CVE-2024-53677

A flaw was found in Apache Struts. Affected versions of this package are vulnerable to remote code execution RCE via manipulation of the file upload mechanism that enables path traversal. Under certain conditions, uploading a malicious file is possible and may then be executed on the server...

Exploit for Unrestricted Upload of File with Dangerous Type in Apache Struts

s2-067-CVE-2024-53677 s2-067CVE-2024-53677 Summary File uplo...

PT-2024-16371 · WordPress · Ajax Search Lite

Name of the Vulnerable Software and Affected Versions: Ajax Search Lite WordPress plugin versions prior to 4.12.4 Description: The issue concerns the Ajax Search Lite WordPress plugin, where versions prior to 4.12.4 do not properly sanitize and escape some of its settings. This could allow...

PT-2024-17464 · WordPress · Video & Photo Gallery For Ultimate Member

Name of the Vulnerable Software and Affected Versions: Video & Photo Gallery for Ultimate Member plugin for WordPress versions up to, and including, 1.1.1 Description: The issue is related to Reflected Cross-Site Scripting via the page parameter due to insufficient input sanitization and output...

Medium: apr

Issue Overview: Lax permissions set by the Apache Portable Runtime library on Unix platforms would allow local users read access to named shared memory segments, potentially revealing sensitive application data. This issue does not affect non-Unix platforms, or builds with APRUSESHMEMSHMGET=1 apr...

PT-2024-36600

Name of the Vulnerable Software and Affected Versions beego versions prior to 2.3.4 Description The issue concerns the use of MD5 as a hashing algorithm in beego, which is no longer considered secure due to its vulnerability to collision attacks. This vulnerability can lead to data integrity risk...

PT-2025-3021

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.12.0-rc6+ Description A circular locking dependency warning has been detected in the Linux kernel's Bluetooth module. This issue occurs when the iso sock recvmsg function is called, which can lead to a deadlock...

PT-2024-9985 · Autodesk · Autodesk Navisworks Manage +2

Name of the Vulnerable Software and Affected Versions: Autodesk Navisworks Freedom affected versions not specified Autodesk Navisworks Simulate affected versions not specified Autodesk Navisworks Manage affected versions not specified Description: The issue is related to an Out-of-Bounds Write...

PT-2024-16424 · Kadence Wp · Gutenberg Blocks With Ai

Name of the Vulnerable Software and Affected Versions: Gutenberg Blocks with AI by Kadence WP versions prior to 3.2.54 Description: The issue concerns insufficient validation and escaping of block options, which could allow users with the contributor role and above to perform Stored Cross-Site...

PT-2024-17545 · WordPress · Essential Real Estate

Name of the Vulnerable Software and Affected Versions: Essential Real Estate plugin for WordPress versions up to and including 5.1.6 Description: The issue is related to a missing capability check on several pages and post types, allowing authenticated attackers with Contributor-level access and...

PT-2024-16336 · WordPress · Paid Membership Plugin

Name of the Vulnerable Software and Affected Versions: Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin versions prior to 4.15.15 Description: The issue concerns the Paid Membership Plugin's failure to sanitise and escape some...

PT-2024-17213 · WordPress · Cookie Consent For Wp

Name of the Vulnerable Software and Affected Versions: Cookie Consent for WP – Cookie Consent, Consent Log, Cookie Scanner, Script Blocker for GDPR, CCPA & ePrivacy plugin for WordPress versions up to, and including, 3.6.5 Description: The issue concerns unauthorized modification of data due to a...

GitLab 13.7 < 17.4.6 / 17.5 < 17.5.4 / 17.6 < 17.6.2 (CVE-2024-12570)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - Privilege Context Switching Error in GitLab CVE-2024-12570 Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL...

EulerOS 2.0 SP12 : httpd (EulerOS-SA-2024-2952)

According to the versions of the httpd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A partial fix for CVE-2024-39884 in the core of Apache HTTP Server 2.4.61 ignores some use of the legacy content-type based configuration of...

CVE-2024-53677 Apache Struts: Mixing setters for uploaded files and normal fields can allow bypass file upload checks

File upload logic in Apache Struts is flawed. An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. This issue affects Apache Struts: from 2.0.0 before...

CVE-2024-53677 Apache Struts: Mixing setters for uploaded files and normal fields can allow bypass file upload checks

File upload logic in Apache Struts is flawed. An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. This issue affects Apache Struts: from 2.0.0 before...

BIT-SUBVERSION-2024-46901 Apache Subversion: mod_dav_svn denial-of-service via control characters in paths

Insufficient validation of filenames against control characters in Apache Subversion repositories served via moddavsvn allows authenticated users with commit access to commit a corrupted revision, leading to disruption for users of the repository. All versions of Subversion up to and including...

PT-2024-10365

Name of the Vulnerable Software and Affected Versions GStreamer versions prior to 1.24.10 Description A null pointer dereference vulnerability has been discovered in the gst matroska demux parse blockgroup or simpleblock function within matroska-demux.c. This function does not properly check the...

PT-2024-36982

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.12.0-00982-gf2a4f1682d07 Description The issue is related to the vmemmap page table code in the Linux kernel for RV64 with SPARSEMEM VMEMMAP. The pmd allocation does not use the generic mechanism, resulting in...

PT-2024-10476

Name of the Vulnerable Software and Affected Versions GStreamer versions prior to 1.24.10 Description The issue is related to an out-of-bounds read in the gst wavparse cue chunk function within gstwavparse.c. This occurs due to a discrepancy between the size of the data buffer and the size value...