PT-2024-28588

Name of the Vulnerable Software and Affected Versions WooCommerce PDF Vouchers versions 4.9.4 and earlier Description The issue is related to a Missing Authorization vulnerability, which allows accessing functionality not properly constrained by ACLs. This enables attackers to bypass capability...

PT-2024-28216 · Unknown · Arconix Faq

Name of the Vulnerable Software and Affected Versions: Arconix FAQ versions 1.9.4 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows accessing functionality not properly constrained by ACLs. Recommendations: For Arconix FAQ versions 1.9.4 and...

Ollama server is vulnerable to OOM DoS attacks when using `makeRequestWithRetry` and `getAuthorizationToken` functions

This report is not public...

Important: python3.11-setuptools

Issue Overview: A vulnerability in the packageindex module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptibl...

Security update for go1.21-openssl

This update for go1.21-openssl fixes the following issues: CVE-2024-34158: Fixed stack exhaustion in Parse in go/build/constraint bsc1230254. CVE-2024-34156: Fixed stack exhaustion in Decoder.Decode in encoding/gob bsc1230253. CVE-2024-34155: Fixed stack exhaustion in all Parse functions...

MariaDB UDF Code Execution

The vulnerability of the UDF functions in the MariaDB database management system is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

PT-2024-40264 · Gnark · Gnark

Name of the Vulnerable Software and Affected Versions: Gnark versions prior to 1.2.0 Description: The issue concerns the Gnark recursion circuit, which has constraints on arithmetic over BabyBear when the native field of the ZKP circuit is the BN254 scalar field. The problem arises from improper...

CVE-2024-10434

A vulnerability was found in Tenda AC1206 up to 20241027. It has been classified as critical. This affects the function ateTendamfgcheckusb/ateTendamfgcheckusb3 of the file /goform/ate. The manipulation of the argument arg leads to stack-based buffer overflow. It is possible to initiate the attac...

DrayTek Vigor 2960 安全漏洞

The DrayTek Vigor 2960 is a dual WAN broadband router/VPN gateway from China DrayTek. A security vulnerability exists in the DrayTek Vigor 2960 version 1.4.4, which stems from an authorized remote code execution vulnerability that results in malicious commands that can be executed by system...

CVE-2024-9584 Image Map Pro <= 6.0.20 - Missing Authorization to Authenticated (Contributor+) Map Project Add/Update/Delete

The Image Map Pro plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the AJAX functions in versions up to, and including, 6.0.20. This makes it possible for authenticated attackers with contributor-level privileges or abov...

CVE-2024-9584: Missing Authorization

The Image Map Pro plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the AJAX functions in versions up to, and including, 6.0.20. This makes it possible for authenticated attackers with contributor-level privileges or abov...

SIMATIC Reader Software

The vulnerability of the SIMATIC Reader software for editing and managing projects and documents is related to the presence of undocumented configuration commands. Exploiting this vulnerability can allow attackers to activate additional functions of the device by modifying the configuration files...

go/parser: golang: Calling any of the Parse functions containing deeply nested literals can cause a panic/stack exhaustion

A flaw was found in the go/parser package of the Golang standard library. Calling any Parse functions on Go source code containing deeply nested literals can cause a panic due to stack exhaustion...

ZZCMS 代码问题漏洞

ZZCMS is a content management system CMS by the ZZCMS team in China. A code issue vulnerability exists in ZZCMS version 2023, which stems from the parameter file in file 3/Ebbak5.1/upload/class/functions.php that can lead to unrestricted uploads...

Imagine Cup Platform Code Execution

The vulnerability of the Imagine Cup platform’s Microsoft Azure Functions component is related to lack of access control. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...

CLSA-2024-1729627193 Fix CVE(s): CVE-2023-27043

SECURITY UPDATE: Incorrect parsing of email addresses containing special characters - debian/patches/CVE-2023-27043.patch: Fix email address parsing errors by adding optional 'strict' parameter to getaddresses and parseaddr functions - CVE-2023-27043...

Important: Red Hat Security Advisory: Red Hat build of Cryostat security update

An update is now available for the Red Hat build of Cryostat 3 on RHEL 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fro...

CVE-2024-49992

In the Linux kernel, the following vulnerability has been resolved: drm/stm: Avoid use-after-free issues with crtc and plane ltdcload calls functions drmcrtcinitwithplanes, drmuniversalplaneinit and drmencoderinit. These functions should not be called with parameters allocated with devmkzalloc to...

WordPress Rover IDX plugin <= 3.0.0.2903 - Authenticated (Subscriber+) Missing Authorization via Multiple Functions vulnerability

Authenticated Subscriber+ Missing Authorization via Multiple Functions vulnerability discovered by István Márton in WordPress Plugin Rover IDX versions = 3.0.0.2903...

DEBIAN-CVE-2024-49982

In the Linux kernel, the following vulnerability has been resolved: aoe: fix the potential use-after-free problem in more places For fixing CVE-2023-6270, f98364e92662 "aoe: fix the potential use-after-free problem in aoecmdcfgpkts" makes tx calling devput instead of doing in aoecmdcfgpkts. It...