PT-2024-34660 · Librenms · Librenms

Name of the Vulnerable Software and Affected Versions: LibreNMS versions prior to 24.10.0 Description: A Reflected Cross-Site Scripting XSS vulnerability in the metric parameter of the "/wireless" and "/health" endpoints allows attackers to inject arbitrary JavaScript, potentially compromising a...

PT-2024-34376 · Unknown · Python Book

Name of the Vulnerable Software and Affected Versions: python book version V1.0 Description: The issue concerns an arbitrary file upload vulnerability in the user avatar upload function. This vulnerability allows for the upload of arbitrary files, which could potentially lead to security issues...

PT-2024-16598 · WordPress · The Popup Box – Create Countdown

Name of the Vulnerable Software and Affected Versions: The Popup Box – Create Countdown, Coupon, Video, Contact Form Popups plugin for WordPress versions up to, and including, 4.9.7 Description: The issue is related to a missing capability check on the deactivate plugin option function, which...

Fedora 38 : python3.8 (2022-eda83be115)

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2022-eda83be115 advisory. Automatic update for python3.8-3.8.15-2.fc38. Changelog Mon Nov 14 2022 Miro Hronok - 3.8.15-2 - CVE-2022-37454: Fix buffer overflows in sha3 module Related:...

Fedora 41 : python-rpyc (2024-17a3b4d4c3)

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-17a3b4d4c3 advisory. Fix CVE-2024-27758 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested...

Amazon Linux 2023 : ecs-service-connect-agent (ALAS2023-2024-758)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-758 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks ...

Ubuntu 14.04 LTS / 16.04 LTS : Linux kernel vulnerabilities (USN-7110-1)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7110-1 advisory. Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update...

CVE-2024-40671

In DevmemIntChangeSparse2 of devicememserver.c, there is a possible way to achieve arbitrary code execution due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2024-34719

In multiple locations, there is a possible permissions bypass due to a missing null check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

(0Day) Trimble SketchUp Viewer SKP File Parsing Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Trimble SketchUp Viewer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsin...

CBL Mariner 2.0 Security Update: ruby / rubygem-rexml (CVE-2024-49761)

The version of ruby / rubygem-rexml installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-49761 advisory. - REXML is an XML toolkit for Ruby. The REXML gem before 3.3.9 has a ReDoS vulnerability when it...

PT-2024-34862 · Unknown · Gopi.R Twitter Plugin

Name of the Vulnerable Software and Affected Versions: Gopi.R Twitter Plugin versions prior to 7.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Reflected XSS in the Twitter real-time searc...

CVE-2024-47073 Dataease arbitrary interface access vulnerability

DataEase is an open source data visualization analysis tool that helps users quickly analyze data and gain insights into business trends. In affected versions a the lack of signature verification of jwt tokens allows attackers to forge jwts which then allow access to any interface. The...

CVE-2024-20109

In ccu, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS09065928; Issue ID: MSV-1763...

CVE-2024-20107

In da, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS09124360; Issue ID: MSV-1823...

CVE-2024-20118

CVE-2024-20118 affects the MediaTek mms component, with an out-of-bounds write caused by an incorrect bounds check. This can lead to local escalation of privilege and SYSTEM privileges are required for exploitation; no user interaction is needed. A patch is referenced as ALPS09062392 (MSV-1621). ...

RHEL 5 : security update for Red Hat Network Satellite (Moderate) (RHSA-2011:0434)

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2011:0434 advisory. Red Hat Network Satellite RHN Satellite is a system management tool for Linux-based infrastructures. It allows for the provisioning, remote...

Fedora 40 : chromium (2024-b92c0289c9)

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-b92c0289c9 advisory. Update to 130.0.6723.91 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...

PT-2024-16499 · Unknown · Codezips Free Exam Hall Seating Management System

Name of the Vulnerable Software and Affected Versions: Codezips Free Exam Hall Seating Management System version 1.0 Description: A critical issue affects the processing of the file /student.php, where the manipulation of the email argument leads to SQL injection. The attack can be initiated...

PT-2024-34620 · Unknown · Open Floodlight Sdn Controller

Name of the Vulnerable Software and Affected Versions: Floodlight SDN Open Flow Controller version 1.2 Description: The issue allows local hosts to build fake LLDP packets, which can cause Floodlight to miss specific clusters. This, in turn, leads to missed hosts inside and outside the cluster. T...