PT-2024-9634 · Adobe · Experience Manager

Name of the Vulnerable Software and Affected Versions: Adobe Experience Manager versions 6.5.21 and earlier Description: The issue is related to a DOM-based Cross-Site Scripting XSS vulnerability. It could be exploited by an attacker to execute arbitrary code in the context of the victim's browse...

PT-2024-16143 · WordPress · Drop Shadow Boxes

Name of the Vulnerable Software and Affected Versions: Drop Shadow Boxes plugin for WordPress versions up to, and including, 1.7.14 Description: The issue is related to arbitrary shortcode execution due to the software allowing users to execute an action that does not properly validate a value...

[SECURITY] [DLA 3951-1] curl security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3951-1 [email protected] https://www.debian.org/lts/security/ Abhijith PA November 14, 2024 https://wiki.debian.org/LTS -...

Denial of service because of stack overflow with malicious decompression input

A denial of service vulnerability was found in zlib-rs, triggered by specially constructed input. This input causes a stack overflow, resulting in the process using zlib-rs to crash. Impact Due to the way LLVM handles the zlib-rs codebase, tail calls were not guaranteed. This caused certain input...

Baxter Life2000 Ventilation System

RISK EVALUATION Successful exploitation of these vulnerabilities could lead to information disclosure and/or disruption of the device's function without detection. 2. RECOMMENDED PRACTICES CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying...

Fedora 41 : dnsdist (2024-73b41ae8e5)

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-73b41ae8e5 advisory. Update to latest upstream Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested f...

PT-2024-35207 · WordPress · Hive Support – Wordpress Help Desk

Name of the Vulnerable Software and Affected Versions: Hive Support – WordPress Help Desk versions 1.1.1 and earlier Description: The issue allows for the unrestricted upload of files with dangerous types, potentially enabling an attacker to upload a web shell to a web server. This could grant an...

Fedora 41 : webkit2gtk4.0 (2024-58de5ad94f)

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-58de5ad94f advisory. Update to 2.46.3 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested f...

PT-2024-38581 · Unknown · Vsrm Supplier Relationship Management System

Name of the Vulnerable Software and Affected Versions: vSRM Supplier Relationship Management System versions prior to 28.08.2024 Description: The issue affects the vSRM Supplier Relationship Management System, allowing Reflected XSS, or Cross-Site Scripting XSS, due to improper neutralization of...

PT-2024-35210 · Unknown · Devexhub Gallery

Name of the Vulnerable Software and Affected Versions: Devexhub Gallery versions n/a through 2.0.1 Description: The issue allows for the unrestricted upload of files with dangerous types, enabling an attacker to upload a web shell to a web server. This can lead to potential exploitation and...

PT-2024-16629 · WordPress · Tutor Lms Elementor Addons

Name of the Vulnerable Software and Affected Versions: Tutor LMS Elementor Addons plugin for WordPress versions up to, and including, 2.1.5 Description: The issue is related to a missing capability check on the install etlms dependency plugin function, allowing authenticated attackers with...

Fedora 41 : rapidjson (2024-5e0da8577a)

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-5e0da8577a advisory. Automatic update for rapidjson-1.1.0-41.fc41. Changelog Wed Jul 10 2024 Tom Hughes - 1.1.0-41 - Add patch for CVE-2024-38517 aka RHBZ2296979 Tenable has...

Fedora 41 : chromium (2024-a59306afa3)

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-a59306afa3 advisory. Update to 129.0.6668.100 CVE-2024-9602: Type Confusion in V8 CVE-2024-9603: Type Confusion in V Tenable has extracted the preceding description bloc...

Fedora 41 : chromium (2024-3a6f9ab958)

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-3a6f9ab958 advisory. Update to 130.0.6723.58 High CVE-2024-9954: Use after free in AI Medium CVE-2024-9955: Use after free in Web Authentication Medium CVE-2024-9956:...

CVE-2024-11175 Public CMS Voting Management save cross site scripting

A vulnerability was found in Public CMS 5.202406.d and classified as problematic. This issue affects some unknown processing of the file /admin/cmsVote/save of the component Voting Management. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has be...

WordPress Plugin "VK All in One Expansion Unit" vulnerable to cross-site scripting

Overview "Custom Alert Content" of WordPress Plugin "VK All in One Expansion Unit" provided by Vektor,Inc. contains a stored cross-site scripting vulnerability CWE-79. Umeda Yuugo of Tokyo Denki University reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under...

PT-2024-16790 · WordPress · Wordpress User Extra Fields

Name of the Vulnerable Software and Affected Versions: WordPress User Extra Fields plugin versions up to, and including, 16.6 Description: The WordPress User Extra Fields plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete tmp...

PT-2024-35375 · Jenkins · Jenkins Openid Connect Authentication Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins OpenId Connect Authentication Plugin versions 4.418.vccc7061f5b 6d and earlier Description: The issue arises because the plugin does not invalidate the previous session on login, allowing attackers to potentially use social engineerin...

TIBCO Security Advisory: November 12, 2024 - TIBCO Hawk & Operational Intelligence - CVE-2024-10217

TIBCO Hawk Stored-XSS Vulnerability Original release date: November 12, 2024 Last revised: --- CVE-2024-10217 Source: TIBCO Software Inc. Products Affected TIBCO Hawk versions 6.2.0, 6.2.1, 6.2.2, 6.2.3, 6.2.4, and 6.3.0 TIBCO Operational Intelligence Hawk versions 7.2.0, 7.2.1, and 7.2.2 Compone...

Rockwell Automation FactoryTalk View ME

RISK EVALUATION Successful exploitation of this vulnerability could allow a local low-privileged user to escalate their privileges by changing the macro to execute arbitrary code. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this...