Security Bulletin: User can inject the suspected code via URL passed

Summary A vulnerability in the packageindex module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or retrieved from package index servers, are susceptible to cod...

PT-2024-9606

Name of the Vulnerable Software and Affected Versions Hunk Companion WordPress plugin versions prior to 1.9.0 Description The Hunk Companion WordPress plugin does not properly authorize certain REST API endpoints, allowing unauthenticated requests to install and activate arbitrary plugins from th...

CVE-2024-53847

The Trix rich text editor, prior to versions 2.1.9 and 1.3.3, is vulnerable to cross-site scripting XSS + mutation XSS attacks when pasting malicious code. An attacker could trick a user to copy and paste malicious code that would execute arbitrary JavaScript code within the context of the user's...

Debian: Security Advisory (DSA-5825-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

AlmaLinux 9 : ruby (ALSA-2024:10858)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2024:10858 advisory. rexml: REXML ReDoS vulnerability CVE-2024-49761 Tenable has extracted the preceding description block directly from the AlmaLinux security advisory. Note that...

CBL Mariner 2.0 Security Update: ncurses (CVE-2023-50495)

The version of ncurses installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-50495 advisory. - NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component ncwrapentry...

Microsoft Edge (Chromium) < 131.0.2903.86 (CVE-2024-49041)

The version of Microsoft Edge installed on the remote Windows host is prior to 131.0.2903.86. It is, therefore, affected by a vulnerability as referenced in the December 5, 2024 advisory. - Microsoft Edge Chromium-based Spoofing Vulnerability CVE-2024-49041 Note that Nessus has not tested for thi...

PT-2025-8783

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 5.10.0 Description A vulnerability has been identified in the Linux kernel, specifically in the net sched module, where the sch sfq implementation does not work correctly with a limit of 1 packet. This issue can...

openSUSE Security Advisory (SUSE-SU-2024:4193-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Devolutions Server Information Disclosure (DEVO-2024-0015)

An information exposure in Devolutions Server 2024.3.6 and earlier on Windows is affected by Improper access control in the Password History feature in Devolutions DVLS 2024.3.6 and earlier allows a malicious authenticated user to obtain sensitive data via faulty permission. Note that Nessus has...

Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in Eclipse Jetty

Summary Multiple vulnerabilities in Eclipse Jetty that is used by InfoSphere Information Server were addressed. Vulnerability Details CVEID:CVE-2024-9823 DESCRIPTION: Eclipse Jetty is vulnerable to a denial of service, caused by a flaw in the DosFilter feature. By sending specially crafted...

CVE-2018-9386

In rebootblockcommand of htc rebootblock driver, there is a possible stack buffer overflow due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation...

CVE-2018-9393

In procfilewrite of drivers/misc/mediatek/connectivity/wlan/gen2/os/linux/glproc.c, there is a possible OOB write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation...

CVE-2024-20134

In ril, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS09154589; Issue ID: MSV-1866...

CVE-2024-20136

In da, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS09121847; Issue ID: MSV-1821...

CVE-2024-20134

In ril, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS09154589; Issue ID: MSV-1866...

CVE-2024-20134

In ril, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS09154589; Issue ID: MSV-1866...

CVE-2024-20132

In Modem, there is a possible out of bonds write due to a mission bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY00957388; Issue ID: MSV-1872...

CVE-2024-20130

In power, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS09193374; Issue ID: MSV-1982...

ASB-A-357079333

In DevmemValidateFlags of devicememserver.c , there is a possible out of bounds write due to memory corruption. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...