PT-2024-26670

Name of the Vulnerable Software and Affected Versions scrapy/scrapy affected versions not specified Description The scrapy/scrapy project is vulnerable to XML External Entity XXE attacks due to the use of lxml.etree.fromstring for parsing untrusted XML data without proper validation. This issue...

PT-2024-15131 · Wolfssl +1 · Wolfssl +1

Name of the Vulnerable Software and Affected Versions: wolfSSL versions prior to 5.6.6 Description: The issue arises from the failure to check that messages in one DTLS record do not span key boundaries, allowing the combination of DTLS messages using different keys into one DTLS record. In the...

PT-2024-26692

Name of the Vulnerable Software and Affected Versions Scrapy versions prior to 2.11.1 Description The issue arises from the failure to remove the Authorization header when redirecting across domains, potentially allowing for account hijacking. This occurs when a request with the Authorization...

PT-2024-20966 · Unknown · Flusity-Cms

Name of the Vulnerable Software and Affected Versions: flusity CMS version 2.4 Description: The issue allows a remote attacker to execute arbitrary code and obtain sensitive information via the download backup.php component. This is a Directory Traversal vulnerability, which means an attacker can...

PT-2024-1924

Name of the Vulnerable Software and Affected Versions QEMU versions 7.1.0 through 8.2.1 Description The issue is related to a buffer overflow in the register vfs function in hw/pci/pcie sriov.c of the QEMU hardware emulator. This occurs when a guest writes NumVFs greater than TotalVFs, leading to...

PT-2024-21003 · Unknown · A-Blog Cms

Name of the Vulnerable Software and Affected Versions: a-blog cms versions 3.1.0 through 3.1.8 Description: A URL spoofing issue exists, allowing an attacker to force the administrator to access an arbitrary website when clicking a link in the audit log by sending a specially crafted request...

Denial of Service (DoS)

Overview Microsoft.AspNetCore.App.Runtime.win-x64 is a package providing a default set of APIs for building an ASP.NET Core application. Contains assets used for self-contained deployments. Affected versions of this package are vulnerable to Denial of Service DoS when parsing X509 certificates...

santuario: Private Key disclosure in debug-log output

All versions of Apache Santuario - XML Security for Java prior to 2.2.6, 2.3.4, and 3.0.3, when using the JSR 105 API, are vulnerable to an issue where a private key may be disclosed in log files when generating an XML Signature and logging with debug level is enabled. Users are recommended to...

PT-2024-1648

Name of the Vulnerable Software and Affected Versions Microsoft Office 2016 Microsoft Office LTSC 2021 Microsoft 365 Apps for Enterprise Microsoft Office 2019 Description A critical vulnerability in Microsoft Outlook allows remote attackers to execute arbitrary code and affect the system. The...

PT-2024-3487 · Autogpt · Autogpt

Name of the Vulnerable Software and Affected Versions: autogpt versions up to v0.5.0 Description: An OS command injection issue exists due to the improper neutralization of special elements used in an OS command. This allows for arbitrary code execution if an attacker can inject shell commands,...

Intel® PM Software Advisory

Summary: A potential security vulnerability in some Intel® Performance Maximizer PM software may allow escalation of privilege. Intel is not releasing updates to mitigate this potential vulnerability and has issued a Product Discontinuation Notice for Intel® PM. Vulnerability Details: CVEID:...

Intel® SPS Firmware Advisory

Summary: A potential security vulnerability in some Intel® Server Platform Services SPS firmware may allow denial of service. Intel is releasing firmware updates to mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2023-29153 Description: Uncontrolled resource consumption f...

Intel® Ethernet Tools and Driver Install Software Advisory

Summary: Potential security vulnerabilities in some Intel® Ethernet tools and driver install software may allow escalation of privilege. Intel is releasing software updates to mitigate these potential vulnerabilities. Vulnerability Details: CVEID: CVE-2023-39432 Description: Improper access contr...

PT-2024-20631 · Yannick Lefebvre · Link Library

Name of the Vulnerable Software and Affected Versions: Link Library versions through 7.5.13 Description: A Cross-Site Request Forgery CSRF issue affects the Yannick Lefebvre Link Library. This issue allows an attacker to perform unintended actions on a user's behalf. Recommendations: For versions...

PT-2024-19917 · Unknown · Calculators World Cc Bmi Calculator

Name of the Vulnerable Software and Affected Versions: Calculators World CC BMI Calculator versions n/a through 2.0.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Stored XSS in the Calculators...

PT-2024-14151 · Unknown · If-So Dynamic Content Personalization

Name of the Vulnerable Software and Affected Versions: If-So Dynamic Content Personalization versions 1.6.3.1 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that ...

CVE-2023-50291 Apache Solr: System Property redaction logic inconsistency can lead to leaked passwords

Insufficiently Protected Credentials vulnerability in Apache Solr. This issue affects Apache Solr: from 6.0.0 through 8.11.2, from 9.0.0 before 9.3.0. One of the two endpoints that publishes the Solr process' Java system properties, /admin/info/properties, was only setup to hide system properties...

CVE-2023-50292 Apache Solr: Solr Schema Designer blindly "trusts" all configsets, possibly leading to RCE by unauthenticated users

Incorrect Permission Assignment for Critical Resource, Improper Control of Dynamically-Managed Code Resources vulnerability in Apache Solr. This issue affects Apache Solr: from 8.10.0 through 8.11.2, from 9.0.0 before 9.3.0. The Schema Designer was introduced to allow users to more easily configu...

PT-2024-21083 · Misp · Misp

Name of the Vulnerable Software and Affected Versions: MISP versions prior to 2.4.184 Description: An issue was discovered where a client does not need to use POST to start an export generation process. This is related to app/Controller/JobsController.php and app/View/Events/export.ctp...

PT-2024-21086 · Litespeed · Lsquic

Name of the Vulnerable Software and Affected Versions: LiteSpeed QUIC LSQUIC Library versions prior to 4.0.4 Description: The issue is related to mishandled DCID validation. Recommendations: For versions prior to 4.0.4, update to version 4.0.4 or later to resolve the issue...