PT-2024-31748

Name of the Vulnerable Software and Affected Versions: tgt versions prior to 1.0.93 Description: The issue is related to the Linux target framework tgt attempting to generate random numbers by using rand without srand, resulting in a predictable PRNG seed. This causes the sequence of challenges t...

[SECURITY] [DLA 3872-1] glance security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3872-1 [email protected] https://www.debian.org/lts/security/ Thomas Goirand September 05, 2024 https://wiki.debian.org/LTS -...

PT-2024-31674 · Zimbra · Zimbra Daffodil

Name of the Vulnerable Software and Affected Versions: Zimbra Daffodil version 10.1.1 Description: A Cross-Site Scripting XSS issue was resolved due to inadequate validation of metadata's Content-Type when importing files into the briefcase. Recommendations: For Zimbra Daffodil version 10.1.1,...

PT-2024-37900 · WordPress · Chatbot With Chatgpt Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Chatbot with ChatGPT WordPress plugin versions prior to 2.4.5 Description: The issue concerns improper access controls in the REST Route Handler of the Chatbot with ChatGPT WordPress plugin. This allows an unauthenticated user to purge error...

PT-2024-6316 · Veeam · Veeam One

Name of the Vulnerable Software and Affected Versions: Veeam ONE affected versions not specified Description: An improper access control issue allows low-privileged users to execute code with Administrator privileges remotely. This vulnerability is related to deficiencies in access control in the...

CVE-2024-45195

Direct Request ‘Forced Browsing’ vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.16. Users are recommended to upgrade to version 18.12.16, which fixes the issue. Recent assessments: remmons-r7 at September 25, 2024 3:32pm UTC reported: Apache OFBiz is an open-source...

[SECURITY] [DSA 5764-1] openssl security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5764-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso September 03, 2024 https://www.debian.org/security/faq -...

[SECURITY] [DLA 3866-1] ruby-tzinfo security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3866-1 [email protected] https://www.debian.org/lts/security/ Adrian Bunk September 03, 2024 https://wiki.debian.org/LTS -...

PT-2024-29396 · Yugabyte · Yugabytedb

Name of the Vulnerable Software and Affected Versions: YugabyteDB version 2.21.1.0 Description: A buffer overflow issue was discovered in YugabyteDB via the insert into parameter. Recommendations: For YugabyteDB version 2.21.1.0, consider restricting the use of the insert into parameter until a...

PT-2024-29397 · Unknown +1 · Clickhouse +1

Name of the Vulnerable Software and Affected Versions: ClickHouse version 24.3.3.102 Description: A buffer overflow issue was discovered in ClickHouse via the component DB::evaluateConstantExpressionImpl. Recommendations: For ClickHouse version 24.3.3.102, consider disabling the...

PT-2025-18104 · Docker · Docker Desktop

Name of the Vulnerable Software and Affected Versions: Docker Desktop versions prior to 4.41.0 Description: A vulnerability in the update process of Docker Desktop for Windows could allow a local, low-privileged attacker to escalate privileges to SYSTEM. During an update, Docker Desktop attempts ...

PT-2024-30196 · Unknown · Limesurvey

Name of the Vulnerable Software and Affected Versions: LimeSurvey versions 6.6.2 and earlier Description: An issue in the js localize.php function allows attackers to execute arbitrary code via injecting a crafted payload into the lng parameter of the js localize.php function. This issue enables...

PT-2024-5901 · Yandex +1 · Yandex Browser +1

Name of the Vulnerable Software and Affected Versions: Yandex Browser for Desktop versions prior to 24.7.1.380 Description: The issue is related to the use of an untrusted search path, which can lead to a DLL Hijacking Vulnerability. This vulnerability allows an attacker to execute arbitrary code...

PT-2024-26075 · Unknown · Universalcredentialmanager

Name of the Vulnerable Software and Affected Versions: UniversalCredentialManager versions prior to SMR Sep-2024 Release 1 Description: The issue is related to the incorrect use of privileged API in UniversalCredentialManager, allowing local attackers to access privileged API related to...

PT-2024-31559 · Vim +5 · Vim +5

Name of the Vulnerable Software and Affected Versions: Vim versions prior to 9.1.0707 Description: Vim is an open source, command line text editor. A change in how the cursor position is calculated, made in patch v9.1.0038, removed a loop that verified the cursor position always points inside a...

`instant` is unmaintained

This crate is no longer maintained, and the author recommends using the maintained web-time crate instead. web-time: https://crates.io/crates/web-time...

PT-2024-10389 · Zimbra · Zimbra Collaboration Suite

Name of the Vulnerable Software and Affected Versions: Zimbra Collaboration Suite ZCS versions through 10.1 Description: The issue exists due to inadequate protection of the web page structure in the Briefcase Module of the Zimbra Collaboration Suite ZCS. An attacker can exploit this by creating ...

PT-2024-22582 · Wolfssl +1 · Wolfssl +1

Name of the Vulnerable Software and Affected Versions: WolfSSL versions 5.6.6 and earlier Description: The issue is related to a Fault Injection vulnerability in the wc ed25519 sign msg function in WolfSSL, which affects the ed25519 key structure. This vulnerability allows a remote attacker...

PT-2024-38334 · WordPress · The Post Grid

Name of the Vulnerable Software and Affected Versions: The Post Grid – Shortcode, Gutenberg Blocks and Elementor Addon for Post Grid plugin for WordPress versions up to, and including, 7.7.11 Description: The issue allows authenticated attackers with contributor-level access and above to extract...

PT-2024-5934 · Totolink · Totolink Ac1200 Wireless Router

Name of the Vulnerable Software and Affected Versions: TOTOLINK AC1200 Wireless Router A3002RU version V2.1.1-B20230720.1011 Description: The issue concerns a buffer overflow vulnerability related to the formWlEncrypt CGI handler in the boa program. This handler fails to limit the length of the...