PT-2024-22112 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 14.4 Description: A path handling issue was addressed with improved validation, which may allow an app to access user-sensitive data. Recommendations: For versions prior to 14.4, update to macOS Sonoma 14.4 to resolve...

PT-2024-17950 · WordPress · Responsive Pricing Table

Name of the Vulnerable Software and Affected Versions: The Responsive Pricing Table WordPress plugin versions prior to 5.1.11 Description: The issue concerns a Stored Cross-Site Scripting flaw in the Responsive Pricing Table WordPress plugin. This flaw could allow users with the author role and...

PT-2024-22276 · Wasmi · Wasmi

Name of the Vulnerable Software and Affected Versions: Wasmi versions 0.15.0 through 0.31.0 Description: The issue arises when the host calls or resumes a Wasm function with more parameters than the default limit 128, causing an Out-of-bounds Buffer Write. This affects calls from host to Wasm, bu...

1Panel open source panel project has an unauthorized vulnerability.

Impact The steps are as follows: 1. Access https://IP:PORT/ in the browser, which prompts the user to access with a secure entry point. 2. Use Burp to intercept: When opening the browser and entering the URL allowing the first intercepted packet through Burp, the following is displayed: It is fou...

BIT-AIRFLOW-2023-35005 Apache Airflow: Information disclosure on configuration view

In Apache Airflow, some potentially sensitive values were being shown to the user in certain situations. This vulnerability is mitigated by the fact configuration is not shown in the UI by default only if webserver exposeconfig is set to non-sensitive-only, and not all uncensored values are...

PT-2024-2184 · Apache · Apache Inlong

Name of the Vulnerable Software and Affected Versions: Apache InLong versions 1.8.0 through 1.10.0 Description: The issue affects Apache InLong due to deserialization of untrusted data, allowing attackers to read from an arbitrary file using a specific payload. This can enable remote attackers to...

PT-2024-2109 · Jenkins · Jenkins Html Publisher Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins HTML Publisher Plugin versions 1.32 and earlier Description: The issue exists due to the lack of protection for the web page structure. This can be exploited by a remote attacker to conduct cross-site scripting attacks. The...

PT-2024-20335 · Teamwire · Teamwire Windows Desktop Client

Name of the Vulnerable Software and Affected Versions: Teamwire Windows desktop client versions 2.0.1 through 2.4.0 Description: An issue in the Teamwire Windows desktop client allows a remote attacker to obtain sensitive information via a crafted payload to the message function. Recommendations:...

PT-2024-13616 · Archibus · Archibus

Name of the Vulnerable Software and Affected Versions: Archibus app version 4.0.3 for iOS Description: An issue was discovered in the create work request feature of the maintenance module, via the description field. This allows an attacker to perform an action on behalf of the user, exfiltrate...

PT-2024-9579

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions prior to 11.0.2, 10.1.34, or 9.0.98. Description The Time-of-check Time-of-use TOCTOU Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive file systems when the default...

PT-2024-13764 · Unknown · Openharmony

Name of the Vulnerable Software and Affected Versions: OpenHarmony versions prior to 3.2.4 Description: The issue allows a local attacker to cause apps to crash through type confusion. Recommendations: For OpenHarmony versions prior to 3.2.4, update to a version newer than 3.2.4 to resolve the...

PT-2024-2157

Name of the Vulnerable Software and Affected Versions pgx versions prior to 4.18.2 Description The issue is related to SQL injection in the pgx PostgreSQL driver and toolkit for Go. It occurs when the non-default simple protocol is used, a placeholder for a numeric value is immediately preceded b...

PT-2024-22256 · Langchain · Langchain

Name of the Vulnerable Software and Affected Versions: LangChain versions 0.1.10 and earlier Description: The issue allows an actor who can control the final part of the path parameter in a load chain call to perform ../ directory traversal. This bypasses the intended behavior of loading...

PT-2024-21154 · Unknown +1 · Prestashop +1

Name of the Vulnerable Software and Affected Versions: PrestaShop versions prior to 9.0 Description: An issue was discovered in the Presta World "Account Manager - Sales Representative & Dealers - CRM" prestasalesmanager module, allowing remote attackers to escalate privilege and obtain sensitive...

PT-2024-2028 · Ibm · Ibm Mq Operator

Name of the Vulnerable Software and Affected Versions: IBM MQ Operator versions 2.0.0 LTS through 2.0.18 LTS IBM MQ Operator versions 2.2.0 through 2.2.2 IBM MQ Operator versions 2.3.0 through 2.3.3 IBM MQ Operator versions 2.4.0 through 2.4.7 IBM MQ Operator versions 3.0.0 CD through 3.0.1 CD...

PT-2024-21389 · Prestashop · Prestashop Product Designer Module

Name of the Vulnerable Software and Affected Versions: PrestaShop Product Designer module versions prior to 1.178.36 Description: A Server-Side Request Forgery SSRF issue allows remote attackers to cause a denial of service DoS and escalate privileges via the url parameter in the postProcess...

PT-2024-15948 · Langchain Ai · Chat-Langchain

Name of the Vulnerable Software and Affected Versions: langchain-ai/chat-langchain versions prior to 0.0.0 Description: The issue is related to Cross-site Scripting XSS - DOM. There is no information about the estimated number of potentially affected devices worldwide or real-world incidents wher...

GHSA-6XWF-XVF3-V459 Apache Airflow: Incorrect Default Permissions in audit logs for Ops and Viewers users

Apache Airflow, versions before 2.8.2, has a vulnerability that allows authenticated Ops and Viewers users to view all information on audit logs, including dag names and usernames they were not permitted to view. With 2.8.2 and newer, Ops and Viewer users do not have audit log permission by...

PYSEC-2024-42

Apache Airflow, versions before 2.8.2, has a vulnerability that allows authenticated Ops and Viewers users to view all information on audit logs, including dag names and usernames they were not permitted to view. With 2.8.2 and newer, Ops and Viewer users do not have audit log permission by...

PT-2024-20654 · Dell · Dell Secure Connect Gateway (Scg) Policy Manager

Name of the Vulnerable Software and Affected Versions: Dell Secure Connect Gateway SCG Policy Manager version 5.10+ Description: The issue is related to a weak password recovery mechanism for forgotten passwords. An adjacent network low privileged attacker could potentially exploit this, leading ...