GitHub Launches AI-Powered Autofix Tool to Assist Devs in Patching Security Flaws

GitHub on Wednesday announced that it's making available a feature called code scanning autofix in public beta for all Advanced Security customers to provide targeted recommendations in an effort to avoid introducing new security issues. "Powered by GitHub Copilot and CodeQL, code scanning autofi...

PT-2024-13657 · Unknown · Tramyardg Autoexpress

Name of the Vulnerable Software and Affected Versions: tramyardg Autoexpress version 1.3.0 Description: A SQL injection issue allows remote unauthenticated attackers to execute arbitrary SQL commands via the parameter id within the getPhotosByCarId function call in details.php. Recommendations: F...

PT-2024-21421 · Codiad · Codiad

Name of the Vulnerable Software and Affected Versions: Codiad version 2.8.4 Description: The issue allows reflected XSS via the type parameter in the "components/market/dialog.php" endpoint. This can lead to remote execution. There is no information about the estimated number of potentially...

PT-2024-21653 · Frappe · Frappe

Name of the Vulnerable Software and Affected Versions: Frappe versions prior to 14.66.3 Frappe versions prior to 15.16.0 Description: Frappe is a full-stack web application framework. The issue allows file permission to be bypassed using certain endpoints, granting less privileged users permissio...

PT-2024-20867

Name of the Vulnerable Software and Affected Versions REBUILD version 3.5 Description The issue allows a remote attacker to obtain sensitive information and execute arbitrary code. This is achieved via the FileDownloader.java and the proxyDownload and URL parameters. Recommendations For REBUILD...

PT-2024-2427

Name of the Vulnerable Software and Affected Versions Moby versions prior to 23.0.11 Moby versions prior to 25.0.4 Moby versions prior to 26.0.0 Description The issue is related to the networking implementation in Moby, which allows for the creation of custom networks with their own IP address...

PT-2025-18295 · Xwiki · Xwiki

Name of the Vulnerable Software and Affected Versions: XWiki versions 15.9-rc-1 through 15.10.8 XWiki versions 16.0.0-rc-1 through 16.2.0 Description: XWiki is a generic wiki platform. The required rights analysis does not consider TextAreas with default content type, allowing a user to put...

Implementations of UDP-based application protocols are vulnerable to network loops

Overview A novel traffic-loop vulnerability has been identified against certain implementations of UDP-based applications protocols. An unauthenticated attacker can use maliciously-crafted packets against a UDP-based vulnerable implementation of application protocols e.g., DNS, NTP, TFTP that can...

PT-2024-21068 · Delinea · Delinea Pam Secret Server

Name of the Vulnerable Software and Affected Versions: Delinea PAM Secret Server version 11.4 Description: The issue allows a user with access to the Report functionality to gain unauthorized access to remote sessions created by legitimate users. Recommendations: For Delinea PAM Secret Server...

PT-2024-13382 · Epmm · Epmm

Name of the Vulnerable Software and Affected Versions: EPMM versions prior to 12.1.0.0 Description: An SQL Injection issue in a web component of EPMM allows an authenticated user with appropriate privilege to access or modify data in the underlying database. Recommendations: For versions prior to...

PT-2024-5776

Name of the Vulnerable Software and Affected Versions Apache ZooKeeper versions prior to 3.9.2 Apache ZooKeeper versions prior to 3.8.4 Description The issue is related to information disclosure in persistent watchers handling in Apache ZooKeeper due to missing ACL check. It allows an attacker to...

CPU hardware utilizing speculative execution may be vulnerable to speculative race conditions

Overview A Speculative Race Condition SRC vulnerability that impacts modern CPU architectures supporting speculative execution has been discovered. CPU hardware utilizing speculative execution that are vulnerable to Spectre v1 are likely affected. An unauthenticated attacker can exploit this...

PT-2024-2562 · Argo Cd · Argo Cd

Name of the Vulnerable Software and Affected Versions: Argo CD versions 1.2.0-rc1 through 2.10.2 Argo CD versions 1.2.0-rc1 through 2.9.7 Argo CD versions 1.2.0-rc1 through 2.8.11 Description: The issue is related to improper validation in Argo CD, a declarative, GitOps continuous delivery tool f...

PT-2024-12942 · Unknown · Student Enrollment In Php

Name of the Vulnerable Software and Affected Versions: Student Enrollment In PHP version 1.0 Description: The issue is related to an arbitrary file upload vulnerability in the Add Student's Profile Picture function. This vulnerability allows attackers to execute arbitrary code by uploading a...

ROS-2-1926

2.1926 Denial of Service in Libxml2 CVE-2021-3541 1. Vulnerability Description: The vulnerability allows a remote attacker to perform a denial of service DoS attack. The vulnerability exists due to insufficient validation of user input. A remote attacker can pass specially crafted input data to a...

PT-2024-10423

Name of the Vulnerable Software and Affected Versions DCMTK versions prior to 3.6.9 Description The issue is related to a segmentation fault in the dcmdata component of the DCMTK library, which can be triggered by an invalid DIMSE message. This can potentially allow a remote attacker to cause a...

PT-2024-12941 · Unknown · Student Enrollment In Php

Name of the Vulnerable Software and Affected Versions: Student Enrollment in PHP version 1.0 Description: The issue allows attackers to execute arbitrary code through the Student Search function, which is vulnerable to SQL injection. This enables attackers to run malicious code, potentially leadi...

PT-2024-2557 · Vinchin · Vinchin Backup & Recovery

Name of the Vulnerable Software and Affected Versions: Vinchin Backup and Recovery versions 7.2 and earlier Description: The issue is related to the getVerifydiyResult function, which is vulnerable to Authenticated Remote Code Execution RCE. This vulnerability can be exploited by a remote attacke...

PT-2024-2438

Name of the Vulnerable Software and Affected Versions Apache Commons Configuration versions 2.0 through 2.10.0 Atlassian Confluence Data Center versions 7.17.0 through 8.9.0 Atlassian Confluence Server versions 7.17.0 through 8.5.8 Description The issue is related to an out-of-bounds write...

CVE-2024-28098 Apache Pulsar: Improper Authorization For Topic-Level Policy Management

The vulnerability allows authenticated users with only produce or consume permissions to modify topic-level policies, such as retention, TTL, and offloading settings. These management operations should be restricted to users with the tenant admin role or super user role. This issue affects Apache...