August 13, 2024-KB5042351 Cumulative Update for .NET Framework 3.5, 4.8 and 4.8.1 for Windows 10 Version 21H2

None None...

PT-2024-37546 · Stitionai +1 · Devika +1

Name of the Vulnerable Software and Affected Versions: stitionai/devika main branch as of commit cdfb782b0e634b773b10963c8034dc9207ba1f9f stitionai/devika up to version 1.0 Description: The issue concerns a Local File Read LFI vulnerability by Prompt Injection. It is caused by the integration of...

CVE-2024-6778

creationtimestamp| type| source ---|---|--- 2024-07-17 00:39:10+00:00| seen| https://t.me/cvedetector/1010 2024-10-17 05:21:34+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/8764 2024-10-18 12:32:07+00:00| seen| None 2024-10-20 18:42:21+00:00| published-proof-of-concept|...

Security Bulletin: Maximo Application Suite - gunicorn-20.1.0-py3-none-any.whl is vulnerable to CVE-2024-1135 used in IBM Maximo Application Suite - Monitor Component

Summary IBM Maximo Application Suite - Monitor Component uses gunicorn-20.1.0-py3-none-any.whl which is vulnerable to CVE-2024-1135. This bulletin identifies the steps to take to address the vulnerabilities. Vulnerability Details CVEID:CVE-2024-1135 DESCRIPTION: Gunicorn is vulnerable to HTTP...

CVE-2024-37230

Cross-Site Request Forgery CSRF vulnerability in Rara Theme Book Landing Page.This issue affects Book Landing Page: from n/a through 1.2.3...

CVE-2024-37345

There is a cross-site scripting vulnerability in the Secure Access administrative UI of Absolute Secure Access prior to version 13.06. Attackers can pass a limited-length script to the administrative UI which is then stored where an administrator can access it. The scope is unchanged, there is no...

CVE-2024-5684 ID Charger Connect & Pro - JWT-Null-Algorithm

An attacker with access to the private network the charger is connected to or local access to the Ethernet-Interface can exploit a faulty implementation of the JWT-library in order to bypass the password authentication to the web configuration interface and then has full access as the user would...

Authentication Bypass

namshi/jose is vulnerable to Authentication Bypass. The vulnerability is due to improper signature validation which permits tokens signed with 'none' algorithms to be processed, effectively allowing authentication to bypass signature validation...

GHSA-HXHC-WMG8-XRQF namshi/jose insecure JSON Web Signatures (JWS)

namshi/jose allows the acceptance of unsecure JSON Web Signatures JWS by default. The vulnerability arises from the $allowUnsecure flag, which, when set to true during the loading of JWSes, permits tokens signed with 'none' algorithms to be processed. This behavior poses a significant security ri...

PT-2024-20855 · Mw45A Pt · Mw45A Pt

Name of the Vulnerable Software and Affected Versions: MW45A PT version 02.00 02 Description: A security issue was discovered in MW45A PT. The estimated number of potentially affected devices and details about real-world incidents are not specified. Technical details about exploitation are not...

Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in pypdf2-3.0.1-py3-none-any.whl

Summary IBM Watson Discovery for IBM Cloud Pak for Data contains a vulnerable version of pypdf2-3.0.1-py3-none-any.whl Vulnerability Details CVEID:CVE-2023-36464 DESCRIPTION: py-pdf pypdfis vulnerable to a denial of service, caused by an infinite loop if parsecontentstream is executed. By...

CVE-2023-45918

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

OESA-2024-1146 rubygem-actionpack security update

Eases web-request routing, handling, and response as a half-way front, half-way page controller. Implemented with specific emphasis on enabling easy unit/integration testing that doesn't require a browser. Security Fixes: A regular expression based DoS vulnerability in Action Dispatch 6.0.6.1,...

CVE-2023-46050

DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

Qualcomm Chipsets Security Vulnerability

Qualcomm Chipsets are a family of chipsets from Qualcomm Incorporated. A security vulnerability exists in Qualcomm Chipsets that results from a denial of service when parsing the IPv6 extended header when the WLAN firmware receives an IPv6 packet containing IPPROTONONE as the next header...

Security Bulletin: IBM Maximo Application Suite - IoT Component uses Pygments-2.14.0-py3-none-any.whl which is vulnerable to CVE-2022-40896

Summary IBM Maximo Application Suite - IoT Component uses Pygments-2.14.0-py3-none-any.whl which is vulnerable to CVE-2022-40896. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2022-40896 DESCRIPTION: Pygments is vulnerable to a...

GHSA-X5FR-7HHJ-34J3 Full Table Permissions by Default

Default table permissions in SurrealDB were FULL instead of NONE. This would lead to tables having FULL permissions for SELECT, CREATE, UPDATE and DELETE unless some other permissions were specified via the PERMISSIONS clause. We have decided to treat this behaviour as a vulnerability due to its...

PT-2023-33071 · Surrealdb · Surrealdb

Name of the Vulnerable Software and Affected Versions: SurrealDB versions prior to 1.0.1 SurrealDB version 1.1.0-beta.1 and earlier nightly releases are not affected as they already include the patch. Description: The issue arises from default table permissions in SurrealDB being set to FULL...

rubygem-actionpack: Denial of Service in Action Dispatch

A flaw was found in the rubygem-actionpack. RubyGem's actionpack gem is vulnerable to a denial of service caused by a regular expression denial of service ReDoS flaw in Action Dispatch related to the If-None-Match header. By sending a specially-crafted HTTP If-None-Match header, a remote attacker...

PT-2023-15061 · Unknown · Gopi Ramasamy Email

Name of the Vulnerable Software and Affected Versions: Gopi Ramasamy Email posts to subscribers versions n/a through 6.2 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection...