Oracle Linux 9 : mingw-glib2 (ELSA-2024-9442)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-9442 advisory. - Fix CVEs: CVE-2024-34397 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that Nessus has not test...

PT-2024-9175 · Absysnet · Absysnet

Name of the Vulnerable Software and Affected Versions: AbsysNet version 2.3.1 Description: An IDOR Insecure Direct Object Reference vulnerability has been discovered, which could allow a remote attacker to obtain the session of an unauthenticated user by brute-force attacking the session identifi...

PAN-OS Firewall Vulnerability Under Active Exploitation – IoCs and Patch Released

Palo Alto Networks has released new indicators of compromise IoCs a day after the network security vendor confirmed that a zero-day vulnerability impacting its PAN-OS firewall management interface has been actively exploited in the wild. To that end, the company said it observed malicious activit...

Vulnerability discovered in Fortinet FortiManager

UPDATE Public proof of concept PoC code for the vulnerability is available. It applies to FortiManager variants that have not yet been patched. Also, researchers have discovered that Fortinet's patch did not fix the full chain of exploitation. Thus, it is still possible to execute code on a patch...

Defense-in-Depth Security Updates for Microsoft SharePoint Server Subscription Edition (November 2024)

The Microsoft SharePoint Server Subscription Edition installation on the remote host is missing defense-in-depth security updates to help improve security-related features. %NASLMINLEVEL 70300 C Tenable, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid211459;...

Oracle Linux 7 : giflib (ELSA-2024-12825)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-12825 advisory. 4.1.6-9.0.1 - Fixes giflib CVE-2023-48161 issue Orabug: 37178930 Tenable has extracted the preceding description block directly from the Oracle Linux security...

CVE-2023-29409 affecting package golang for versions less than 1.20.7-1

CVE-2023-29409 affecting package golang for versions less than 1.20.7-1. A patched version of the package is available...

CVE-2024-46710 affecting package kernel for versions less than 6.6.57.1-1

CVE-2024-46710 affecting package kernel for versions less than 6.6.57.1-1. A patched version of the package is available...

PT-2024-26492 · Unknown · Vmir E8117

Name of the Vulnerable Software and Affected Versions: vmir e8117 version e8117 Description: A heap buffer overflow issue was discovered in vmir e8117 via the wasm parse section functions function at /src/vmir wasm parser.c. This issue occurs due to a heap buffer overflow, which can be exploited...

GHSA-QQ5C-677P-737Q Symfony vulnerable to command execution hijack on Windows with Process class

Description On Windows, when an executable file named cmd.exe is located in the current working directory it will be called by the Process class when preparing command arguments, leading to possible hijacking. Resolution The Process class now uses the absolute path to cmd.exe. The patch for this...

PT-2024-16657 · Guangzhou Tuchuang Computer Software Development · Interlib Library Cluster Automation Management System

Name of the Vulnerable Software and Affected Versions: Guangzhou Tuchuang Computer Software Development Interlib Library Cluster Automation Management System versions up to 2.0.1 Description: A critical issue has been found in the Interlib Library Cluster Automation Management System, affecting a...

Oracle Linux 8 : bcc (ELSA-2024-8831)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-8831 advisory. - Really prevent the loading of compromised headers RHEL-28768, CVE-2024-2314 Tenable has extracted the preceding description block directly from the Oracle Lin...

PT-2024-34573 · Draytek · Draytek Vigor3900

Name of the Vulnerable Software and Affected Versions: Draytek Vigor3900 version 1.5.1.3 Description: The issue allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the reboot function. This enables remote reboot and potentially other...

SUSE CVE-2024-49753

Zitadel is open-source identity infrastructure software. Versions prior to 2.64.1, 2.63.6, 2.62.8, 2.61.4, 2.60.4, 2.59.5, and 2.58.7 have a flaw in the URL validation mechanism of Zitadel actions allows bypassing restrictions intended to block requests to localhost 127.0.0.1. The isHostBlocked...

CVE-2024-0553 affecting package gnutls for versions less than 3.7.11-1

CVE-2024-0553 affecting package gnutls for versions less than 3.7.11-1. A patched version of the package is available...

CVE-2023-39130 affecting package gdb for versions less than 11.2-3

CVE-2023-39130 affecting package gdb for versions less than 11.2-3. A patched version of the package is available...

CVE-2024-26875 affecting package kernel for versions less than 5.15.167.1-2

CVE-2024-26875 affecting package kernel for versions less than 5.15.167.1-2. A patched version of the package is available...

CVE-2024-28180 affecting package dcos-cli for versions less than 1.2.0-19

CVE-2024-28180 affecting package dcos-cli for versions less than 1.2.0-19. A patched version of the package is available...

CVE-2023-52601 affecting package kernel for versions less than 5.15.167.1-2

CVE-2023-52601 affecting package kernel for versions less than 5.15.167.1-2. A patched version of the package is available...

WordPress BookingPress Plugin <= 1.1.16 is vulnerable to SQL Injection

Software BookingPress Type Plugin Vulnerable versions = 1.1.16 Fixed in 1.1.17 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-10540 Patch priority High CVSS severity High 8.5 Developer Claim ownership PSID ae4b89138a08 Credits Arkadiusz Hydzik Required privilege Subscriber...