CVE-2024-47544 GHSL-2024-238: GStreamer has NULL-pointer dereferences in MP4/MOV demuxer CENC handling

GStreamer is a library for constructing graphs of media-handling components. The function qtdemuxparsesbgp in qtdemux.c is affected by a null dereference vulnerability. This vulnerability is fixed in 1.24.10...

CVE-2024-47542

GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference has been discovered in the id3v2readsynchuint function, located in id3v2.c. If id3v2readsynchuint is called with a null work-hdr.framedata, the pointer guint8 data is accessed without validatio...

CVE-2024-47538 GHSL-2024-115: GStreamer has a stack-buffer overflow in vorbis_handle_identification_packet

GStreamer is a library for constructing graphs of media-handling components. A stack-buffer overflow has been detected in the vorbishandleidentificationpacket function within gstvorbisdec.c. The position array is a stack-allocated buffer of size 64. If vd-vi.channels exceeds 64, the for loop will...

PT-2024-9492 · Microsoft · Windows Remote Desktop Services +1

Name of the Vulnerable Software and Affected Versions: Windows Remote Desktop Services affected versions not specified Description: The issue is related to a remote code execution problem in Windows Remote Desktop Services. It involves the use of memory after it has been freed, which can be...

PT-2024-9454 · Microsoft · Windows Mobile Broadband Driver +1

Name of the Vulnerable Software and Affected Versions: Windows Mobile Broadband Driver affected versions not specified Description: The issue is related to a buffer overflow in memory, which can be exploited to elevate privileges. This could allow an attacker to affect the system. There is no...

PT-2024-9441 · Microsoft · Windows Printworkflowusersvc +1

Name of the Vulnerable Software and Affected Versions: Windows PrintWorkflowUserSvc affected versions not specified Description: The issue is related to the use of memory after it has been freed in the Windows PrintWorkflowUserSvc service, which can allow an attacker to elevate their privileges...

PT-2024-9347 · Microsoft · Windows Routing/Remote Access Service +1

Name of the Vulnerable Software and Affected Versions: Windows Routing and Remote Access Service RRAS affected versions not specified Description: The issue is related to a remote code execution vulnerability in the Windows Routing and Remote Access Service RRAS. It is caused by a buffer overflow...

PT-2024-9529 · Unknown +1 · Wmsrepair Service +1

Name of the Vulnerable Software and Affected Versions: WmsRepair Service affected versions not specified Description: The issue is related to insufficient access restrictions in the WmsRepair Service, which can be exploited to elevate privileges. This allows an attacker to affect the system...

PT-2024-36975

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.74 Description The issue is related to an invalid access to prog array in perf event detach bpf prog. A crash occurs when a tracepoint perf event with attr.inherit=1 is created, attached to a process, and a b...

CVE-2024-10909

The The Pojo Forms plugin for WordPress is vulnerable to arbitrary shortcode execution via formpreviewshortcode AJAX action in all versions up to, and including, 1.4.7. This is due to the software allowing users to execute an action that does not properly validate a value before running...

SUSE CVE-2024-53259

quic-go is an implementation of the QUIC protocol in Go. An off-path attacker can inject an ICMP Packet Too Large packet. Since affected quic-go versions used IPPMTUDISCDO, the kernel would then return a "message too large" error on sendmsg, i.e. when quic-go attempts to send a packet that exceed...

PT-2025-44686

Name of the Vulnerable Software and Affected Versions Chromium affected versions not specified Description An issue exists in Chromium related to an inappropriate implementation in App-Bound Encryption. This could allow attackers to affect the system. Microsoft Edge Chromium-based is also impacte...

PT-2025-9934

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A issue in the Linux kernel has been resolved, related to the handling of received connection aborts in the rxrpc module. The problem occurs when a connection abort is received but not...

DEBIAN-CVE-2024-53863

Synapse is an open-source Matrix homeserver. In Synapse versions before 1.120.1, enabling the dynamicthumbnails option or processing a specially crafted request could trigger the decoding and thumbnail generation of uncommon image formats, potentially invoking external tools like Ghostscript for...

PT-2024-31482 · Veeam · Veeam Backup & Replication

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: A vulnerability exists where a low-privileged user can exploit insufficient permissions in credential handling to leak NTLM hashes of saved credentials...

PT-2024-34900 · Aruba · Clearpass Policy Manager

Name of the Vulnerable Software and Affected Versions: ClearPass Policy Manager affected versions not specified Description: An authenticated remote code execution issue in the ClearPass Policy Manager web-based management interface allows remote authenticated users to run arbitrary commands on t...

PT-2024-41065 · Git +1 · Shaderc

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: A crash occurs due to a container-overflow READ 8 issue. The crash involves the glslang::HlslParseContext::decomposeIntrinsic and glslang::HlslParseContext::handleFunctionCall functions, as...

PT-2024-8877 · Microsoft · Azure Policywatch

Name of the Vulnerable Software and Affected Versions: Microsoft Azure PolicyWatch affected versions not specified Description: The issue is related to a lack of authentication for a critical function in Microsoft Azure PolicyWatch, allowing an unauthorized attacker to elevate privileges over a...

PT-2024-32497 · Axis · Axis

Name of the Vulnerable Software and Affected Versions: Axis devices affected versions not specified Description: The issue is related to the handling of certain ethernet frames, which could lead to the Axis device becoming unavailable in the network. It is estimated that selected Axis devices are...

PT-2024-23174 · Sharp +1 · Multiple Mfps

Name of the Vulnerable Software and Affected Versions: Product name affected versions not specified Description: The issue involves user passwords being decrypted and stored in memory before any user logs in. These decrypted passwords can be retrieved from the coredump file. Recommendations: At t...