PT-2024-37348

Name of the Vulnerable Software and Affected Versions: Auto Featured Image plugin for WordPress versions up to, and including, 1.2 Description: The issue arises from missing file type validation in the create post attachment from url function, allowing authenticated attackers with contributor-lev...

Astra Linux – Vulnerability in Composer

Composer is a dependency manager for PHP. On the 2.x branch, prior to versions 2.2.24 and 2.7.7, the status, reinstall, and remove commands, when packages were installed from sources via Git, could allow execution of malicious code if the branch name contained specially crafted text in the...

Multiple WordPress Plugins Compromised: Hackers Create Rogue Admin Accounts

Multiple WordPress plugins have been backdoored to inject malicious code that makes it possible to create rogue administrator accounts with the aim of performing arbitrary actions. "The injected malware attempts to create a new administrative user account and then sends those details back to the...

SUSE CVE-2024-38637

In the Linux kernel, the following vulnerability has been resolved: greybus: lights: check return of getchannelfrommode If channel for the given node is not found we return null from getchannelfrommode. Make sure we validate the return pointer before using it in two of the missing places. This wa...

UBUNTU-CVE-2024-38637

In the Linux kernel, the following vulnerability has been resolved: greybus: lights: check return of getchannelfrommode If channel for the given node is not found we return null from getchannelfrommode. Make sure we validate the return pointer before using it in two of the missing places. This wa...

CVE-2024-38637 greybus: lights: check return of get_channel_from_mode

In the Linux kernel, the following vulnerability has been resolved: greybus: lights: check return of getchannelfrommode If channel for the given node is not found we return null from getchannelfrommode. Make sure we validate the return pointer before using it in two of the missing places. This wa...

PT-2024-4395 · Tenda · Tenda A301

Name of the Vulnerable Software and Affected Versions: Tenda A301 version 15.13.08.12 Description: A critical issue has been identified, classified as critical, affecting the function fromSetWirelessRepeat of the file /goform/WifiExtraSet. The manipulation of the argument wpapsk crypto leads to a...

PT-2024-40793

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a crash type of "Use-of-uninitialized-value". The crash state involves several functions: icalmemory strdup, icalparameter new from...

CVE-2024-34815: Missing Authorization

Missing Authorization vulnerability in Javier Carazo Import and export users and customers import-users-from-csv-with-meta.This issue affects Import and export users and customers: from n/a through = 1.26.5...

PT-2024-24043

Name of the Vulnerable Software and Affected Versions Cybozu Garoon versions 5.0.0 through 5.15.2 Description The issue is related to improper handling of extra values. If exploited, a user with administrative privilege who can log in to the product may be able to cause a denial-of-service DoS...

CVE-2024-35749: Authentication Bypass by Spoofing

Authentication Bypass by Spoofing vulnerability in Acurax Under Construction / Maintenance Mode from Acurax allows Authentication Bypass.This issue affects Under Construction / Maintenance Mode from Acurax: from n/a through 2.6...

PT-2024-9644

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.10.0-rc1-syzkaller-00013-g2bfcfd584ff5 Description The vulnerability is related to a possible race in the fib6 drop pcpu from function, which can cause a null pointer dereference. This issue can lead to a gener...

UBUNTU-CVE-2024-24789

The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment could be exploited to create an zip file with contents that vary depending on the implementation reading the file. The archive/zip package now rejects...

SUSE CVE-2019-9193

In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pgexecuteserverprogram' group to execute arbitrary code in the context of the database's operating system user. This functionality is enabled by default and can be abused to run arbitrary...

Command Injection

swiftmailer/swiftmailer is vulnerable to Command Injection. The vulnerability is due to improper handling of the "From" header when it comes from a non-trusted source and when no "Return-Path" is configured, which allows an attacker to execute arbitrary shell commands...

PT-2024-40065 · Typo3 +1 · Typo3 +1

Name of the Vulnerable Software and Affected Versions: TYPO3 affected versions not specified Description: The issue allows execution of arbitrary shell commands if the "From" header comes from a non-trusted source and no "Return-Path" is configured. This is specifically related to the swiftmailer...

Important: git

Issue Overview: Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, repositories with submodules can be crafted in a way that exploits a bug in Git whereby it can be fooled into writing files not into the submodule's worktree but into a...

PT-2024-40077 · Unknown · Swiftmailer

Name of the Vulnerable Software and Affected Versions: SwiftMailer versions prior to 5.2.1 Description: The issue allows for arbitrary shell execution if the From header comes from a non-trusted source and no Return-Path is configured. This can be exploited when using the sendmail transport,...

JetBrains TeamCity < 2023.11 Multiple Vulnerabilities

The version of JetBrains TeamCity installed on the remote host is prior to 2023.11. It is, therefore, affected by multiple vulnerabilities: - In JetBrains TeamCity before 2023.11 users with access to the agent machine might obtain permissions of the user running the agent process CVE-2024-29880 -...

PT-2024-36020 · Winnmp · Winnmp

Name of the Vulnerable Software and Affected Versions: WinNMP version 19.02 Description: A vulnerability has been discovered that allows for an XSS attack via the index page, specifically in the from, subject, text, and hash parameters. This could enable a remote user to send a specially crafted...