PT-2024-8141 · Postgresql +6 · Postgresql +6

Name of the Vulnerable Software and Affected Versions: PostgreSQL versions prior to 17.1 PostgreSQL versions prior to 16.5 PostgreSQL versions prior to 15.9 PostgreSQL versions prior to 14.14 PostgreSQL versions prior to 13.17 PostgreSQL versions prior to 12.21 Description: The issue is related t...

PT-2024-8138

Name of the Vulnerable Software and Affected Versions: PostgreSQL versions prior to 17.1 PostgreSQL versions prior to 16.5 PostgreSQL versions prior to 15.9 PostgreSQL versions prior to 14.14 PostgreSQL versions prior to 13.17 PostgreSQL versions prior to 12.21 Description: The issue is related t...

Intel® Xeon® Processor Advisory

Summary: A potential security vulnerability in some 4th and 5th Generation Intel® Xeon® Processors may allow denial of service. Intel is releasing microcode updates to mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2024-21853 Description: Improper Finite State Machines...

PT-2024-16390 · WordPress · Wpforms

Name of the Vulnerable Software and Affected Versions: WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More plugin for WordPress versions up to, and including, 1.9.1.6 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect...

Siemens SCALANCE M-800 Family Improper Input Validation (CVE-2024-50557)

Affected devices do not properly validate input in configuration fields of the iperf functionality. This could allow an unauthenticated remote attacker to execute arbitrary code on the device. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for mor...

Siemens SCALANCE M-800 Family Improper Limitation of a Pathname to a Restricted Directory (CVE-2024-50559)

Affected devices do not properly validate the filenames of the certificate. This could allow an authenticated remote attacker to append arbitrary values which will lead to compromise of integrity of the system. This plugin only works with Tenable.ot. Please visit...

November 12, 2024—KB5046682 (Monthly Rollup)

None None...

Schneider Electric PowerLogic PM5300 Series

GENERAL SECURITY RECOMMENDATIONS We strongly recommend the following industry cybersecurity best practices. https://www.se.com/us/en/download/document/7EN52-0390/ Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network. Install...

PT-2024-8450

Name of the Vulnerable Software and Affected Versions Laravel versions 6.20.45 through 11.31.0 Description The issue is related to the register argc argv php directive being set to on, allowing users to change the environment used by the framework when handling requests with a special crafted que...

Siemens SINEC INS

SUMMARY SINEC INS before V1.0 SP2 Update 3 is affected by multiple vulnerabilities. Siemens has released a new version for SINEC INS and recommends to update to the latest version. 2. GENERAL RECOMMENDATIONS As a general security measure, Siemens strongly recommends to protect network access to...

PT-2024-9111 · Gnome +9 · Gnome Glib +9

Name of the Vulnerable Software and Affected Versions: GNOME GLib versions prior to 2.82.1 Description: The issue is related to an off-by-one error and resultant buffer overflow in the gio/gsocks4aproxy.c component of GNOME GLib. This occurs because SOCKS4 CONN MSG LEN is not sufficient for a...

PT-2024-16695

Name of the Vulnerable Software and Affected Versions Ivanti Connect Secure versions prior to 22.7R2.1 Ivanti Policy Secure versions prior to 22.7R1.1 Description The issue is related to a Reflected XSS that allows a remote unauthenticated attacker to obtain admin privileges, with user interactio...

PT-2024-34053 · Linux +1 · Linux Kernel +1

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.6.61 Description: A memory management issue in the Linux kernel has been identified, which can be exploited under memory pressure. The estimated number of potentially affected devices is not specified...

PT-2024-21935 · Wasm3 · Wasm3

Name of the Vulnerable Software and Affected Versions: wasm3 version 139076a Description: The issue concerns memory leaks in the Read utf8 function. This function is part of the wasm3 software, specifically at commit 139076a. No information is provided about the estimated number of potentially...

PT-2024-39904 · WordPress · The Poll Maker – Versus Polls

Name of the Vulnerable Software and Affected Versions: The Poll Maker – Versus Polls, Anonymous Polls, Image Polls plugin for WordPress versions up to, and including, 5.4.6 Description: The issue is related to time-based SQL Injection via the orderby parameter due to insufficient escaping on the...

PT-2024-34885 · Twig +3 · Twig +3

Name of the Vulnerable Software and Affected Versions: Twig versions prior to 3.11.2 Twig versions prior to 3.14.1 Description: In a sandbox, an attacker can call toString on an object even if the toString method is not allowed by the security policy when the object is part of an array or an...

PT-2024-7982

Name of the Vulnerable Software and Affected Versions D-Link DNS-320, DNS-320LW, DNS-325, and DNS-340L versions up to 20241028 Description A critical issue exists in the cgi user add function of the file /cgi-bin/account mgr.cgi?cmd=cgi user add within the affected D-Link devices. Manipulation of...

PT-2024-34372 · Unopim · Unopim

Name of the Vulnerable Software and Affected Versions: UnoPim versions 0.1.3 and below Description: The issue is related to Cross Site Scripting XSS in the Create User function, allowing attackers to perform XSS via an SVG document. This can be used to steal cookies. The vulnerability is exploite...

DEBIAN-CVE-2024-51745

Wasmtime is a fast and secure runtime for WebAssembly. Wasmtime's filesystem sandbox implementation on Windows blocks access to special device filenames such as "COM1", "COM2", "LPT0", "LPT1", and so on, however it did not block access to the special device filenames which use superscript digits,...

DoS (Denial of Service) org.bouncycastle:bcprov-jdk18on Dependency in Bamboo Data Center and Server

This High severity org.bouncycastle:bcprov-jdk18on Dependency vulnerability was introduced in versions 9.2.11, 9.4.3, 9.5.0, and 9.6.0 of Bamboo Data Center and Server. This org.bouncycastle:bcprov-jdk18on Dependency vulnerability, with a CVSS Score of 7.5 and a CVSS Vector of...