ35-X99R-54FC github.com/u-root/u-root/pkg/cpio Arbitrary File Write via Archive Extraction (Zip Slip)

This affects all versions of package github.com/u-root/u-root/pkg/cpio up to and including 7.0.0. It is vulnerable to leading, non-leading relative path traversal attacks and symlink based relative and absolute path traversal attacks in cpio file extraction...

CVE-2023-31090 WordPress Unlimited Elements For Elementor plugin <= 1.5.60 - Unrestricted Zip Extraction vulnerability

Unrestricted Upload of File with Dangerous Type vulnerability in Unlimited Elements Unlimited Elements For Elementor Free Widgets, Addons, Templates allows Upload a Web Shell to a Web Server.This issue affects Unlimited Elements For Elementor Free Widgets, Addons, Templates: from n/a through 1.5....

Exploit for Improper Input Validation in Paloaltonetworks Pan-Os

CVE-2024-3400-pot Simple honeypot for CVE-2024-3400 Palo Alto...

IBM Aspera Faspex Log Message Disclosure Vulnerability

IBM Aspera is a set of fast file transfer and streaming solutions built on the IBM FASP protocol from International Business Machines IBM. A log information disclosure vulnerability exists in IBM Aspera Faspex, which can be exploited by an attacker to obtain sensitive information...

Important: Red Hat Security Advisory: Satellite 6.15.0 release

An update is now available for Red Hat Satellite 6.15. The release contains a new version of Satellite and important security fixes for various components. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base scor...

Hub: insecure galaxy-importer tarfile extraction

A path traversal vulnerability exists in Ansible when extracting tarballs. An attacker could craft a malicious tarball so that when using the galaxy importer of Ansible Automation Hub, a symlink could be dropped on the disk, resulting in files being overwritten...