CVE-2024-29205

An Improper Check for Unusual or Exceptional Conditions vulnerability in the web component of Ivanti Connect Secure 9.x, 22.x and Ivanti Policy Secure 9.x, 22.x allows a remote unauthenticated attacker to send specially crafted requests in-order-to cause service disruptions...

PT-2024-15904 · WordPress · Elespare

Name of the Vulnerable Software and Affected Versions: Elespare plugin for WordPress versions up to, and including, 2.1.2 Description: The issue is related to unauthorized post creation due to a missing capability check on the elespare create post function, which is hooked via AJAX. This allows...

PT-2024-40005 · Unknown · Uptime Kuma

Name of the Vulnerable Software and Affected Versions: Uptime Kuma affected versions not specified Description: The issue allows access to the platform despite authentication being enabled, as previously logged-in sessions remain valid. The expected behavior is that all previously connected...

Mozilla Firefox Security Update (MFSA2024-18) - Mac OS X

Mozilla Firefox is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:firefox";...

CVE-2024-30409

Vulnerability (CVE-2024-30409) in Juniper Networks Junos OS and Junos OS Evolved telemtry processing can crash the forwarding information base telemetry daemon (fibtd) via an improper check for unusual or exceptional conditions. A network-based authenticated attacker can cause a limited Denial of...

PT-2024-23593 · Ros2 · Ros2

Name of the Vulnerable Software and Affected Versions: ROS2 Dashing Diademata version 2 Description: An issue in ROS2 allows remote attackers to execute arbitrary code via packages or nodes. Recommendations: For ROS2 Dashing Diademata version 2, at the moment, there is no information about a newe...

WordPress Woocommerce Social Media Share Buttons Plugin <= 1.3.0 is vulnerable to Cross Site Scripting (XSS)

Software Woocommerce Social Media Share Buttons Type Plugin Vulnerable versions = 1.3.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-31109 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 2941fe56e84a Credits Dimas Maula...

CVE-2024-29943

An attacker was able to perform an out-of-bounds read or write on a JavaScript object by fooling range-based bounds check elimination. This vulnerability affects Firefox 124.0.1...

Mozilla Thunderbird Security Update (MFSA2024-11) - Mac OS X

Mozilla Thunderbird is prone to an information disclosure vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

BIT-ELASTICSEARCH-2020-7020

Elasticsearch versions before 6.8.13 and 7.9.2 contain a document disclosure flaw when Document or Field Level Security is used. Search queries do not properly preserve security permissions when executing certain complex queries. This could result in the search disclosing the existence of documen...

mysql: Server: DDL unspecified vulnerability (CPU Apr 2023)

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: DDL. Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks o...

CVE-2023-45594

CVE-2023-45594 affects AiLux imx6 bundle earlier than imx6_1.0.7-2. The root cause is a CWE-552 vulnerability in the embedded Chromium browser that could allow a physical attacker to arbitrarily download or upload files to the device’s filesystem, with impacts on confidentiality, integrity, and a...

PT-2024-22133

Name of the Vulnerable Software and Affected Versions Minder versions prior to 0.0.33 Description A Minder user can use the endpoints GetRepositoryByName, DeleteRepositoryByName, and GetArtifactByName to access any repository in the database, irrespective of who owns the repository and any...

openSUSE: Security Advisory for catatonit, containerd, runc (SUSE-SU-2023:4727-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

UBUNTU-CVE-2023-52510

In the Linux kernel, the following vulnerability has been resolved: ieee802154: ca8210: Fix a potential UAF in ca8210probe If ofclkaddprovider fails in ca8210registerextclock, it calls clkunregister to release priv-clk and returns an error. However, the caller ca8210probe then calls ca8210remove,...

DEBIAN-CVE-2021-47066

In the Linux kernel, the following vulnerability has been resolved: asyncxor: increase srcoffs when dropping destination page Now we support sharing one page if PAGESIZE is not equal stripe size. To support this, it needs to support calculating xor value with different offsets for each r5dev. One...

CentOS 9 : libtiff-4.4.0-5.el9

The remote CentOS Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the libtiff-4.4.0-5.el9 build changelog. - Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that...

CVE-2023-49114

A DLL hijacking vulnerability was identified in the Qognify VMS Client Viewer version 7.1 or higher, which allows local users to execute arbitrary code and obtain higher privileges via careful placement of a malicious DLL, if some specific pre-conditions are met...

LIVEBOX Collaboration vDesk Cross-Site Scripting Vulnerability

LIVEBOX Collaboration vDesk is an application from LIVEBOX, Inc. A cross-site scripting vulnerability exists in LIVEBOX Collaboration vDesk v031 and earlier versions, which stems from a cross-site scripting vulnerability in the title and /dashboard/reminders parameters of the...

mysql: Server: RAPID unspecified vulnerability (CPU Jan 2024)

A flaw was found in MySQL Server RAPID. This vulnerability allows a malicious user with low privileges and network access to compromise the MySQL Server. A successful attack can result in the unauthorized ability to cause a hang, or a frequently repeatable crash, a complete denial of service DOS,...