BIT-HYPERLEDGER-FABRIC-PEER-2022-31121 Improper Input Validation in fabric hyperledger

Hyperledger Fabric is a permissioned distributed ledger framework. In affected versions if a consensus client sends a malformed consensus request to an orderer it may crash the orderer node. A fix has been added in commit 0f1835949 which checks for missing consensus messages and returns an error ...

[SECURITY] [DSA 5732-1] chromium security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5732-1 [email protected] https://www.debian.org/security/ Andres Salomon July 18, 2024 https://www.debian.org/security/faq -...

PT-2025-29113

Name of the Vulnerable Software and Affected Versions: Apache HTTP Server versions prior to 2.4.64 Description: An issue exists in the core of Apache HTTP Server that allows an attacker who can manipulate the Content-Type response headers of applications hosted or proxied by the server to split t...

PT-2024-4769 · Apache · Apache Airflow

Name of the Vulnerable Software and Affected Versions: Apache Airflow versions 2.4.0 through 2.9.3 Description: This vulnerability allows authenticated DAG authors to craft a malicious doc md parameter, potentially leading to arbitrary code execution within the scheduler context. This bypasses...

CVE-2024-39887 Apache Superset: Improper SQL authorisation, parse not checking for specific engine functions

An SQL Injection vulnerability in Apache Superset exists due to improper neutralization of special elements used in SQL commands. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. To mitigate this, a new...

PT-2024-4993 · Oracle · Oracle Database Server

Name of the Vulnerable Software and Affected Versions: Oracle Database Server versions 19.3 through 19.23 Description: The issue is related to insufficient input validation in the Oracle Database Core component. This allows a high-privileged attacker with SYSDBA privilege and logon access to the...

PT-2024-4994 · Oracle · Peoplesoft Enterprise Hcm Shared Components

Name of the Vulnerable Software and Affected Versions: PeopleSoft Enterprise HCM Shared Components version 9.2 Description: The issue is related to insufficient input validation in the Text Catalog component of PeopleSoft Enterprise HCM Shared Components. This easily exploitable vulnerability...

PT-2024-28843 · Unknown · Spark Mall B2C Mall

Name of the Vulnerable Software and Affected Versions: Spark Mall B2C Mall versions 1.1.6 and earlier Description: The issue allows a remote attacker to execute arbitrary code. This is achieved via the controller/common.php component. Recommendations: For Spark Mall B2C Mall versions 1.1.6 and...

PT-2024-5083

Name of the Vulnerable Software and Affected Versions: Oracle Java SE versions 8u411, 8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0.1 Oracle GraalVM for JDK versions 17.0.11, 21.0.3, 22.0.1 Oracle GraalVM Enterprise Edition versions 20.3.14, 21.3.10 Description: The vulnerability in the Oracle Java...

PT-2024-5103

Name of the Vulnerable Software and Affected Versions: Apache Superset versions prior to 4.0.2 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in SQL commands. Specifically, certain engine-specific functions are not...

PT-2024-5599

Name of the Vulnerable Software and Affected Versions Oracle Java SE versions 8u411, 8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0.1 Oracle GraalVM for JDK versions 17.0.11, 21.0.3, 22.0.1 Oracle GraalVM Enterprise Edition versions 20.3.14, 21.3.10 Description A difficult to exploit vulnerability in...

PT-2024-28892 · Tenda · Tenda Ax2Pro

Name of the Vulnerable Software and Affected Versions: Tenda AX2pro version V16.03.29.48 cn Description: The issue allows a remote attacker to execute arbitrary code via the Routing functionality. Recommendations: For Tenda AX2pro version V16.03.29.48 cn, consider disabling the Routing...

PT-2024-28919 · Unknown · Tmall Demo

Name of the Vulnerable Software and Affected Versions: Tmall demo version 2024.07.03 Description: The issue is related to an access control problem, which enables attackers to gain access to sensitive information. Recommendations: For Tmall demo version 2024.07.03, at the moment, there is no...

PT-2024-28952 · Unknown +1 · Openimageio +1

Name of the Vulnerable Software and Affected Versions: OpenImageIO versions prior to 2.5.13.1 Description: The issue is related to a bug in the heif input functionality of OpenImageIO, specifically in the HeifInput::seek subimage function. This bug can lead to an information disclosure issue,...

PT-2024-28918 · Unknown · Tmall Demo

Name of the Vulnerable Software and Affected Versions: Tmall demo version 2024.07.03 Description: The issue allows for an arbitrary file upload through the uploadUserHeadImage component. Recommendations: For Tmall demo version 2024.07.03, consider disabling the uploadUserHeadImage component until...

PT-2024-5237

Name of the Vulnerable Software and Affected Versions: pypa/setuptools versions up to 69.1.1 Description: A vulnerability in the package index module of pypa/setuptools allows for remote code execution via its download functions. These functions, which are used to download packages from URLs...

PT-2024-28566 · WordPress · Giveaways/Contests By Rafflepress

Name of the Vulnerable Software and Affected Versions: Giveaways and Contests by RafflePress WordPress plugin versions prior to 1.12.14 Description: The issue concerns a lack of sanitization and escaping of certain parameters, potentially allowing users with a role as low as editor to perform...

PT-2024-35451 · Unknown · Wp-Affiliate-Platform

Name of the Vulnerable Software and Affected Versions: wp-affiliate-platform versions prior to 6.5.1 Description: The issue concerns a lack of CSRF check and missing sanitization as well as escaping in certain areas, potentially allowing attackers to execute an XSS payload via a CSRF attack on...

PT-2024-35458 · Unknown · Wp-Affiliate-Platform

Name of the Vulnerable Software and Affected Versions: wp-affiliate-platform versions prior to 6.5.1 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back in the page. This cou...

PT-2024-36777 · WordPress · Tournamatch

Name of the Vulnerable Software and Affected Versions: Tournamatch WordPress plugin versions prior to 4.6.1 Description: The issue allows users with a role as low as subscriber to perform Cross-Site Scripting attacks due to the plugin's failure to sanitise and escape some parameters...