CVE-2024-34008 moodle: CSRF risk in analytics management of models

Actions in the admin management of analytics models did not include the necessary token to prevent a CSRF risk...

CVE-2024-34001

Actions in the admin preset tool did not include the necessary token to prevent a CSRF risk...

PT-2024-3504 · Adobe · Substance3D - Painter

Name of the Vulnerable Software and Affected Versions: Substance3D - Painter versions 9.1.2 and earlier Description: The issue is related to an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires...

MAL-2024-1296 Malicious code in waveapi (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8ed8a707955886dfaa2b55283c703e3acbc8f5db17a426587702b53e53a9c0fb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

KLA65276 OSI vulnerability in Microsoft Developer Tools

An information disclosure vulnerability was found in Microsoft Developer Tools. Malicious users can exploit this vulnerability to obtain sensitive information. Original advisories CVE-2024-29059 Exploitation Public exploits exist for this vulnerability. Related products Microsoft-.NET-Framework...

CVE-2024-27351

In Django 3.2 before 3.2.25, 4.2 before 4.2.11, and 5.0 before 5.0.3, the django.utils.text.Truncator.words method with html=True and the truncatewordshtml template filter are subject to a potential regular expression denial-of-service attack via a crafted string. NOTE: this issue exists because ...

[SECURITY] Fedora 40 Update: plexus-testing-1.3.0-2.fc40

The Plexus Testing contains the necessary classes to be able to test Plexus components...

[SECURITY] Fedora 40 Update: maven-plugin-testing-3.3.0-33.fc40

The Maven Plugin Testing contains the necessary modules to be able to test Maven Plugins...

PT-2024-3257 · Mediawiki +1 · Mediawiki +1

Name of the Vulnerable Software and Affected Versions: MediaWiki versions prior to 1.39.7 MediaWiki versions 1.40.x prior to 1.40.3 MediaWiki versions 1.41.x prior to 1.41.1 Description: An issue in the includes/specials/SpecialMovePage.php file of MediaWiki can lead to a denial of service. If a...

CVE-2024-25119 Information Disclosure of Encryption Key in TYPO3 Install Tool

TYPO3 is an open source PHP based web content management system released under the GNU GPL. The plaintext value of $GLOBALS'SYS''encryptionKey' was displayed in the editing forms of the TYPO3 Install Tool user interface. This allowed attackers to utilize the value to generate cryptographic hashes...

PT-2024-19017 · Atlassian · Confluence

Name of the Vulnerable Software and Affected Versions: Confluence Data Center and Server versions 7.19.0 through 8.9.0 Confluence Data Center and Server version 4.3 Description: This Reflected XSS and CSRF vulnerability allows an unauthenticated attacker to execute arbitrary HTML or JavaScript co...

Juniper Networks Releases Security Bulletin for J-Web in Junos OS SRX Series and EX Series

Juniper Networks released a security bulletin to address multiple vulnerabilities for J-Web in Junos OS SRX Series and EX Series. A cyber threat actor could exploit one of these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review the Juniper...

Drupal Releases Security Advisory for Drupal Core

Drupal released a security advisory to address a vulnerability affecting multiple Drupal core versions. A cyber threat actor could exploit this vulnerability to cause a denial-of-service condition. CISA encourages users and administrators to review Drupal security advisory SA-CORE-2024-001link is...

CVE-2023-48222 Authenticated users can view or delete jobs they do not have authorization for in Rundeck

Rundeck is an open source automation service with a web console, command line tools and a WebAPI. In affected versions access to two URLs used in both Rundeck Open Source and Process Automation products could allow authenticated users to access the URL path, which would allow access to view or...

CVE-2023-47629 Privilege escalation through email sign-up in datahub

DataHub is an open-source metadata platform. In affected versions sign-up through an invite link does not properly restrict users from signing up as privileged accounts. If a user is given an email sign-up link they can potentially create an admin account given certain preconditions. If the defau...

Upgraded Q -> 2 from #430 [1699028562977]

Judge has assessed an item in Issue 430 as 2 risk. The relevant finding follows: It’s not clear which token the OD token will be paired with in order to determine the price in the uniV3Relayer contract. Then the following lines are problematic: baseAmount = uint12810...

VMware Releases Advisory for VMware Tools Vulnerabilities

VMware released a security advisory addressing multiple vulnerabilities CVE-2023-34057, CVE-2023-34058 in VMware Tools. A cyber actor could exploit one of these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review the VMware advisory...

Tenable Nessus SEoL (7.0.x)

According to its version, Tenable Nessus is 7.0.x. It is, therefore, no longer maintained by its vendor or provider. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it may contain security vulnerabilities. %NASLMINLEVEL 80900 C...

Tenable Nessus SEoL (10.3.x)

According to its version, Tenable Nessus is 10.3.x. It is, therefore, no longer maintained by its vendor or provider. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it may contain security vulnerabilities. %NASLMINLEVEL 80900 C...

KLA61043 Multiple vulnerabilities in Microsoft Browser

Multiple vulnerabilities were found in Microsoft Browser. Malicious users can exploit these vulnerabilities to execute arbitrary code, cause denial of service. Below is a complete list of vulnerabilities: 1. Double-free memory address vulnerability in libwebp can be exploited remotely to cause...