CVE-2024-53947 Apache Superset: Improper SQL authorisation, parse not checking for specific postgres functions

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache Superset. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. This issue is a follow-up to CVE-2024-39887...

RUSTSEC-2024-0421 `idna` accepts Punycode labels that do not produce any non-ASCII when decoded

idna 0.5.0 and earlier accepts Punycode labels that do not produce any non-ASCII output, which means that either ASCII labels or the empty root label can be masked such that they appear unequal without IDNA processing or when processed with a different implementation and equal when processed with...

CVE-2024-46901

Insufficient validation of filenames against control characters in Apache Subversion repositories served via moddavsvn allows authenticated users with commit access to commit a corrupted revision, leading to disruption for users of the repository. All versions of Subversion up to and including...

CVE-2024-46901 Apache Subversion: mod_dav_svn denial-of-service via control characters in paths

Insufficient validation of filenames against control characters in Apache Subversion repositories served via moddavsvn allows authenticated users with commit access to commit a corrupted revision, leading to disruption for users of the repository. All versions of Subversion up to and including...

GLSA-202412-08 : icinga2: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202412-08 icinga2: Multiple Vulnerabilities Multiple vulnerabilities have been discovered in Icinga2. Please review the CVE identifiers referenced below for details. Tenable has extracted the preceding description block directly...

PT-2024-9810

Name of the Vulnerable Software and Affected Versions: Apache Tomcat versions 9.0.0-M1 through 11.0.1 Description: The issue is a Time-of-check Time-of-use TOCTOU Race Condition vulnerability that can be exploited to bypass case sensitivity checks and execute arbitrary code. This can be done by...

PT-2024-13650 · Unknown · 360 Javascript Viewer

Name of the Vulnerable Software and Affected Versions: 360 Javascript Viewer versions 1.7.11 and earlier Description: The issue affects the 360 Javascript Viewer due to missing authorization, allowing exploitation of incorrectly configured access control security levels. Recommendations: For...

PT-2024-35929 · Analytify · Analytify

Name of the Vulnerable Software and Affected Versions: Analytify versions prior to 5.4.4 Description: The issue is related to the exposure of sensitive system information to an unauthorized control sphere. This could potentially allow unauthorized access to sensitive data. Recommendations: For...

PT-2024-36110 · Unknown · Rraddons For Elementor

Name of the Vulnerable Software and Affected Versions: RRAddons for Elementor versions 1.1.0 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS, which allows Stored XSS. This means that an attacker c...

PT-2024-9743

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 11.0.0-M1 through 11.0.1 Apache Tomcat versions 10.1.0-M1 through 10.1.33 Apache Tomcat versions 9.0.0.M1 through 9.0.97 Description The issue is related to an uncontrolled resource consumption vulnerability in the...

PT-2024-13989 · Unknown · Profilepress

Name of the Vulnerable Software and Affected Versions: ProfilePress versions n/a through 4.13.2 Description: The issue is related to a Missing Authorization vulnerability in ProfilePress Membership Team, allowing exploitation of incorrectly configured access control security levels...

PT-2024-13503 · Sonaar · Sonaar Music Mp3 Audio Player

Name of the Vulnerable Software and Affected Versions: Sonaar Music MP3 Audio Player for Music, Radio & Podcast by Sonaar versions n/a through 4.10 Description: The issue affects the Sonaar Music MP3 Audio Player for Music, Radio & Podcast by Sonaar due to a Missing Authorization vulnerability...

GLSA-202412-10 : Dnsmasq: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202412-10 Dnsmasq: Multiple Vulnerabilities Multiple vulnerabilities have been discovered in Dnsmasq. Please review the CVE identifiers referenced below for details. Tenable has extracted the preceding description block directly...

PT-2024-34365 · Digi · Digi Connectport Lts

Name of the Vulnerable Software and Affected Versions: Digi ConnectPort LTS versions prior to 1.4.12 Description: A vulnerability in the file upload handling of a web application allows manipulation of file paths via POST requests to API endpoints such as /file/upload. This can lead to arbitrary...

PT-2024-35753 · Wegia · Wegia

Name of the Vulnerable Software and Affected Versions: WeGIA versions 3.2.0 before 3998672 Description: The issue is related to a lack of permission verification when changing a password. This means that the software does not check if the user has the necessary permissions to change a password,...

PT-2024-9301 · WordPress · Wp Umbrella

Name of the Vulnerable Software and Affected Versions: WP Umbrella: Update Backup Restore & Monitoring plugin for WordPress versions up to, and including, 2.17.0 Description: The issue is related to Local File Inclusion, which makes it possible for unauthenticated attackers to include and execute...

PT-2024-16308 · WordPress · 3Dprint Lite

Name of the Vulnerable Software and Affected Versions: 3DPrint Lite WordPress plugin versions prior to 2.1 Description: The issue is related to a lack of CSRF check when updating settings in the 3DPrint Lite WordPress plugin. This could allow attackers to make a logged-in admin change settings vi...

PT-2024-39902 · WordPress · Online Booking & Scheduling Calendar For Wordpress

Name of the Vulnerable Software and Affected Versions: The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress versions up to, and including, 4.5.1 Description: The issue is related to a missing capability check on the vcita save user data callback function, allowing...

PT-2024-10121

Name of the Vulnerable Software and Affected Versions Python versions 3.12.0 through 3.12.x Python versions prior to 3.14.0a2 Description The issue is related to the asyncio. SelectorSocketTransport.writelines method, which does not properly "pause" writing and signal to the Protocol to drain the...

PT-2024-9986 · Acronis · Acronis Cyber Protect Cloud Agent

Name of the Vulnerable Software and Affected Versions: Acronis Cyber Protect Cloud Agent Linux before build 39185 Description: The issue is related to the use of a weak algorithm for signing RPM packages in the Acronis Cyber Protect Cloud Agent for Linux. This weakness can potentially allow an...