The vulnerability of the RES software service for controlling user access to applications and data in Ivanti Workspace Control allows a intruder to increase their privileges.

The vulnerability of the RES software service for controlling user access to applications and data in Ivanti Workspace Control is related to the use of dangerous methods or functions. Exploiting this vulnerability can allow attackers to enhance their privileges...

CVE-2024-47762 Unexpected visibility of environment variable configurations in @backstage/plugin-app-backend

Backstage is an open framework for building developer portals. Configuration supplied through APPCONFIG environment variables, for example APPCONFIGbackendlistenport=7007, where unexpectedly ignoring the visibility defined in configuration schema. This occurred even if the configuration schema...

Medium: amazon-ssm-agent

Issue Overview: An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed...

CVE-2024-41290

FlatPress CMS versions 1.3.1 (

PT-2024-29349 · Unknown · Flatpress Cms

Name of the Vulnerable Software and Affected Versions: FlatPress CMS versions 1.3.1 through 1.3 Description: The issue concerns the use of insecure methods to store authentication data via the cookie's component. This could potentially lead to unauthorized access. No information is provided about...

PT-2024-40589 · Oracle · Java.Base

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: A security exception crash was reported, involving methods in java.base, specifically java.util.Arrays.copyOfRange, java.lang.StringUTF16.newString, and...

Driver Disk for Intel i40e 2.25.11 - For Citrix Hypervisor 8.2 Cumulative Update 1 LTSR

Who should install this driver disk? Customers running the Citrix Hypervisor 8.2 Cumulative Update 1 LTSR release who use Intel's i40e driver and wish to use the latest version of the following: Driver Module| Driver Type| Version ---|---|--- i40e| Ethernet/NIC| 2.25.11 Issues resolved in this...

Mass-Assigner - Simple Tool Made To Probe For Mass Assignment Vulnerability Through JSON Field Modification In HTTP Requests

Mass Assigner is a powerful tool designed to identify and exploit mass assignment vulnerabilities in web applications. It achieves this by first retrieving data from a specified request, such as fetching user profile data. Then, it systematically attempts to apply each parameter extracted from th...

golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses

A flaw was found in the Go language standard library net/netip. The method Is IsPrivate, IsPublic, etc doesn't behave properly when working with IPv6 mapped to IPv4 addresses. The unexpected behavior can lead to integrity and confidentiality issues, specifically when these methods are used to...

The vulnerability of the AVG Internet Security antivirus protection lies in the use of dangerous methods or functions, which allow attackers to enhance their privileges.

The vulnerability of the AVG Internet Security antivirus protection lies in the use of dangerous methods or functions. Exploiting this vulnerability can allow attackers to enhance their privileges...

PT-2025-8696

Name of the Vulnerable Software and Affected Versions URI gem versions prior to 0.11.3 URI gem versions 0.12.0 through 0.12.3 URI gem versions 0.13.0 through 0.13.1 URI gem versions 1.0.0 through 1.0.2 Description The URI handling methods URI.join, URImerge, URI+ in the URI gem for Ruby have an...

CVE-2024-8268

CVE-2024-8268 affects the Frontend Dashboard WordPress plugin (versions

WordPress plugin Frontend Dashboard 代码注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A code injection...

CVE-2024-7884 Memory leak when calling a canister method via `ic_cdk::call`

When a canister method is called via iccdk::call , a new Future CallFuture is created and can be awaited by the caller to get the execution result. Internally, the state of the Future is tracked and stored in a struct called CallFutureState. A bug in the polling implementation of the CallFuture...

PT-2024-38658 · Ic Cdk · Ic Cdk

Name of the Vulnerable Software and Affected Versions: ic cdk versions 0.8.0 through 0.15.0 Description: A bug in the polling implementation of the CallFuture allows multiple references to be held for the internal state and not all references were dropped before the Future is resolved, causing a...

Medium: runc

Issue Overview: The various Is methods IsPrivate, IsLoopback, etc did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms. CVE-2024-24790 Affected Packages: runc Issue Correction: Run dnf update runc --releasev...

CVE-2024-5148 Gnome-remote-desktop: inadequate validation of session agents using d-bus methods may expose rdp tls certificate

A flaw was found in the gnome-remote-desktop package. The gnome-remote-desktop system daemon performs inadequate validation of session agents using D-Bus methods related to transitioning a client connection from the login screen to the user session. As a result, the system RDP TLS certificate and...

CISA and Partners Release Advisory on RansomHub Ransomware

Today, CISA—in partnership with the Federal Bureau of Investigation FBI, Multi-State Information Sharing and Analysis Center MS-ISAC, and Department of Health and Human Services HHS—released a joint Cybersecurity Advisory, StopRansomware: RansomHub Ransomware. This advisory provides network...

Amazon Linux 2 : runc (ALASDOCKER-2024-043)

The version of runc installed on the remote host is prior to 1.1.13-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2DOCKER-2024-043 advisory. The various Is methods IsPrivate, IsLoopback, etc did not work as expected for IPv4-mapped IPv6 addresses, returning false for...

infinispan: invokeAccessibly method from ReflectionUtil class allows to invoke private methods

A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application class to invoke private methods in any class with Infinispan's privileges. The attacker can use reflection to introduce new, malicious behavior into the...