CVE-2024-34082

Grav is a file-based Web platform. Prior to version 1.7.46, a low privilege user account with page edit privilege can read any server files using Twig Syntax. This includes Grav user account files - /grav/user/accounts/.yaml. This file stores hashed user password, 2FA secret, and the password res...

AZL-43041 CVE-2024-32004 affecting package git for versions less than 2.45.2-1

Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, an attacker can prepare a local repository in such a way that, when cloned, will execute arbitrary code during the operation. The problem has been patched in versions 2.45.1, 2.44.1,...

PT-2024-25952 · Yvan Dotet · Postgresql Query Deluxe

Name of the Vulnerable Software and Affected Versions: Yvan Dotet PostgreSQL Query Deluxe module versions 17.x before 17.0.0.4 Description: A SQL injection issue allows a remote attacker to gain privileges via the query parameter to models/querydeluxe.py:QueryDeluxe::get result from query. This...

PT-2024-24150 · WordPress · Jeg Elementor Kit

Name of the Vulnerable Software and Affected Versions: Jeg Elementor Kit plugin for WordPress versions up to, and including, 2.6.4 Description: The issue is related to Stored Cross-Site Scripting via the countdown widget's attributes due to insufficient input sanitization and output escaping. Thi...

Zitadel exposing internal database user name and host information

Impact In case ZITADEL could not connect to the database, connection information including db name, username and db host name could be returned to the user. Patches 2.x versions are fixed on = 2.50.3 2.49.x versions are fixed on = 2.49.5 2.48.x versions are fixed on = 2.48.5 2.47.x versions are...

CVE-2024-32967 Zitadel exposes internal database user name and host information

Zitadel is an open source identity management system. In case ZITADEL could not connect to the database, connection information including db name, username and db host name could be returned to the user. This has been addressed in all supported release branches in a point release. There is no...

PT-2024-40749 · Git +1 · Libpcap

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a crash type of "Use-of-uninitialized-value". The crash state involves several functions: pcapint filter with aux data, pcapint...

PT-2024-12115 · Libmodbus · Libmodbus

Name of the Vulnerable Software and Affected Versions: libmodbus version 3.1.10 Description: The issue is a heap-based buffer overflow vulnerability in the read io status function located in src/modbus.c. This vulnerability can potentially be exploited, but there is no information provided about...

CVE-2022-29526 affecting package cri-o for versions less than 1.21.7-2

CVE-2022-29526 affecting package cri-o for versions less than 1.21.7-2. A patched version of the package is available...

CVE-2023-45288 affecting package git-lfs for versions less than 3.5.1-1

CVE-2023-45288 affecting package git-lfs for versions less than 3.5.1-1. A patched version of the package is available...

CVE-2024-3194

A vulnerability was found in MailCleaner up to 2023.03.14 and classified as problematic. Affected by this issue is some unknown functionality of the component Log File Endpoint. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to...

PT-2024-21928 · Unknown · Superantispyware Professional

Name of the Vulnerable Software and Affected Versions: SUPERAntiSpyware Professional X versions 10.0.1262 through 10.0.1264 Description: The issue allows unprivileged attackers to escalate privileges via a restore of a crafted DLL file into the C:Program FilesSUPERAntiSpyware folder...

SUSE CVE-2024-32658

FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version 3.5.1 are vulnerable to out-of-bounds read. Version 3.5.1 contains a patch for the issue. No known workarounds are available...

UBUNTU-CVE-2024-32661

FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version 3.5.1 are vulnerable to a possible NULL access and crash. Version 3.5.1 contains a patch for the issue. No known workarounds are available...

CVE-2022-31394 affecting package rpm-ostree for versions less than 2022.1-7

CVE-2022-31394 affecting package rpm-ostree for versions less than 2022.1-7. A patched version of the package is available...

CVE-2023-1393 affecting package xorg-x11-server for versions less than 1.20.10-4

CVE-2023-1393 affecting package xorg-x11-server for versions less than 1.20.10-4. A patched version of the package is available...

CVE-2023-3817 affecting package edk2 for versions less than 20230301gitf80f052277c8-37

CVE-2023-3817 affecting package edk2 for versions less than 20230301gitf80f052277c8-37. A patched version of the package is available...

CVE-2024-27281 affecting package ruby for versions less than 3.1.4-4

CVE-2024-27281 affecting package ruby for versions less than 3.1.4-4. A patched version of the package is available...

PT-2024-24484 · Tenda · Tenda W30E

Name of the Vulnerable Software and Affected Versions: Tenda W30E version 1.0 V1.0.1.25633 Description: The issue is a stack overflow vulnerability located via the page parameter in the fromVirtualSer function. Recommendations: For Tenda W30E version 1.0 V1.0.1.25633, consider disabling the...

PT-2024-24501 · Tenda · Tenda F1203

Name of the Vulnerable Software and Affected Versions: Tenda F1203 version 2.0.1.6 Description: The issue is a stack overflow vulnerability located in the adslPwd parameter of the formWanParameterSetting function. This vulnerability can be exploited, potentially allowing unauthorized access or...