PT-2024-10368 · Gstreamer +7 · Gstreamer +7

Name of the Vulnerable Software and Affected Versions: GStreamer versions prior to 1.24.10 Description: The issue is related to a null pointer dereference vulnerability in the gst matroska demux add wvpk header function. This vulnerability can be exploited by a remote attacker to cause a denial o...

PT-2024-10366

Name of the Vulnerable Software and Affected Versions GStreamer versions prior to 1.24.10 Description The issue is related to an integer underflow in the qtdemux parse theora extension function within qtdemux.c. This underflow causes the size variable to hold a large unintended value when cast to...

[SECURITY] [DSA 5827-1] proftpd-dfsg security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5827-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso December 10, 2024 https://www.debian.org/security/faq -...

[SECURITY] [DSA 5826-1] smarty3 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5826-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff December 10, 2024 https://www.debian.org/security/faq -...

Security Advisory Ivanti Cloud Services Application (CSA) (CVE-2024-11639, CVE-2024-11772, CVE-2024-11773)

Summary Ivanti has released updates for Ivanti Cloud Services Application which addresses medium, high and critical vulnerabilities. We are not aware of any customers being exploited by these vulnerabilities at the time of disclosure. Vulnerability Details: CVE Number | Description | CVSS Score...

December 10, 2024—KB5048699 (Monthly Rollup)

None None...

PT-2024-35964

Name of the Vulnerable Software and Affected Versions: pnpm versions prior to 9.15.0 Description: The package manager pnpm seems to mishandle overrides and global cache. This can lead to overrides from one workspace leaking into npm metadata saved in the global cache, affecting other workspaces...

PT-2024-34462 · Silicon · Silicon Labs 500 Series Z-Wave

Name of the Vulnerable Software and Affected Versions: Silicon Labs Z-Wave Series 500 version 6.84.0 Description: The issue is related to insecure permissions in the software. Recommendations: For version 6.84.0, consider updating the permissions configuration to a more secure setup, however, at...

PT-2024-34391 · Tp Link · Tp-Link Tl-Wr845N

Name of the Vulnerable Software and Affected Versions: TP-Link TL-WR845NUN V4 versions 190219 through 201214 Description: The issue concerns weak default credentials for the Administrator account. This allows unauthorized access to the device. Recommendations: For TP-Link TL-WR845NUN V4 versions...

PT-2024-9948 · Adobe · Substance3D - Modeler

Name of the Vulnerable Software and Affected Versions: Substance3D - Modeler versions 1.14.1 and earlier Description: The issue is related to an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires...

Simulation of Wasmd message can cause crashing

CWA-2024-009 Severity Low Marginal + Likely^1 Affected versions: - wasmd 0.53.1 Patched versions: - wasmd 0.53.2 please note that wasmd 0.53.1 is broken and must not be used Description of the bug Blank for now. We'll add more detail once chains had a chance to upgrade. Mitigations Apart from...

PT-2024-16481

Name of the Vulnerable Software and Affected Versions System Dashboard WordPress plugin versions prior to 2.8.15 Description The issue is related to the plugin not validating user input used in a path, which could allow high privilege users, such as admin, to perform path traversal attacks and re...

PT-2024-10222 · Document Foundation +5 · Libreoffice +5

Name of the Vulnerable Software and Affected Versions: LibreOffice versions 24.8 through 24.8.3 Description: The issue is related to an improper limitation of a pathname to a restricted directory, allowing absolute path traversal. An attacker can write to arbitrary locations, albeit suffixed with...

GHSA-6VX4-V2JW-QWQH Trix editor subject to XSS vulnerabilities on copy & paste

The Trix editor, in versions prior to 2.1.9 and 1.3.3, is vulnerable to XSS + mutation XSS attacks when pasting malicious code. Impact An attacker could trick a user to copy and paste malicious code that would execute arbitrary JavaScript code within the context of the user's session, potentially...

Trix editor subject to XSS vulnerabilities on copy & paste

The Trix editor, in versions prior to 2.1.9 and 1.3.3, is vulnerable to XSS + mutation XSS attacks when pasting malicious code. Impact An attacker could trick a user to copy and paste malicious code that would execute arbitrary JavaScript code within the context of the user's session, potentially...

CVE-2024-53847

The CVE-2024-53847 entry concerns the Trix rich text editor prior to 2.1.9 and 1.3.3, which is vulnerable to XSS and mutation XSS when pasting malicious code. The described impact is execution of arbitrary JavaScript in the user’s session, potentially enabling unauthorized actions or data disclos...

Apache Superset: Error verbosity exposes metadata in analytics databases

Generation of Error Message Containing analytics metadata Information in Apache Superset. This issue affects Apache Superset: before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue...

Apache Superset: Lower privilege users are able to create Role when FAB_ADD_SECURITY_API is enabled

Improper Authorization vulnerability in Apache Superset when FABADDSECURITYAPI is enabled disabled by default. Allows for lower privilege users to use this API. issue affects Apache Superset: from 2.0.0 before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue...

CVE-2024-53947

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache Superset. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. This issue is a follow-up to CVE-2024-39887...

CVE-2024-53949

Improper Authorization vulnerability in Apache Superset when FABADDSECURITYAPI is enabled disabled by default. Allows for lower privilege users to use this API. issue affects Apache Superset: from 2.0.0 before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue...