GitLab 15.2 < 17.4.6 / 17.5 < 17.5.4 / 17.6 < 17.6.2 (CVE-2024-8647)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' in GitLab CVE-2024-8647 Note that Nessus has not tested for this issue but has instead relied only on the application's...

PQClean has a correctness error in HQC decapsulation

Impact A correctness error has been identified in the reference implementation of the HQC key encapsulation mechanism. Due to an indexing error, part of the secret key is incorrectly treated as non-secret data. This results in an incorrect shared secret value being returned when the decapsulation...

Apache Struts file upload logic is flawed

File upload logic is flawed vulnerability in Apache Struts. An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. This issue affects Apache Struts: from...

CVE-2024-53677 Apache Struts: Mixing setters for uploaded files and normal fields can allow bypass file upload checks

File upload logic in Apache Struts is flawed. An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. This issue affects Apache Struts: from 2.0.0 before...

CVE-2024-50237 affecting package kernel for versions less than 5.15.173.1-1

CVE-2024-50237 affecting package kernel for versions less than 5.15.173.1-1. An upgraded version of the package is available that resolves this issue...

PT-2024-36562

Name of the Vulnerable Software and Affected Versions python-libarchive versions 4.2.1 and earlier Description The issue allows directory traversal, enabling the creation of files in extract in zip.py for ZipFile.extractall and ZipFile.extract functions. This can be exploited to create files...

Debian dla-3991 : upx-ucl - security update

The remote Debian 11 host has a package installed that is affected by a vulnerability as referenced in the dla-3991 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3991-1 [email protected] https://www.debian.org/lts/security/...

GLSA-202412-16 : libvirt: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202412-16 libvirt: Multiple Vulnerabilities Multiple vulnerabilities have been discovered in libvirt. Please review the CVE identifiers referenced below for details. Tenable has extracted the preceding description block directly...

Amazon Linux 2023 : apr, apr-devel (ALAS2023-2024-789)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-789 advisory. Lax permissions set by the Apache Portable Runtime library on Unix platforms would allow local users read access to named shared memory segments, potentially revealing sensitive application data. This...

Amazon Linux 2 : kernel (ALAS-2021-1634)

The version of kernel installed on the remote host is prior to 4.14.231-173.361. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2021-1634 advisory. A low severity issue was found in the Nitro Enclaves Linux kernel driver that could lead to local privilege escalation. The...

Security Bulletin: A vulnerability in XML toolkit for Ruby affects IBM License Metric Tool.

Summary There is a vulnerability in the XML toolkit for Ruby component used by IBM License Metric Tool. Vulnerability Details CVEID:CVE-2024-49761 DESCRIPTION: Ruby REXML is vulnerable to a denial of service, caused by a regular expression denial of service ReDoS flaw. By sending a specially...

December 10, 2024—KB5048744 (Security-only update)

None None...

National Instruments LabVIEW

RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to disclose information or execute arbitrary code. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as: Minimize...

Horner Automation Cscape

RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to disclose information and execute arbitrary code. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as: Minimize...

Debian dsa-5826 : smarty3 - security update

The remote Debian 12 host has a package installed that is affected by multiple vulnerabilities as referenced in the dsa-5826 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-5826-1 [email protected] https://www.debian.org/securit...

Siemens Teamcenter Visualization 

SUMMARY Siemens Teamcenter Visualization contains multiple file parsing vulnerabilities that could be triggered when the application reads files in WRL format. If a user is tricked to open a malicious file with any of the affected products, this could lead the application to crash or potentially...

Siemens Simcenter Femap

SUMMARY Simcenter Femap contains multiple memory corruption vulnerabilities that could be triggered when the application reads files in BDF file formats. If a user is tricked to open a malicious file with any of the affected products, this could lead the application to crash or potentially lead...

PT-2024-9949 · Adobe · Substance3D - Modeler

Name of the Vulnerable Software and Affected Versions: Substance3D - Modeler versions 1.14.1 and earlier Description: The issue is related to a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue...

PT-2024-34459 · Silicon · Z-Wave Series 700 +1

Name of the Vulnerable Software and Affected Versions: Silicon Labs SiLabs Z-Wave Series 700 and 800 version 7.21.1 Description: Insecure permissions in the software allow attackers to arbitrarily change the device type in the controller's memory, leading to a Denial of Service DoS...

PT-2024-9602 · Adobe · Acrobat Reader

Name of the Vulnerable Software and Affected Versions: Acrobat Reader versions 20.005.30730, 20.005.30710, 24.001.30193, 24.001.30213, 24.005.20307 and earlier Description: The issue is related to a Use After Free vulnerability that could result in arbitrary code execution in the context of the...