PT-2024-9586

Name of the Vulnerable Software and Affected Versions GStreamer versions prior to 1.24.10 Description A vulnerability has been detected in the format channel mask function in gst-discoverer.c, which can cause an out-of-bounds OOB read. This occurs when the gst discoverer audio info get channels...

PT-2024-9583 · Gstreamer +7 · Gstreamer +7

Name of the Vulnerable Software and Affected Versions: GStreamer versions prior to 1.24.10 Description: A null pointer dereference vulnerability has been discovered in the gst matroska demux update tracks function within matroska-demux.c. The vulnerability occurs when the gst caps is equal functi...

[SECURITY] [DLA 3904-1] cups security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3904-1 [email protected] https://www.debian.org/lts/security/ Thorsten Alteholz September 29, 2024 https://wiki.debian.org/LTS -...

PT-2024-39572 · Sourcecodester · Sourcecodester Inventory Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Inventory Management System version 1.0 Description: A vulnerability was found in the system, affecting an unknown functionality of the file /app/action/add staff.php. The manipulation leads to cross site scripting. The attack...

PT-2024-39570 · Sourcecodester · Sourcecodester Online Railway Reservation System

Name of the Vulnerable Software and Affected Versions: SourceCodester Online Railway Reservation System version 1.0 Description: A critical issue affects the processing of the file /admin/inquiries/view details.php, where the manipulation of the id argument leads to improper access controls. The...

PT-2024-39556 · E2Nest · E2Nest

Name of the Vulnerable Software and Affected Versions: E2Nest versions prior to commit 8a41948e553c89c56b14410c6ed395e9cfb9250a Description: A path traversal issue exists in the software. This issue allows for unauthorized access to files and directories. Recommendations: For versions prior to...

CVE-2024-47121

The goTenna Pro App uses a weak password for sharing encryption keys via the key broadcast method. If the broadcasted encryption key is captured over RF, and password is cracked via brute force attack, it is possible to decrypt it and use it to decrypt all future and past messages sent via...

[SECURITY] [DLA 3896-1] mediawiki security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3896-1 [email protected] https://www.debian.org/lts/security/ Adrian Bunk September 26, 2024 https://wiki.debian.org/LTS -...

PT-2024-6501

Name of the Vulnerable Software and Affected Versions cups versions prior to 2.4.11-alt1 cups-browsed versions prior to 2.0.1-0ubuntu2.1 cups-filters affected versions not specified Description The Common UNIX Printing System CUPS and related components, including cups-browsed and cups-filters, a...

PT-2024-9620

Name of the Vulnerable Software and Affected Versions GStreamer versions prior to 1.24.10 Description The issue is related to a null dereference vulnerability in the function qtdemux parse sbgp in qtdemux.c. This vulnerability can be exploited by a remote attacker to cause a denial of service...

PT-2024-9614 · Gstreamer +7 · Gstreamer +7

Name of the Vulnerable Software and Affected Versions: GStreamer versions prior to 1.24.10 Description: A vulnerability has been discovered in the qtdemux parse container function within qtdemux.c, related to an out-of-bounds OOB read in memory. The issue arises from the parent function qtdemux...

GHSA-M842-4QM8-7GPQ Gradio allows users to access arbitrary files

Impact This vulnerability allows users of Gradio applications that have a public link such as on Hugging Face Spaces to access files on the machine hosting the Gradio application. This involves intercepting and modifying the network requests made by the Gradio app to the server. Patches Yes, the...

The FIPS Compliance of HKDF

HKDF is an HMAC-based key-derivation function specified in RFC 5869. It’s nice and we generally like using it. FIPS Federal Information Processing Standards is used generally as a moniker for the set of standards, recommendations, and guidance published by the U.S. National Institute of Standards...

PT-2024-29029 · Apache · Apache Answer

Name of the Vulnerable Software and Affected Versions: Apache Answer versions through 1.3.5 Description: The issue is related to inadequate encryption strength, where the MD5 value of a user's email is used to access Gravatar, leading to potential leakage of user email. The official recommendatio...

PT-2024-6648

Name of the Vulnerable Software and Affected Versions NVIDIA Container Toolkit versions 1.16.1 and earlier Description The NVIDIA Container Toolkit contains a Time-of-check Time-of-Use TOCTOU vulnerability when used with default configuration, allowing a specifically crafted container image to ga...

PT-2024-32396 · Django +1 · Django +1

Name of the Vulnerable Software and Affected Versions: Strawberry GraphQL versions prior to 0.243.0 Description: The issue concerns Strawberry GraphQL, a library for creating GraphQL APIs. Prior to version 0.243.0, multipart file upload support was enabled by default in all Strawberry HTTP view...

PT-2024-19600 · Unknown · Openslides

Name of the Vulnerable Software and Affected Versions: OpenSlides version 4.0.15 Description: The issue is related to the use of a weak hashing algorithm for storing passwords. Recommendations: For OpenSlides version 4.0.15, update to a version that uses a secure password hashing algorithm to...

PT-2024-10158

Name of the Vulnerable Software and Affected Versions GStreamer versions prior to 1.24.10 Description A stack-buffer overflow has been detected in the vorbis handle identification packet function within gstvorbisdec.c. The position array is a stack-allocated buffer of size 64. If vd-vi.channels...

PT-2024-32073 · Icecms · Icecms

Name of the Vulnerable Software and Affected Versions: IceCMS versions 3.4.7 and earlier Description: An access control issue in the CheckVip function in UserController.java of IceCMS allows unauthenticated attackers to access and return all user information, including passwords. Recommendations:...

PT-2024-38932 · Opw Fuel Management Systems · Sitesentinel

Name of the Vulnerable Software and Affected Versions: OPW Fuel Management Systems SiteSentinel versions prior to 17Q2.1 Description: The issue allows an attacker to bypass authentication to the server and obtain full admin privileges. This could enable remote attacks. Recommendations: For OPW Fu...