PT-2024-24034 · Unknown · Popup Like Box

Name of the Vulnerable Software and Affected Versions: Popup Like box versions 3.7.2 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for stored cross-site scripting XSS. This means that an attacker can inject malicious...

UBUNTU-CVE-2024-31309

HTTP/2 CONTINUATION DoS attack can cause Apache Traffic Server to consume more resources on the server. Version from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.3 are affected. Users can set a new setting proxy.config.http2.maxcontinuationframesperminute to limit the number of CONTINUATION frames...

PT-2024-4390

Name of the Vulnerable Software and Affected Versions: QEMU affected versions not specified Description: A flaw was found in QEMU, related to an assertion failure in the update sctp checksum function when calculating the checksum of a short-sized fragmented packet. This issue allows a malicious...

PT-2024-23889 · Unknown · Fg Drupal To Wordpress

Name of the Vulnerable Software and Affected Versions: FG Drupal to WordPress versions 3.70.3 and earlier Description: The issue is related to the insertion of sensitive information into log files. This could potentially expose sensitive data. Recommendations: For FG Drupal to WordPress versions...

PT-2024-18922 · Mysql2 · Mysql2

Name of the Vulnerable Software and Affected Versions: mysql2 versions prior to 3.9.3 Description: The issue is related to Improper Input Validation through the keyFromFields function, resulting in cache poisoning. An attacker can inject a colon : character within a value of the attacker-crafted...

PT-2024-3833

Name of the Vulnerable Software and Affected Versions python-idna version 3.6 Description The issue arises from the idna.encode function's handling of crafted input strings, which can lead to quadratic complexity and consequently, a denial of service condition. This is triggered by a crafted inpu...

PT-2024-20044 · S/Notify · S/Notify

Name of the Vulnerable Software and Affected Versions: S/Notify versions prior to 4.0.0 for Confluence Description: A Cross Site Scripting XSS issue exists in the S/MIME certificate upload functionality of the User Profile pages, allowing attackers to manipulate user data via specially crafted...

PT-2024-3594 · Quay · Quay

Name of the Vulnerable Software and Affected Versions: Quay affected versions not specified Description: The issue is related to the storage of critical information in plain text, which can be exploited by a remote attacker to create session cookies and gain unauthorized access to the affected Qu...

System Management Module (SMM v1 and v2) and Fan Power Controller (FPC) Vulnerabilities - Lenovo Support US

No description provided...

CVE-2024-22423

yt-dlp is a youtube-dl fork with additional features and fixes. The patch that addressed CVE-2023-40581 attempted to prevent RCE when using --exec with %q by replacing double quotes with two double quotes. However, this escaping is not sufficient, and still allows expansion of environment...

Injection com.fasterxml.jackson.core:jackson-databind Dependency in Crowd Data Center and Server

This High severity com.fasterxml.jackson.core:jackson-databind Dependency vulnerability was introduced in versions 5.0.0, 5.1.0, and 5.2.0 of Crowd Data Center and Server. This com.fasterxml.jackson.core:jackson-databind Dependency vulnerability, with a CVSS Score of 8.1 and a CVSS Vector of...

PT-2024-21772 · Zoom · Zoom Desktop Client For Linux

Name of the Vulnerable Software and Affected Versions: Zoom Desktop Client for Linux versions prior to 5.17.10 Description: The issue allows an authenticated user to conduct a denial of service via network access. This is due to cross-site scripting in the Zoom Desktop Client for Linux...

PT-2024-21773 · Zoom · Zoom Desktop Client For Macos

Name of the Vulnerable Software and Affected Versions: Zoom Desktop Client for macOS versions prior to 5.17.10 Description: The issue is related to improper privilege management in the installer, which may allow a privileged user to conduct an escalation of privilege via local access...

PT-2024-20321 · WordPress · Userswp

Name of the Vulnerable Software and Affected Versions: UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress versions up to, and including, 1.2.6 Description: The issue arises from insufficient input sanitization and output escaping on...

PT-2024-20323 · Canimaan Software · Clamav

Name of the Vulnerable Software and Affected Versions: Canimaan Software LTD ClamXAV versions 3.1.2 through 3.6.1 Description: An issue in Canimaan Software LTD ClamXAV allows a local attacker to escalate privileges via the ClamXAV helper tool component. Recommendations: For versions 3.1.2 throug...

PT-2024-23577 · Unknown · Ros2 Galactic Geochelone

Name of the Vulnerable Software and Affected Versions: ROS2 Galactic Geochelone versions 2 Description: A buffer overflow issue has been found in the C++ components, allowing attackers to execute arbitrary code or cause a denial of service DoS via improper handling of arrays or strings...

PT-2024-15149 · WordPress · The Pods – Custom Content Types/Fields

Name of the Vulnerable Software and Affected Versions: The Pods – Custom Content Types and Fields plugin for WordPress versions prior to 3.0.11, excluding versions 2.7.31.2, 2.8.23.2, and 2.9.19.2 Description: The issue arises from insufficient escaping on the user supplied parameter and lack of...

PT-2024-24254 · Apache · Apache Zeppelin

Name of the Vulnerable Software and Affected Versions: Apache Zeppelin versions 0.8.2 through 0.11.0 Description: The issue is related to improper encoding or escaping of output, allowing attackers to execute shell scripts or malicious code by overriding configuration like ZEPPELIN INTP CLASSPATH...

PT-2024-24253 · Apache · Apache Zeppelin

Name of the Vulnerable Software and Affected Versions: Apache Zeppelin versions 0.8.2 through 0.11.0 Description: The issue is related to improper input validation, allowing attackers to call the updating cron API with invalid or improper privileges. This enables the notebook to run with elevated...

PT-2024-24256 · Apache · Apache Zeppelin

Name of the Vulnerable Software and Affected Versions: Apache Zeppelin versions 0.8.2 through 0.11.0 Description: The issue is related to improper encoding or escaping of output, allowing attackers to modify helium.json and perform cross-site scripting attacks on normal users. Recommendations: Fo...