PT-2024-10368

Name of the Vulnerable Software and Affected Versions GStreamer versions prior to 1.24.10 Description The issue is related to a null pointer dereference vulnerability in the gst matroska demux add wvpk header function. This vulnerability can be exploited by a remote attacker to cause a denial of...

PT-2024-10160 · Http4K · Http4K

Name of the Vulnerable Software and Affected Versions: http4k versions prior to 5.41.0.0 Description: The issue is related to an XXE XML External Entity Injection vulnerability when http4k handles malicious XML contents within requests. This could allow attackers to read local sensitive informati...

PT-2025-13869

Name of the Vulnerable Software and Affected Versions: macOS Ventura versions prior to 13.7.5 macOS Sonoma versions prior to 14.7.5 Description: A permissions issue was addressed with additional sandbox restrictions. An app may be able to access sensitive user data. Recommendations: Update macOS ...

PT-2024-10476

Name of the Vulnerable Software and Affected Versions GStreamer versions prior to 1.24.10 Description The issue is related to an out-of-bounds read in the gst wavparse cue chunk function within gstwavparse.c. This occurs due to a discrepancy between the size of the data buffer and the size value...

PT-2024-36982

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.12.0-00982-gf2a4f1682d07 Description The issue is related to the vmemmap page table code in the Linux kernel for RV64 with SPARSEMEM VMEMMAP. The pmd allocation does not use the generic mechanism, resulting in...

[SECURITY] [DSA 5827-1] proftpd-dfsg security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5827-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso December 10, 2024 https://www.debian.org/security/faq -...

[SECURITY] [DSA 5826-1] smarty3 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5826-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff December 10, 2024 https://www.debian.org/security/faq -...

Security Advisory Ivanti Cloud Services Application (CSA) (CVE-2024-11639, CVE-2024-11772, CVE-2024-11773)

Summary Ivanti has released updates for Ivanti Cloud Services Application which addresses medium, high and critical vulnerabilities. We are not aware of any customers being exploited by these vulnerabilities at the time of disclosure. Vulnerability Details: CVE Number | Description | CVSS Score...

December 10, 2024—KB5048699 (Monthly Rollup)

None None...

Simulation of Wasmd message can cause crashing

CWA-2024-009 Severity Low Marginal + Likely^1 Affected versions: - wasmd 0.53.1 Patched versions: - wasmd 0.53.2 please note that wasmd 0.53.1 is broken and must not be used Description of the bug Blank for now. We'll add more detail once chains had a chance to upgrade. Mitigations Apart from...

PT-2024-34462 · Silicon · Silicon Labs 500 Series Z-Wave

Name of the Vulnerable Software and Affected Versions: Silicon Labs Z-Wave Series 500 version 6.84.0 Description: The issue is related to insecure permissions in the software. Recommendations: For version 6.84.0, consider updating the permissions configuration to a more secure setup, however, at...

PT-2024-35964

Name of the Vulnerable Software and Affected Versions: pnpm versions prior to 9.15.0 Description: The package manager pnpm seems to mishandle overrides and global cache. This can lead to overrides from one workspace leaking into npm metadata saved in the global cache, affecting other workspaces...

PT-2024-16481

Name of the Vulnerable Software and Affected Versions System Dashboard WordPress plugin versions prior to 2.8.15 Description The issue is related to the plugin not validating user input used in a path, which could allow high privilege users, such as admin, to perform path traversal attacks and re...

PT-2024-34391 · Tp Link · Tp-Link Tl-Wr845N

Name of the Vulnerable Software and Affected Versions: TP-Link TL-WR845NUN V4 versions 190219 through 201214 Description: The issue concerns weak default credentials for the Administrator account. This allows unauthorized access to the device. Recommendations: For TP-Link TL-WR845NUN V4 versions...

PT-2024-10222 · Document Foundation +5 · Libreoffice +5

Name of the Vulnerable Software and Affected Versions: LibreOffice versions 24.8 through 24.8.3 Description: The issue is related to an improper limitation of a pathname to a restricted directory, allowing absolute path traversal. An attacker can write to arbitrary locations, albeit suffixed with...

PT-2024-9948 · Adobe · Substance3D - Modeler

Name of the Vulnerable Software and Affected Versions: Substance3D - Modeler versions 1.14.1 and earlier Description: The issue is related to an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires...

PT-2025-3136

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.12.5 Description A potential deadlock issue has been identified in the Linux kernel's zone write plugging code. This issue occurs when a device queue freeze is initiated while BIOs are still plugged in a zone...

GHSA-6VX4-V2JW-QWQH Trix editor subject to XSS vulnerabilities on copy & paste

The Trix editor, in versions prior to 2.1.9 and 1.3.3, is vulnerable to XSS + mutation XSS attacks when pasting malicious code. Impact An attacker could trick a user to copy and paste malicious code that would execute arbitrary JavaScript code within the context of the user's session, potentially...

Trix editor subject to XSS vulnerabilities on copy & paste

The Trix editor, in versions prior to 2.1.9 and 1.3.3, is vulnerable to XSS + mutation XSS attacks when pasting malicious code. Impact An attacker could trick a user to copy and paste malicious code that would execute arbitrary JavaScript code within the context of the user's session, potentially...

CVE-2024-53847

The CVE-2024-53847 entry concerns the Trix rich text editor prior to 2.1.9 and 1.3.3, which is vulnerable to XSS and mutation XSS when pasting malicious code. The described impact is execution of arbitrary JavaScript in the user’s session, potentially enabling unauthorized actions or data disclos...