ABB Cylon Aspect 3.08.02 (licenseUpload.php) Stored Cross-Site Scripting

Summary ASPECT is an award-winning scalable building energy management and control solution designed to allow users seamless access to their building data through standard building protocols including smart devices. Description The ABB Cylon Aspect BMS/BAS controller suffers from an authenticated...

ABB Cylon Aspect 3.08.03 (MapServicesHandler) Authenticated Reflected XSS

Summary ASPECT is an award-winning scalable building energy management and control solution designed to allow users seamless access to their building data through standard building protocols including smart devices. Description The ABB BMS/BAS controller suffers from an authenticated reflected...

SUSE: Security Advisory (SUSE-SU-2024:4423-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

GHSA-M56H-5XX3-2JC2 Prototype pollution in jsii.configureCategories

Summary jsii is a TypeScript to JavaScript compiler that also extracts an interface definition manifest to generate RPC stubs in various programming languages. jsii is typically used as a command-line tool, but it can also be loaded as a library. When loaded as a library into a larger application...

ai.tripl:arc-jupyter_2.11 (>=0.0.13 <=0.0.14), ai.tripl:arc-kafka-pipeline-plugin_2.11 (>=1.0.0 <=1.4.0) +569 more potentially affected by CVE-2024-56128 via org.apache.kafka:kafka_2.11 (>=0.10.2.0 <=2.4.1)

org.apache.kafka:kafka2.11 MAVEN version =0.10.2.0, =0.0.13, =1.0.0, =1.14.0, =1.0.0, =5.1.0, =1.1.0, =1.0.0, =1.1.0, =1.0.0, =1.0.0, =blink-3.2.0, =blink-3.2.0, =1.1.1, =1.1.4 - com.alibaba.otter:canal.kafka =1.1.0 and more Source cves: CVE-2024-56128 Source advisory: OSV:GHSA-P7C9-8XX8-H74F...

CVE-2024-12570

An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.7 prior to 17.4.6, from 17.5 prior to 17.5.4, and from 17.6 prior to 17.6.2. It may have been possible for an attacker with a victim's CIJOBTOKEN to obtain a GitLab session token belonging to the victim...

cauuu (>=0.1.0 <=0.1.1), cosmwasm-check (>=1.1.0 <=1.3.4) +16 more potentially affected by unknown CVE via cosmwasm-vm (>=0.10.1 <=1.3.4)

cosmwasm-vm CARGO version =0.10.1, =0.1.0, =1.1.0, =0.13.2, =0.4.0, =0.4.0, =0.2.0, =0.4.0, =0.2.0, =0.2.1, =0.1.12, =0.1.13 - terra-math =0.0.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-2Q97-M5RC-P3GP...

CVE-2024-12254

Starting in Python 3.12.0, the asyncio.SelectorSocketTransport.writelines method would not "pause" writing and signal to the Protocol to drain the buffer to the wire once the write buffer reached the "high-water mark". Because of this, Protocols would not periodically drain the write buffer...

de.arbeitsagentur.opdt:keycloak-cassandra-model-tests (>=3.0.1-25.0 <=4.0.5-25.0), org.keycloak:keycloak-guides (>=25.0.0 <=26.0.5) +6 more potentially affected by CVE-2024-9666 via org.keycloak:keycloak-quarkus-server (>=25.0.0 <=26.0.5)

org.keycloak:keycloak-quarkus-server MAVEN version =25.0.0, =3.0.1-25.0, =25.0.0, =25.0.0, =25.0.0, =26.0.0, =25.0.0, =25.0.0, =26.0.0, =26.0.5 Source cves: CVE-2024-9666 Source advisory: OSV:GHSA-JGWC-JH89-RPGQ...

3m (=0.1.0), aaa-ml-datasets-course (=1.0.0) +1525 more potentially affected by CVE-2024-11392 via transformers (>=2.10.0 <=4.47.1)

transformers PYPI version =2.10.0, =0.1.1, =0.1.0, =0.0.3, =0.0.1, =0.0.0.dev20230804, =0.1.0, =0.3.0, =0.1.0, =0.2.5, =0.0.1, =0.1.0, =0.1.1 and more Source cves: CVE-2024-11392 Source advisory: OSV:GHSA-QXRP-VHVM-J765...

CVE-2024-53074 wifi: iwlwifi: mvm: don't leak a link on AP removal

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: don't leak a link on AP removal Release the link mapping resource in AP removal. This impacted devices that do not support the MLD API 9260 and down. On those devices, we couldn't start the AP again after the ...

com.elega9t:fitnesse-params (=0.0.1), com.github.andreptb:fitnesse-maven-runner-plugin (>=0.2.0 <=0.2.1) +69 more potentially affected by CVE-2024-39610 via org.fitnesse:fitnesse (>=20050731 <=20240707)

org.fitnesse:fitnesse MAVEN version =20050731, =0.2.0, =0.1.0, =BETA-V1.00, =1.0.6, =1.0.0, =1.0.0, =1.2.1, =1.0.1, =1.1.0, =1.0.0, =1.0.0, =1.6.0, =1.6.5 and more Source cves: CVE-2024-39610 Source advisory: OSV:GHSA-PG82-9W35-3W3R...

bounded-prescience (=0.0.3), chainer-chemistry (=0.7.1) +21 more potentially affected by CVE-2024-48206 via chainer (>=6.0.0 <=7.8.1)

chainer PYPI version =6.0.0, =0.1.0, =0.2.0, =0.3.0, =0.0.1, =0.1.0, =0.6.1, =0.2.0, =0.6.0.post1, =1.3.1, =2024.0.0, =2024.0.1 and more Source cves: CVE-2024-48206 Source advisory: SNYK:PYTHON-CHAINER-8340635...

aldryn-django (=4.2.10.0), am-report (=0.1.5) +84 more potentially affected by CVE-2024-45230 via django (>=4.2.0 <=4.2.15)

django PYPI version =4.2.0, =7.5.1, =1.0.2, =0.0.1, =0.4.0, =4.16.2, =4.8.0, =5.2.0, =0.5.1, =0.12.2, =0.12.3 - directory-api-client =26.3.0 and more Source cves: CVE-2024-45230 Source advisory: OSV:GHSA-5HGC-2VFP-MQVC...

CVE-2024-8926

In PHP versions 8.1. before 8.1.30, 8.2. before 8.2.24, 8.3. before 8.3.12, when using a certain non-standard configurations of Windows codepages, the fixes for CVE-2024-4577 https://github.com/advisories/GHSA-vxpp-6299-mxw3 may still be bypassed and the same command injection related to Windows...

@christianhugo/mobile-builder (>=0.7.3-beta.3 <=0.7.4-beta.9), @christianhugoch/cli (>=0.7.2-beta.12 <=0.7.2-beta.13) +4 more potentially affected by unknown CVE via @saltcorn/server (>=0.0.2 <=1.0.0-beta.15)

@saltcorn/server NPM version =0.0.2, =0.7.3-beta.3, =0.7.2-beta.12, =0.0.2, =0.7.2, =0.0.2, =0.2.3-beta.2 Source cves: unknown CVE Source advisory: OSV:GHSA-PF56-H9QF-RXQ4...

HPESBNS04707 rev.1 - HPE NonStop BackBox and QORESTOR products, multiple vulnerabilities

Potential Security Impact: Local: Denial of Service DoS SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE NonStop QRSTR software T1137 - T1137V01, T1137V01^AAA to AAD HPE BackBox Software T0954 - T0954V04, T0954V04^AAA to AAW, T0954V04^AAA to AAV - T0954V04^AAA to AAW Impacted...

@coder/code-server-pr (>=0.0.0-5720-b0b6a997d711d1596cd75597cb51aefe64be150e <=4.8.3-5762-deebf96f942f25d874570d654b2baa91e77c5967), @daiyu-5577/quickbuild (>=1.2.1 <=2.6.8) +33 more potentially affected by CVE-2024-43796 via express (>=5.0.0-alpha.2 <=5.0.0-beta.3)

express NPM version =5.0.0-alpha.2, =0.0.0-5720-b0b6a997d711d1596cd75597cb51aefe64be150e, =1.2.1, =3.0.0, =3.0.0, =3.0.3, =4.2.0, =0.2.0, =0.0.1, =0.1.0, =0.55.1, =2.0.0-2, =2.0.0-1, =0.5.9, =0.0.13-12a6a820047e3132ee61831695cef6c364501b06, =4.0.2-4925-8b6a45f5d4ee7831398049b4716df775a3f16f2e,...

aglow (>=0.1.0rc3 <=0.1.0rc4), ai-flow (>=0.1.0 <=0.3.1) +8 more potentially affected by CVE-2024-45034 via apache-airflow (>=1.8.2 <=2.0.2)

apache-airflow PYPI version =1.8.2, =0.1.0rc3, =0.1.0, =2.4.2, =1.7.2, =0.3.12, =11.8.0, =0.0.5, =0.0.6 Source cves: CVE-2024-45034 Source advisory: OSV:GHSA-92XG-GMRQ-5C3W...

5sg (>=0.0.2 <=0.0.8), @1stg/app-config (>=4.0.0 <=7.3.0) +2067 more potentially affected by CVE-2024-45047 via svelte (>=0.0.1 <=4.2.18)

svelte NPM version =0.0.1, =0.0.2, =4.0.0, =4.0.0, =6.0.0, =2.2.0, =1.0.0, =0.0.1, =0.0.1, =0.0.1, =10.9.0, =0.0.1, =0.1.0, =1.0.0, =1.0.0, =2.0.0 - @albertaz/r2s-cli =1.0.1-alpha.0 and more Source cves: CVE-2024-45047 Source advisory: OSV:GHSA-8266-84WP-WV5C...