[SECURITY] [DSA 5717-1] php8.2 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5717-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff June 20, 2024 https://www.debian.org/security/faq -...

PT-2024-5043

Name of the Vulnerable Software and Affected Versions: TinyMCE versions prior to 5.11.0 LTS TinyMCE versions prior to 6.8.4 TinyMCE versions prior to 7.2.0 Description: A cross-site scripting XSS vulnerability was discovered in TinyMCE’s content extraction code. When using the noneditable regexp...

PT-2024-12566 · Thimpress · Learnpress

Name of the Vulnerable Software and Affected Versions: ThimPress LearnPress versions 4.2.3 and earlier Description: The issue is related to a Missing Authorization vulnerability in ThimPress LearnPress. This vulnerability affects LearnPress versions from n/a through 4.2.3. Recommendations: For...

PT-2024-5497

Name of the Vulnerable Software and Affected Versions Roundcube versions prior to 1.5.8 Roundcube versions 1.6.x through 1.6.7 Description A Cross-Site Scripting XSS issue exists in Roundcube Webmail due to improper sanitization in the message body function within the program/actions/mail/show.ph...

PT-2024-27680 · Xinhu · Rockoa

Name of the Vulnerable Software and Affected Versions: Xinhu RockOA version 2.6.3 Description: A reflected cross-site scripting XSS issue was found in the /kaoqin/tpl kaoqin locationchange.html component. Recommendations: For version 2.6.3, consider disabling access to the /kaoqin/tpl kaoqin...

PT-2024-27979 · Iterm2 · Iterm2

Name of the Vulnerable Software and Affected Versions: iTerm2 versions prior to 3.5.2 Description: The issue arises because the "Terminal may report window title" setting is not honored, potentially leading to remote code execution, although it is noted that exploitation is not trivial...

PT-2024-28013 · Xenforo · Xenforo

Name of the Vulnerable Software and Affected Versions: Xenforo versions prior to 2.2.16 Description: The issue allows for CSRF, which is a type of attack that tricks a user into performing unintended actions on a web application. Recommendations: For versions prior to 2.2.16, update to version...

PT-2024-28016 · Sonarqube · Sonarqube

Name of the Vulnerable Software and Affected Versions: SonarQube versions prior to 10.4 SonarQube version 9.9.4 LTA and earlier Description: The issue concerns the potential exposure of encrypted values in cleartext as part of URL parameters in logs, such as SonarQube Access Logs and Proxy Logs...

CVE-2024-34451

Ghost through 5.85.1 allows remote attackers to bypass an authentication rate-limit protection mechanism by using many X-Forwarded-For headers with different values. NOTE: the vendor's position is that Ghost should be installed with a reverse proxy that allows only trusted X-Forwarded-For headers...

PT-2024-37309 · Zkteco · Zkbio Cvsecurity V5000

Name of the Vulnerable Software and Affected Versions: ZKTeco ZKBio CVSecurity V5000 version 4.1.0 Description: A vulnerability was found in the component Summer Schedule Handler. The manipulation of the Schedule Name argument leads to cross-site scripting. The attack may be launched remotely. Th...

PT-2024-34698 · WordPress · Inquiry Cart Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Inquiry cart WordPress plugin versions 3.4.2 and earlier Description: The issue concerns the lack of CSRF checks in some areas of the plugin, as well as missing sanitization and escaping. This could allow attackers to make logged-in admins ad...

PT-2024-18843

Name of the Vulnerable Software and Affected Versions FooGallery plugin for WordPress versions up to and including 2.4.15 Description The issue is related to Stored Cross-Site Scripting via album gallery custom URLs due to insufficient input sanitization and output escaping. This allows...

PT-2024-25223 · Lb Link · Lb-Link Bl-W1210M

Name of the Vulnerable Software and Affected Versions: LB-LINK BL-W1210M version 2.0 Description: A clickjacking issue was discovered via the Administrator login page. Attackers can cause victim users to perform arbitrary operations by interacting with crafted elements on the web page...

PT-2024-4257 · Apache · Apache Airflow

Name of the Vulnerable Software and Affected Versions: Apache Airflow versions prior to 2.9.2 Description: The issue is related to the use of web browser cache containing sensitive information in Apache Airflow. Airflow did not return a "Cache-Control" header for dynamic content, which could resu...

PT-2024-25222 · Lb Link · Lb-Link Bl-W1210M

Name of the Vulnerable Software and Affected Versions: LB-LINK BL-W1210M version 2.0 Description: The issue concerns the storage of user credentials in plaintext within the router's firmware. This means that sensitive information, such as usernames and passwords, is not encrypted and can be easil...

PT-2024-9096

Name of the Vulnerable Software and Affected Versions: Apache Arrow R package versions 4.0.0 through 16.1.0 Description: The issue is related to the deserialization of untrusted data in IPC and Parquet readers, which allows arbitrary code execution. An application is vulnerable if it reads Arrow...

PT-2024-33377 · Unknown · Social Sharing Plugin

Name of the Vulnerable Software and Affected Versions: The Social Sharing Plugin versions prior to 3.3.63 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for example, in a...

PT-2024-5656 · Palo Alto Networks · Palo Alto Networks Expedition

Name of the Vulnerable Software and Affected Versions: Palo Alto Networks Expedition versions prior to 1.2.92 Description: The vulnerability is related to a missing authentication mechanism for a critical function in Palo Alto Networks Expedition, allowing an attacker with network access to take...

PT-2024-14497 · Unknown · Post Smtp Mailer/Email Log

Name of the Vulnerable Software and Affected Versions: Post SMTP Mailer/Email Log versions n/a through 2.8.6 Description: The issue is related to a Missing Authorization vulnerability in Post SMTP Post SMTP Mailer/Email Log. Recommendations: For Post SMTP Mailer/Email Log versions n/a through...

PT-2024-4227 · Adobe · Framemaker Publishing Server

Name of the Vulnerable Software and Affected Versions: Adobe Framemaker Publishing Server versions 2020.3, 2022.2 and earlier Description: The issue is related to an Improper Authentication vulnerability that could result in privilege escalation. An attacker could exploit this vulnerability to ga...