K000149093: Apache Struts vulnerability CVE-2024-53677

Security Advisory Description File upload logic in Apache Struts is flawed. An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. This issue affects Apach...

Fortra FileCatalyst Workflow Directory Traversal (CVE-2024-25153) (Version Check)

The version of Fortra FileCatalyst Workflow running on the remote host is prior to 5.1.6 Build 114. It is, therefore, is affected by a Directory Traversal vulnerability. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number...

PT-2024-17789 · Foxcms · Foxcms

Name of the Vulnerable Software and Affected Versions: FoxCMS versions up to 1.2 Description: A critical issue was found in the API Endpoint component, specifically in the file /app/api/controller/Site.php. The manipulation of the password argument leads to improper authorization, allowing for...

Fortra GoAnywhere Managed File Transfer (MFT) < 7.4.2 Path Traversal (CVE-2024-25156)

According to its self-reported version, the instance of Fortra GoAnywhere Managed File Transfer MFT running on the remote web server is 7.4.2. It is, therefore, affected by an Path Traversal vulnerability. This can allow an unauthenticated attacker to create an admin user via the administration...

CVE-2024-12894 TreasureHuntGame TreasureHunt acesso.php sql injection

A vulnerability, which was classified as critical, was found in TreasureHuntGame TreasureHunt up to 963e0e0. Affected is an unknown function of the file TreasureHunt/acesso.php. The manipulation of the argument usuario leads to sql injection. It is possible to launch the attack remotely. This...

PT-2024-36783 · Redcap · Redcap

Name of the Vulnerable Software and Affected Versions: REDCap versions prior to 15.0.0 Description: A stored cross-site scripting XSS vulnerability in the Project Dashboard name of REDCap allows authenticated users to inject malicious scripts into the name field of a Project Dashboard. When a use...

PT-2024-36784 · Redcap · Redcap

Name of the Vulnerable Software and Affected Versions: REDCap versions through 14.9.6 Description: A stored cross-site scripting XSS vulnerability in the Calendar feature allows authenticated users to inject malicious scripts into the Notes field of a calendar event. When the event is viewed, the...

PT-2024-36808 · Poppler +6 · Poppler +6

Name of the Vulnerable Software and Affected Versions: Poppler versions prior to 24.12.0 Description: The issue is an out-of-bounds read vulnerability within the JBIG2Bitmap::combine function in JBIG2Stream.cc. This vulnerability occurs in the libpoppler.so file in Poppler. Recommendations: For...

PT-2024-36785 · Redcap · Redcap

Name of the Vulnerable Software and Affected Versions: REDCap versions prior to 15.0.0 Description: A stored cross-site scripting XSS vulnerability in the Project name of REDCap allows authenticated users to inject malicious scripts into the name field of a Project. When a user clicks on the...

[SECURITY] [DLA 4000-1] sqlparse security update

Debian LTS Advisory DLA-4000-1 [email protected] https://www.debian.org/lts/security/ Guilhem Moulin December 21, 2024 https://wiki.debian.org/LTS Package : sqlparse Version : 0.4.1-1+deb11u1 CVE ID : CVE-2021-32839 CVE-2023-30608 CVE-2024-4340 Debian Bug : 994841 1034615 1070148 Multip...

PT-2024-34640 · Ibm · Ibm I

Name of the Vulnerable Software and Affected Versions: IBM i versions 7.3, 7.4, and 7.5 Description: The issue allows an authenticated attacker to bypass Navigator for i interface restrictions by sending a specially crafted request, enabling them to remotely perform operations that the user is no...

Debian dla-3999 : gir1.2-gst-plugins-base-1.0 - security update

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3999 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3999-1 [email protected]...

CVE-2024-56335

vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwardenrs. In affected versions an attacker is capable of updating or deleting groups from an organization given a few conditions: 1. The attacker has a user account in the server. 2. The attacker's...

[SECURITY] [DSA 5834-1] chromium security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5834-1 [email protected] https://www.debian.org/security/ Andres Salomon December 20, 2024 https://www.debian.org/security/faq -...

Security Bulletin: Multiple vulnerabilities in IBM WebSphere Application Server Liberty may affect IBM Storage Protect Backup-Archive Client

Summary IBM Storage Protect Backup-Archive Client can be affected by security flaws in IBM WebSphere Application Server Liberty. An attacker could exploit this vulnerability using a certificate issued by a trusted authority to obtain sensitive information, as described in the "Vulnerability...

Security Bulletin: A vulnerability in IBM WebSphere Application Server Liberty may affect IBM Storage Protect for Virtual Environments: Data Protection for VMware

Summary IBM Storage Protect for Virtual Environments: Data Protection for VMware can be affected by a security flaw in IBM WebSphere Application Server Liberty. An attacker could exploit this vulnerability using a certificate issued by a trusted authority to obtain sensitive information, as...

Security Bulletin: Vulnerability in IBM WebSphere Application Server Liberty may affect IBM Storage Protect for Space Management

Summary IBM Storage Protect for Space Management can be affected by security flaws in IBM WebSphere Application Server. Network to conduct spoofing attacks, as described in the "Vulnerability Details" section. CVE-2023-50314. Vulnerability Details CVEID:CVE-2023-50314 DESCRIPTION: IBM WebSphere...

PT-2024-10029

Name of the Vulnerable Software and Affected Versions Four-Faith routers F3x24 and F3x36 versions prior to 2.0 Description The Four-Faith router models F3x24 and F3x36 are affected by an operating system OS command injection vulnerability. At least firmware version 2.0 allows authenticated and...

PT-2024-28988 · Ibm · Ibm Cognos Analytics

Name of the Vulnerable Software and Affected Versions: IBM Cognos Analytics versions 11.2.0 through 11.2.4 FP4 IBM Cognos Analytics versions 12.0.0 through 12.0.4 Description: The issue is related to a malicious file upload vulnerability due to the lack of validation of the content of uploaded...

Cleo VLTrader < 5.8.0.21 Unrestricted File Upload/Download (CVE-2024-50623)

The version of Cleo VLTrader running on the remote host is prior to 5.8.0.21. It is, therefore, affected by an unrestricted file upload and download vulnerability. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number...