PT-2024-34232 · Unknown · Qode Essential Addons

Name of the Vulnerable Software and Affected Versions: Qode Essential Addons versions 1.6.3 and earlier Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion'. This is a type of vulnerability tha...

PT-2024-34209

Name of the Vulnerable Software and Affected Versions: Theme Horse NewsCard versions 1.3 and earlier Description: The issue is related to an improper control of filename for include/require statement in PHP, known as 'PHP Remote File Inclusion'. This allows for potential remote code execution...

PT-2024-8321

Name of the Vulnerable Software and Affected Versions REXML gem versions prior to 3.3.9 Ruby 3.1 Description The issue is related to a ReDoS vulnerability in the REXML gem when parsing XML with many digits between & and x...; in a hex numeric character reference &x...;. This vulnerability can be...

Debian dsa-5798 : activemq - security update

The remote Debian 12 host has packages installed that are affected by a vulnerability as referenced in the dsa-5798 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-5798-1 [email protected] https://www.debian.org/security/ Moritz...

EulerOS Virtualization 2.12.1 : python-urllib3 (EulerOS-SA-2024-2761)

According to the versions of the python-urllib3 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : urllib3 is a user-friendly HTTP client library for Python. When using urllib3's proxy support with ProxyManager, the...

EulerOS Virtualization 2.12.1 : httpd (EulerOS-SA-2024-2751)

According to the versions of the httpd packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Encoding problem in modproxy in Apache HTTP Server 2.4.59 and earlier allows request URLs with incorrect encoding to be sent to...

EulerOS Virtualization 2.12.0 : python-pip (EulerOS-SA-2024-2778)

According to the versions of the python-pip packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : urllib3 is a user-friendly HTTP client library for Python. urllib3 previously wouldn't remove the HTTP request body when an HTT...

EulerOS Virtualization 2.12.0 : python-urllib3 (EulerOS-SA-2024-2779)

According to the versions of the python-urllib3 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : urllib3 is a user-friendly HTTP client library for Python. When using urllib3's proxy support with ProxyManager, the...

[SECURITY] [DLA 3936-1] activemq security update

Debian LTS Advisory DLA-3936-1 [email protected] https://www.debian.org/lts/security/ Santiago Ruano Rincón October 25, 2024 https://wiki.debian.org/LTS Package : activemq Version : 5.16.1-1+deb11u1 CVE ID : CVE-2022-41678 CVE-2023-46604 Debian Bug : 1054909 Two vulnerabilities were fou...

DoS (Denial of Service) minimatch Dependency in Confluence Data Center

This High severity minimatch Dependency vulnerability was introduced in versions 7.19.0 of Confluence Data Center. This minimatch Dependency vulnerability, with a CVSS Score of 7.5, allows an unauthenticated attacker to expose assets in your environment susceptible to exploitation which has no...

PT-2024-7460 · Cisco · Cisco Secure Client

Name of the Vulnerable Software and Affected Versions: Cisco Secure Client Software versions 4.10 and earlier Description: The issue is related to an integer underflow condition in the Internet Key Exchange version 2 IKEv2 processing of Cisco Secure Client Software. This could allow an...

[SECURITY] [DLA 3932-1] python-sql security update

Debian LTS Advisory DLA-3932-1 [email protected] https://www.debian.org/lts/security/ Santiago Ruano Rincón October 22, 2024 https://wiki.debian.org/LTS Package : python-sql Version : 1.2.1-1+deb11u1 CVE ID : CVE-2024-9774 Cédric Krier discovered that python-sql, a library to write SQL...

Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electric Products (Update C)

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION : Low attack complexity Vendor : ICONICS, Mitsubishi Electric Equipment : ICONICS Product Suite, Mitsubishi Electric MC Works64 Vulnerability : Incorrect Default Permissions 2. RISK EVALUATION Successful exploitation of this vulnerability could...

PT-2024-39544

Name of the Vulnerable Software and Affected Versions CPython versions prior to 3.13.0 Description A vulnerability has been found in the CPython venv module and CLI where path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into...

PT-2024-24264 · Ibm · Ibm Db2

Name of the Vulnerable Software and Affected Versions: IBM Db2 for Linux, UNIX and Windows includes Db2 Connect Server versions 10.5, 11.1, and 11.5 Description: The issue is related to a denial of service under specific configurations, where the server may crash when using a specially crafted SQ...

[SECURITY] [DLA 3929-1] openjdk-11 security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3929-1 [email protected] https://www.debian.org/lts/security/ Emilio Pozuelo Monfort October 21, 2024 https://wiki.debian.org/LTS -...

[SECURITY] [DLA 3927-1] openjdk-17 security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3927-1 [email protected] https://www.debian.org/lts/security/ Emilio Pozuelo Monfort October 21, 2024 https://wiki.debian.org/LTS -...

PT-2024-29025 · Joomla · Hikashop

Name of the Vulnerable Software and Affected Versions: HikaShop Joomla Component versions prior to 5.1.1 Description: A stored cross-site scripting XSS issue allows remote attackers to execute arbitrary JavaScript in a user's web browser. This is achieved by including a malicious payload in the...

PT-2024-33780

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.6.58 Description: A vulnerability in the Linux kernel has been resolved, related to the wifi driver rtw89. The issue occurs when SER L2 happens during the WoWLAN resume flow, causing the add interface flow to ...

PT-2024-28777 · Vilo · Vilo 5 Mesh Wifi System

Name of the Vulnerable Software and Affected Versions: Vilo 5 Mesh WiFi System versions up to 5.16.1.33 Description: A Command Injection issue allows remote, authenticated attackers to execute arbitrary code by injecting shell commands into the name of the Vilo device. This enables attackers to r...