PT-2024-34564 · Os4Ed · Opensis Classic

Name of the Vulnerable Software and Affected Versions: OS4ED openSIS-Classic version 9.1 Description: A SQL injection issue exists due to improper input validation of the username stn id parameter in the resetuserinfo.php file, allowing an attacker to inject arbitrary SQL commands. Recommendation...

PT-2024-32983 · Sunniwell · Sunniwell Ht3300

Name of the Vulnerable Software and Affected Versions: sunniwell HT3300 versions before 1.0.0.B022.2 Description: The issue concerns insecure permissions in the sunniwell HT3300 device, specifically with the /usr/local/bin/update program, which is used for software updates and has the execution...

PT-2024-9413

Name of the Vulnerable Software and Affected Versions: curl versions 6.5 through 8.11.0 Description: The issue arises when curl is used with a .netrc file for credentials and follows HTTP redirects. Under certain circumstances, curl could leak the password used for the first host to the followed-...

EulerOS 2.0 SP10 : ruby (EulerOS-SA-2024-2914)

According to the versions of the ruby packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : REXML is an XML toolkit for Ruby.The REXML gem 3.3.2 has a DoS vulnerability when it parses an XML that has many entity expansions with SAX2 or pull...

PT-2024-26491 · Vmir · Vmir

Name of the Vulnerable Software and Affected Versions: vmir version e8117 Description: A heap buffer overflow issue was discovered in vmir via the wasm call function at /src/vmir wasm parser.c. This issue occurs due to a problem in the wasm call function, which can lead to a heap buffer overflow...

PT-2024-16693 · Unknown · Codeastro Real Estate Management System

Name of the Vulnerable Software and Affected Versions: CodeAstro Real Estate Management System version 1.0 Description: A problematic vulnerability was found in the CodeAstro Real Estate Management System. The issue affects an unknown functionality of the file /aboutedit.php of the component Abou...

[SECURITY] [DSA 5804-1] webkit2gtk security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5804-1 [email protected] https://www.debian.org/security/ Alberto Garcia November 07, 2024 https://www.debian.org/security/faq -...

PT-2025-17312

Name of the Vulnerable Software and Affected Versions PyTorch versions prior to 2.6.0 PyTorch ≤2.5.1 Description PyTorch is vulnerable to a Remote Command Execution RCE vulnerability. This flaw exists in versions 2.5.1 and prior, specifically when loading a model using the torch.load function wit...

PT-2024-33072 · Realtek · Realtek Rtl8762E Ble Sdk

Name of the Vulnerable Software and Affected Versions: Realtek RTL8762E BLE SDK version 1.4.0 Description: The issue is related to the Bluetooth Low Energy implementation of the Realtek RTL8762E BLE SDK, which allows attackers to cause a Denial of Service DoS by supplying a crafted ll terminate i...

[SECURITY] [DLA 3946-1] context bugfix update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3946-1 [email protected] https://www.debian.org/lts/security/ Bastien Roucariès November 05, 2024 https://wiki.debian.org/LTS -...

CVE-2024-51745 Wasmtime doesn't fully sandbox all the Windows device filenames

Wasmtime is a fast and secure runtime for WebAssembly. Wasmtime's filesystem sandbox implementation on Windows blocks access to special device filenames such as "COM1", "COM2", "LPT0", "LPT1", and so on, however it did not block access to the special device filenames which use superscript digits,...

CVE-2024-10443

creationtimestamp| type| source ---|---|--- 2024-11-05 09:34:00+00:00| seen| https://thehackernews.com/2024/11/synology-urges-patch-for-critical-zero.html 2024-11-05 10:37:25+00:00| seen| https://t.me/thehackernews/5832 2024-11-05 15:11:45+00:00| published-proof-of-concept|...

Debian dsa-5803 : thunderbird - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5803 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-5803-1 [email protected] https://www.debian.org/securit...

PT-2024-33518 · Samsung · Samsung Flow

Name of the Vulnerable Software and Affected Versions: Samsung Flow versions prior to 4.9.15.7 Description: The issue is related to improper access control, allowing physical attackers to access data across multiple user profiles. Recommendations: For versions prior to 4.9.15.7, update to version...

PT-2024-34616 · Jatos · Jatos

Name of the Vulnerable Software and Affected Versions: JATOS version 3.9.3 Description: A Cross-Site Request Forgery CSRF issue allows attackers to perform actions reserved for administrators, including creating admin accounts. This flaw can lead to unauthorized activities, compromising the...

PT-2024-74: Incorrect session termination in Password Pusher

The vulnerability was identified in Password Pusher versions prior to 1.48.0. The application incorrectly terminates the session and allows attacker to reuse session credentials to obtain user information. Vulnerability status: Confirmed by vendor Date of vulnerability remediation: 04.11.2024...

PT-2024-16238 · Unknown +1 · Safearchive +1

Name of the Vulnerable Software and Affected Versions: Safearchive versions prior to commit f7ce9d7b6f9c6ecd72d0b0f16216b046e55e44dc Description: The issue is related to a Path Traversal vulnerability in Safearchive on platforms with case-insensitive filesystems, such as NTFS. This vulnerability...

PT-2024-73: Unlimited session lifetime in Password Pusher

The vulnerability was identified in Password Pusher versions prior to 1.48.0. The application does not limit the storage time of the session identifier or credentials, or this time is excessively long. An attacker can reuse old credentials or session identifiers to log in as another user and gain...

Certain Poly Video Conference Devices – Potential Remote Code Execution

A potential vulnerability was discovered in certain Poly video conferencing devices. The firmware flaw does not properly sanitize user input. The exploitation of this vulnerability is dependent on a layered attack and cannot be exploited by itself. The recommendation is to update an impacted devi...

PT-2024-39003 · WordPress +1 · Pagelayer

Name of the Vulnerable Software and Affected Versions: Page Builder: Pagelayer versions prior to 1.8.8 Description: The issue concerns the Page Builder: Pagelayer WordPress plugin, where versions prior to 1.8.8 do not properly sanitise and escape some of its settings. This could allow high...