PT-2024-22831 · Synology · Synology Surveillance Station

Name of the Vulnerable Software and Affected Versions: Synology Surveillance Station versions prior to 9.2.0-11289 Synology Surveillance Station versions prior to 9.2.0-9289 Description: The issue is related to an improper neutralization of special elements used in an SQL command, also known as...

PT-2024-23049 · WordPress · Fancy Comments

Name of the Vulnerable Software and Affected Versions: Fancy Comments WordPress versions 1.2.14 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows stored cross-site scripting XSS. This means an attacker can inject malicious...

PT-2024-2577 · Cisco · Cisco Ios Xe

Name of the Vulnerable Software and Affected Versions: Cisco IOS XE Software affected versions not specified Description: A vulnerability in the auxiliary asynchronous port AUX functions could allow an authenticated, local attacker to cause an affected device to reload or stop responding. This...

PT-2024-22822 · Synology · Synology Surveillance Station

Name of the Vulnerable Software and Affected Versions: Synology Surveillance Station versions prior to 9.2.0-9289 Synology Surveillance Station versions prior to 9.2.0-11289 Description: The issue is related to improper neutralization of special elements used in an SQL command, also known as SQL...

PT-2024-2473

Name of the Vulnerable Software and Affected Versions JetBrains TeamCity versions prior to 2024.03 Description The issue is related to the configuration of the agent distribution in the JetBrains TeamCity system, which is a continuous integration and continuous delivery CI/CD platform. It allows...

PT-2024-20934 · Ignite Realtime · Openfire

Name of the Vulnerable Software and Affected Versions: Ignite Realtime Openfire versions 4.9.0 and earlier Ignite Realtime Openfire versions 4.8.0 and earlier Description: An issue in Ignite Realtime Openfire allows a remote attacker to escalate privileges via the ROOM CACHE component...

PT-2024-2708

Name of the Vulnerable Software and Affected Versions Apache Airflow versions 2.8.2 through 2.8.3 Description The issue is related to improper preservation of permissions in Apache Airflow, which can allow a remote attacker to gain write access to arbitrary files in the file system. This is due t...

PT-2024-13311 · S-Lang +1 · S-Lang +1

Name of the Vulnerable Software and Affected Versions: S-Lang version 2.3.2 Description: A segmentation fault was discovered in S-Lang via the function fixup tgetstr. Recommendations: For S-Lang version 2.3.2, consider disabling the fixup tgetstr function as a temporary workaround until a patch i...

PT-2024-13450 · Unknown +1 · Readymedia +1

Name of the Vulnerable Software and Affected Versions: ReadyMedia MiniDLNA version 1.3.3 Description: A stack-buffer-overflow issue allows attackers to cause a denial of service via the SendContainer function at tivo commands.c. Recommendations: For ReadyMedia MiniDLNA version 1.3.3, consider...

PT-2024-5218

Name of the Vulnerable Software and Affected Versions: Express.js versions prior to 4.19.0 Express.js pre-release alpha and beta versions of 5.0 prior to 5.0.0-beta.3 Description: The issue is related to an open redirect vulnerability using malformed URLs. When Express performs a redirect using a...

PT-2024-23251 · Org Mode +5 · Org Mode +5

Name of the Vulnerable Software and Affected Versions: Emacs versions prior to 29.3 Org Mode versions prior to 9.6.23 Description: The issue allows arbitrary Lisp code to be evaluated as part of turning on Org mode. Recommendations: For Emacs versions prior to 29.3, update to version 29.3 or late...

PT-2024-2509 · Arm +3 · Mbed Crypto +4

Name of the Vulnerable Software and Affected Versions: Mbed TLS versions 2.18.0 through 2.28.x before 2.28.8 Mbed TLS versions 3.x before 3.6.0 Mbed Crypto affected versions not specified Description: The PSA Crypto API in Mbed TLS and Mbed Crypto mishandles shared memory, which can be exploited ...

PT-2024-23254 · Gnu +9 · Emacs +10

Name of the Vulnerable Software and Affected Versions: Emacs versions prior to 29.3 Org Mode versions prior to 9.6.23 Description: The issue arises because Org mode in Emacs considers the contents of remote files to be trusted. This could potentially lead to security issues if malicious content i...

PT-2024-4137 · Unknown · Wix Toolset

Name of the Vulnerable Software and Affected Versions: WiX Toolset versions prior to 3.14.1 WiX Toolset versions prior to 4.0.5 Description: The custom action behind WiX's RemoveFolderEx functionality could allow a standard user to delete protected directories. RemoveFolderEx deletes an entire...

PT-2024-12450 · Hasthemes · Hashthemes Viral +2

Name of the Vulnerable Software and Affected Versions: HashThemes Viral News versions 1.4.5 and earlier HashThemes Viral versions 1.8.0 and earlier HashThemes HashOne versions 1.3.0 and earlier Description: The issue is related to a Missing Authorization vulnerability in HashThemes products. This...

PT-2024-22490 · Moodle · Moodle

Name of the Vulnerable Software and Affected Versions: Moodle version 4.3.3 Description: The Chat activity in Moodle allows students to insert potentially unwanted HTML elements, such as A or IMG elements, or HTML content that can lead to performance degradation. The vendor's documentation notes...

PT-2024-22592 · Checkmk · Checkmk

Name of the Vulnerable Software and Affected Versions: Checkmk versions prior to 2.3.0b4 Checkmk versions prior to 2.2.0p24 Checkmk versions prior to 2.1.0p41 Checkmk version 2.0.0 Description: The issue is related to a least privilege violation and reliance on untrusted inputs in the mk informix...

GitHub Launches AI-Powered Autofix Tool to Assist Devs in Patching Security Flaws

GitHub on Wednesday announced that it's making available a feature called code scanning autofix in public beta for all Advanced Security customers to provide targeted recommendations in an effort to avoid introducing new security issues. "Powered by GitHub Copilot and CodeQL, code scanning autofi...

PT-2024-13657 · Unknown · Tramyardg Autoexpress

Name of the Vulnerable Software and Affected Versions: tramyardg Autoexpress version 1.3.0 Description: A SQL injection issue allows remote unauthenticated attackers to execute arbitrary SQL commands via the parameter id within the getPhotosByCarId function call in details.php. Recommendations: F...

PT-2024-21421 · Codiad · Codiad

Name of the Vulnerable Software and Affected Versions: Codiad version 2.8.4 Description: The issue allows reflected XSS via the type parameter in the "components/market/dialog.php" endpoint. This can lead to remote execution. There is no information about the estimated number of potentially...