PT-2024-35055 · Unknown · Websand Subscription Form

Name of the Vulnerable Software and Affected Versions: Websand Subscription Form versions 1.0.3 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for stored cross-site scripting XSS. This means that an attacker can inject...

PT-2024-16721 · WordPress · Wpb Popup For Contact Form 7

Name of the Vulnerable Software and Affected Versions: WPB Popup for Contact Form 7 versions 1.7.5 and earlier Description: The issue is related to arbitrary shortcode execution via the wpb pcf fire contact form AJAX action. This is due to the software allowing users to execute an action that doe...

CVE-2024-0012 PAN-OS: Authentication Bypass in the Management Web Interface (PAN-SA-2024-0015)

An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges to perform administrative actions, tamper with the configuration, or exploit other authenticated privilege...

CVE-2024-9526 Stored XSS in Kubeflow Pipeline View

There exists a stored XSS Vulnerability in Kubeflow Pipeline View web UI. The Kubeflow Web UI allows to create new pipelines. When creating a new pipeline, it is possible to add a description. The description field allows html tags, which are not filtered properly. Leading to a stored XSS. We...

GHSA-QVF5-HVJX-WM27 Apache Tomcat Request and/or response mix-up

Incorrect object re-cycling and re-use vulnerability in Apache Tomcat. Incorrect recycling of the request and response used by HTTP/2 requests could lead to request and/or response mix-up between users. This issue affects Apache Tomcat: from 11.0.0-M23 through 11.0.0-M26, from 10.1.27 through...

PT-2024-35258 · Cactusthemes · Cactusthemes Gameplan

Name of the Vulnerable Software and Affected Versions: CactusThemes Gameplan versions 1.5.10 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Reflected XSS. Recommendations: For...

PT-2024-35257 · Unknown · Reconstruction

Name of the Vulnerable Software and Affected Versions: ReConstruction versions 1.4.7 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Reflected XSS. Recommendations: For versions...

GLSA-202411-07 : Pillow: Arbitrary code execution

The remote host is affected by the vulnerability described in GLSA-202411-07 Pillow: Arbitrary code execution A vulnerability has been discovered in Pillow. Please review the CVE identifier referenced below for details. Tenable has extracted the preceding description block directly from the Gento...

[SECURITY] [DLA 3955-1] waitress security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3955-1 [email protected] https://www.debian.org/lts/security/ Adrian Bunk November 16, 2024 https://wiki.debian.org/LTS -...

Malicious code in seller-rn-mng-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 92086f415cec1b766cd8be30c674b6841262d14cae307bfc7060691b93c93078 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2024-35471 · Flagsmith · Flagsmith

Name of the Vulnerable Software and Affected Versions: Flagsmith versions prior to 2.134.1 Description: The issue allows bypassing the ALLOW REGISTRATION WITHOUT INVITE setting. Recommendations: For versions prior to 2.134.1, update to version 2.134.1 or later to resolve the issue...

PT-2024-8602 · Apache · Apache Ofbiz

Name of the Vulnerable Software and Affected Versions: Apache OFBiz versions prior to 18.12.17 Description: The issue is related to improper control of code generation, allowing for code injection, and also involves cross-site request forgery CSRF and improper neutralization of special elements...

CVE-2024-52517

CVE-2024-52517 affects Nextcloud Server (and Enterprise Server) where, after storing global credentials for external storage, the API returns them and injects them into the frontend, enabling plaintext read by someone with an active user session. This information disclosure risk is limited to use...

CVE-2024-52521 Nextcloud Server has a potential hash collision for background jobs could skip queuing them

Nextcloud Server is a self hosted personal cloud system. MD5 hashes were used to check background jobs for their uniqueness. This increased the chances of a background job with arguments falsely being identified as already existing and not be queued for execution. By changing the Hash to SHA256 t...

PT-2024-9206

Name of the Vulnerable Software and Affected Versions: Apache Airflow versions before 2.10.3 Description: The issue is related to the exposure of sensitive configuration variables in task logs. This could allow unauthorized users to access critical data, potentially compromising the security of t...

PT-2024-34546 · Jepaas · Jepaas

Name of the Vulnerable Software and Affected Versions: JEPaaS version 7.2.8 Description: The issue is related to SQL injection vulnerability in multiple parameters via the "/je/login/btnLog/insertBtnLog" API endpoint. This could allow a remote user to submit a specially crafted query, enabling an...

PT-2024-16608 · WordPress · Gallery Manager

Name of the Vulnerable Software and Affected Versions: Gallery Manager plugin for WordPress versions up to, and including, 1.6.58 Description: The Gallery Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove Query Arg without appropriate escaping o...

Progress Telerik Report Server <= 10.2.24.924 Encryption Weakness (CVE-2024-7295)

The version of Progress Telerik Report Server installed on the remote host is affected by an encryption weakness vulnerability: - The encryption of local asset data used an older algorithm which may allow a sophisticated actor to decrypt this information. CVE-2024-7295 Note that Nessus has not...

PT-2024-8896

Name of the Vulnerable Software and Affected Versions: PHP versions 8.1. before 8.1.31 PHP versions 8.2. before 8.2.26 PHP versions 8.3. before 8.3.14 Description: The issue is related to insufficient protection of internal data due to a buffer overflow in memory, which can be exploited by a...

torchgeo Python Library < 0.6.1 RCE

The version of the torchgeo Python library installed on the remote host is prior to 0.6.1. It is, therefore, affected by a remote code execution vulnerability. The usage of 'eval' in torchgeo's 'getweight' API function could allow an unauthenticated, remote attacker to execute arbitrary commands...