CVE-2024-56128

Apache Kafka's SCRAM authentication implementation fails to comply with RFC 5802 because it does not verify that the client's second-message nonce matches the server's first-message nonce. This flaw allows an attacker with plaintext access to the authentication exchange to intercept and potential...

PT-2024-9675

Name of the Vulnerable Software and Affected Versions Fortinet FortiWLM versions 8.5.0 through 8.5.4 Fortinet FortiWLM versions 8.6.0 through 8.6.5 Description A relative path traversal vulnerability in Fortinet FortiWLM allows an attacker to execute unauthorized code or commands via specially...

Exploit for CVE-2024-44765

CVE-2024-44765https://nvd.nist.gov/vuln/detail/CVE-2024-447...

DEBIAN-CVE-2024-54677

Uncontrolled Resource Consumption vulnerability in the examples web application provided with Apache Tomcat leads to denial of service. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.1, from 10.1.0-M1 through 10.1.33, from 9.0.0.M1 through 9.9.97. The following versions were EOL at...

ThreatQuotient ThreatQ Platform

RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to perform remote code execution. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as: Minimize network exposure for all...

Apache Tomcat 10.1.0.M1 < 10.1.34 multiple vulnerabilities

The version of Tomcat installed on the remote host is prior to 10.1.34. It is, therefore, affected by multiple vulnerabilities as referenced in the fixedinapachetomcat10.1.34security-10 advisory. - Time-of-check Time-of-use TOCTOU Race Condition vulnerability during JSP compilation in Apache Tomc...

PT-2025-25327

Name of the Vulnerable Software and Affected Versions XWiki versions prior to 15.10.16 XWiki versions prior to 16.4.7 XWiki versions prior to 16.10.2 Description The issue allows execution of any SQL query in Oracle using functions like DBMS XMLGEN or DBMS XMLQUERY. This is due to the XWiki query...

PT-2025-3315

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to the fixed version Description A bug in the Linux kernel has been resolved, specifically in the bpf get smp processor id function when CONFIG SMP is disabled. On x86-64, calling this function can trigger an error...

PT-2025-3583

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue concerns the Linux kernel's ASoC: SOF: Intel: hda-dai component, where the link DMA should not be released on a stop trigger, as a stream re-start might occur without closing t...

CVE-2024-12698

An incomplete fix for ose-olm-catalogd-container was issued for the Rapid Reset Vulnerability CVE-2023-39325/CVE-2023-44487 where only unauthenticated streams were protected, not streams created by authenticated sources. Mitigation Red Hat Product Security does not have any mitigation...

PT-2024-9739

Name of the Vulnerable Software and Affected Versions: GFI Kerio Control versions 9.2.5 through 9.4.5 Description: An issue was discovered in GFI Kerio Control where the dest GET parameter passed to the "/nonauth/addCertException.cs", "/nonauth/guestConfirm.cs", and "/nonauth/expiration.cs" pages...

PT-2024-36242 · Vcita · Online Booking & Scheduling Calendar For Wordpress

Name of the Vulnerable Software and Affected Versions: Online Booking & Scheduling Calendar for WordPress by vcita versions n/a through 4.5 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows Cross Site Request Forgery. This means an attacker can trick a user...

PT-2024-17289 · WordPress · Tithe.Ly Giving Button

Name of the Vulnerable Software and Affected Versions: Tithe.ly Giving Button WordPress plugin versions 1.1 and earlier Description: The issue concerns a Stored Cross-Site Scripting vulnerability. It arises because the plugin does not validate and escape some of its shortcode attributes before...

PT-2024-17277

Name of the Vulnerable Software and Affected Versions The Out of the Block: OpenStreetMap plugin for WordPress versions up to, and including, 2.8.3 Description The issue is related to Stored Cross-Site Scripting via the plugin's ootb query shortcode due to insufficient input sanitization and outp...

PT-2024-9584

Name of the Vulnerable Software and Affected Versions Cleo Harmony versions prior to 5.8.0.24 Cleo VLTrader versions prior to 5.8.0.24 Cleo LexiCom versions prior to 5.8.0.24 Description The issue allows an unauthenticated user to import and execute arbitrary Bash or PowerShell commands on the ho...

PT-2024-16651 · WordPress · Image Widget

Name of the Vulnerable Software and Affected Versions: Image Widget WordPress plugin versions prior to 4.4.11 Description: The issue concerns the Image Widget WordPress plugin, where certain settings of its Image Widget are not properly sanitized and escaped. This could allow high-privilege users...

Path Traversal org.springframework:spring-webmvc Dependency in Bitbucket Data Center and Server

This High severity org.springframework:spring-webmvc vulnerability exists in 8.9.0 - 8.9.23 and 8.19.0 to 8.19.12 of Bitbucket Data Center and Server. This org.springframework:spring-webmvc Dependency vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of...

PT-2025-3605

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The issue is related to the ASoC: Intel: sof sdw component in the Linux kernel. The code uses the initialised member of the asoc sdw dailink struct to determine if a member of the array ...

Debian dla-3992 : gir1.2-soup-2.4 - security update

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3992 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-3992-1 [email protected]...

PT-2024-35712 · Dell · Dell Thinos

Name of the Vulnerable Software and Affected Versions: Dell ThinOS version 2408 Description: The issue is related to a Time-of-check Time-of-use TOCTOU Race Condition vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of...