CVE-2024-47249 Apache NimBLE: Lack of input sanitization leading to out-of-bound reads in multiple advertisement handler

Improper Validation of Array Index vulnerability in Apache NimBLE. Lack of input validation for HCI events from controller could result in out-of-bound memory corruption and crash. This issue requires broken or bogus Bluetooth controller and thus severity is considered low. This issue affects...

PT-2024-34712 · Apache · Apache Nimble

Name of the Vulnerable Software and Affected Versions: Apache NimBLE versions through 1.7.0 Description: The issue is an Out-of-bounds Read vulnerability in Apache NimBLE. It is caused by missing proper validation of HCI Number Of Completed Packets, which could lead to out-of-bound access when...

GitLab 16.11 < 17.4.5 / 17.5 < 17.5.3 / 17.6 < 17.6.1 (CVE-2024-11668)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - Insufficient Session Expiration in GitLab CVE-2024-11668 Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 809...

PT-2024-11584 · Ipp · Ipp

Name of the Vulnerable Software and Affected Versions: IPP software versions prior to 1.71 Description: The issue is related to a default credential vulnerability. This could lead attackers to identify and access vulnerable systems. Recommendations: For versions prior to 1.71, update to version...

PT-2024-35700 · Sveltekit · Sveltekit

Name of the Vulnerable Software and Affected Versions: SvelteKit versions prior to 2.8.3 Description: The static error.html template for errors in SvelteKit contains placeholders that are replaced without escaping the content first. This leads to possible injection if an app explicitly creates an...

PT-2024-16483

Name of the Vulnerable Software and Affected Versions YaDisk Files WordPress plugin versions 1.2.5 and earlier Description The YaDisk Files WordPress plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripti...

Debian dla-3962 : libglib2.0-0 - security update

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-3962 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3962-1 [email protected] https://www.debian.org/lts/security/...

[SECURITY] [DLA 3962-1] glib2.0 security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3962-1 [email protected] https://www.debian.org/lts/security/ Adrian Bunk November 23, 2024 https://wiki.debian.org/LTS -...

CVE-2023-7299 DataGear resolveSql sql injection

A vulnerability was found in DataGear up to 4.60. It has been declared as critical. This vulnerability affects unknown code of the file /dataSet/resolveSql. The manipulation of the argument sql leads to sql injection. The attack can be initiated remotely. Upgrading to version 4.7.0 is able to...

PT-2024-16935 · WordPress · Pdf Invoices & Packing Slips Generator For Woocommerce

Name of the Vulnerable Software and Affected Versions: PDF Invoices & Packing Slips Generator for WooCommerce plugin for WordPress versions up to, and including, 2.2.1 Description: The issue arises from the use of add query arg without proper escaping on the URL, leading to Reflected Cross-Site...

PT-2024-16620 · WordPress · The Tribute Testimonials

Name of the Vulnerable Software and Affected Versions: The Tribute Testimonials – WordPress Testimonial Grid/Slider plugin versions up to, and including, 1.0.4 Description: The issue is related to Stored Cross-Site Scripting via the plugin's tribute testimonials slider shortcode due to insufficie...

org.apache.commons:commons-compress Dependency in Confluence Data Center and Server

This High severity org.apache.commons:commons-compress Dependency vulnerability was introduced in versions 7.14 of Confluence Data Center and Server. This org.apache.commons:commons-compress Dependency vulnerability, with a CVSS Score of 8.1 and a CVSS Vector of...

org.apache.commons:commons-compress Dependency in Bamboo Data Center and Server

This High severity org.apache.commons:commons-compress Dependency vulnerability was introduced in versions 9.0.0, 9.1.0, 9.2.1, 9.3.0, 9.4.0, and 9.5.0 of Bamboo Data Center and Server. This org.apache.commons:commons-compress Dependency vulnerability, with a CVSS Score of 8.1 and a CVSS Vector o...

OSCAT Basic Library

RISK EVALUATION Successful exploitation of this vulnerability allows an local, unprivileged attacker to access limited internal data of the PLC, which may lead to a crash of the affected service. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of...

Arbitrary command execution through gitRepo volume

A security vulnerability was discovered in Kubernetes that could allow a user with the ability to create a pod and associate a gitRepo volume to execute arbitrary commands beyond the container boundary. This vulnerability leverages the hooks folder in the target repository to run arbitrary comman...

PT-2024-35313 · Unknown · Html5 Lyrics Karaoke Player

Name of the Vulnerable Software and Affected Versions: HTML5 Lyrics Karaoke Player versions n/a through 2.4 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Reflected XSS attacks...

CVE-2024-31141 Apache Kafka Clients: Privilege escalation to filesystem read-access via automatic ConfigProvider

Files or Directories Accessible to External Parties, Improper Privilege Management vulnerability in Apache Kafka Clients. Apache Kafka Clients accept configuration data for customizing behavior, and includes ConfigProvider plugins in order to manipulate these configurations. Apache Kafka also...

PT-2024-35022 · Unknown · Saleswizard Crm Plugin

Name of the Vulnerable Software and Affected Versions: Official SalesWizard CRM Plugin versions 1.0.2 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows stored cross-site scripting XSS. This means an attacker can inject...

PT-2024-34963 · Teconce · Teconce Wezido

Name of the Vulnerable Software and Affected Versions: Teconce Wezido versions 1.2 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing DOM-Based XSS. This means that an attacker can inject...

PT-2024-32978 · Unknown · Weaver E-Cology

Name of the Vulnerable Software and Affected Versions: Weaver E-cology versions 9. Description: A vulnerability in Weaver E-cology allows attackers to use race conditions to bypass security mechanisms, potentially leading to the upload of malicious files and control of server privileges...