PT-2025-3053 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 13.7.2 macOS versions prior to 14.7.2 macOS versions prior to 15.2 Description: The issue is related to a lack of protection for sensitive data, which may allow an application to access protected user data. This proble...

Simulation of Wasmd message can cause crashing

CWA-2024-009 Severity Low Marginal + Likely^1 Affected versions: - wasmd 0.53.1 Patched versions: - wasmd 0.53.2 please note that wasmd 0.53.1 is broken and must not be used Description of the bug Blank for now. We'll add more detail once chains had a chance to upgrade. Mitigations Apart from...

Microsoft Releases December 2024 Security Updates

Microsoft released security updates to address vulnerabilities in multiple Microsoft products. A cyber threat actor could exploit some of these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review the following and apply necessary updates:...

Adobe Releases Security Updates for Multiple Products

Adobe released security updates to address vulnerabilities in multiple Adobe software products including Adobe Acrobat, Adobe Illustrator, and Adobe InDesign. A cyber threat actor could exploit some of these vulnerabilities to take control of an affected system. CISA encourages users and...

December 10, 2024—KB5048735 (Monthly Rollup)

None None...

December 10, 2024—KB5048695 (Monthly Rollup)

None None...

Rockwell Automation Arena (Update C)

RISK EVALUATION Successful exploitation of these vulnerabilities could result in execution of arbitrary code. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as: Minimize network exposure for all control...

PT-2024-36026 · Parasolid · Parasolid

Name of the Vulnerable Software and Affected Versions: Parasolid versions prior to V36.1.225 Parasolid versions prior to V37.0.173 Parasolid versions prior to V37.1.1 Description: A vulnerability has been identified in the affected application, which contains an out of bounds write past the end o...

PT-2024-31965 · Tp Link · Tp-Link Tl-Wr845N

Name of the Vulnerable Software and Affected Versions: TP-Link TL-WR845NUN versions 190219 through 201214 Description: The issue allows the transmission of user credentials in plaintext after a factory reset is executed. Recommendations: For TP-Link TL-WR845NUN versions 190219 through 201214,...

PT-2024-34458 · Silicon · Z-Wave Series 700 +1

Name of the Vulnerable Software and Affected Versions: Silicon Labs SiLabs Z-Wave Series 700 and 800 version 7.21.1 Description: The issue is related to insecure permissions in the Silicon Labs Z-Wave Series 700 and 800, which allow attackers to modify the wakeup interval of end devices in the...

PT-2024-10221

Name of the Vulnerable Software and Affected Versions LibreOffice versions 24.8 through 24.8.3 Description The issue is related to insufficient protection of internal data in LibreOffice, allowing an unauthorized actor to potentially disclose sensitive information. Specifically, URLs could be...

PT-2024-9407 · Sap · Sap Netweaver As Java

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver AS for Java affected versions not specified Description: The issue allows an attacker authenticated as an administrator to use an exposed webservice to create a PDF with an embedded attachment. By specifying the file to be an...

PT-2024-36981

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.12.0-rc6-00077-g2e1b3cc9d7f7 Description A problem in the Linux kernel has been fixed, specifically with the vGPIO driver, which would crash during bootup. The crash was caused by an unauthorized modification o...

CVE-2024-54149 Winter CMS Modules allows a sandbox bypass in Twig templates leading to data modification and deletion

Winter is a free, open-source content management system CMS based on the Laravel PHP framework. Winter CMS prior to versions 1.2.7, 1.1.11, and 1.0.476 allow users with access to the CMS templates sections that modify Twig files to bypass the sandbox placed on Twig files and modify resources such...

PT-2024-36072 · Unknown · Winter Cms

Name of the Vulnerable Software and Affected Versions: Winter CMS versions prior to 1.2.7 Winter CMS versions prior to 1.1.11 Winter CMS versions prior to 1.0.476 Description: The issue allows users with access to the CMS templates sections that modify Twig files to bypass the sandbox placed on...

PT-2024-36445 · Unknown · Kashipara E-Learning Management System

Name of the Vulnerable Software and Affected Versions: Kashipara E-Learning Management System version 1.0 Description: The issue is related to SQL Injection in the /admin/delete users.php file. This allows for potential exploitation. No information is provided about the estimated number of...

PT-2024-11616 · Unknown · Doctor-Appointment

Name of the Vulnerable Software and Affected Versions: Doctor-Appointment version 1.0 Description: The issue allows attackers to execute arbitrary code due to an arbitrary file upload vulnerability in the /Frontend/signup com.php endpoint. This vulnerability enables attackers to upload malicious...

PT-2024-11617 · Unknown · Flipkart-Clone-Php

Name of the Vulnerable Software and Affected Versions: Flipkart-Clone-PHP version 1.0 Description: The issue allows attackers to execute arbitrary code through a SQL Injection vulnerability in the product title parameter in the entry.php file. Recommendations: For Flipkart-Clone-PHP version 1.0,...

PT-2024-36446 · Unknown · Kashipara E-Learning Management System

Name of the Vulnerable Software and Affected Versions: Kashipara E-learning Management System version 1.0 Description: The issue is related to a SQL Injection vulnerability in the /admin/delete teacher.php file. This vulnerability can be exploited through the delete teacher.php API endpoint. No...

PT-2024-34367 · Digi · Digi Connectport Lts

Name of the Vulnerable Software and Affected Versions: Digi ConnectPort LTS versions prior to 1.4.12 Description: A Privilege Escalation issue exists in the file upload feature of Digi ConnectPort LTS. This allows an attacker on the local area network, with specific permissions, to upload and...