olm-sys: wrapped library unmaintained, potentially vulnerable

After several cryptographic vulnerabilities in libolm were disclosed publicly, the Matrix Foundation has officially deprecated the library. olm-sys is a thin wrapper around libolm and is now deprecated and potentially vulnerable in kind. Users of olm-sys and its higher-level abstraction, olm-rs,...

Malicious code in @diotoborg/rerum-excepturi-nostrum (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0fa444c08981ef3df01f86ea014c351119efd804037799cecbb080b5cf37fce8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @diotoborg/ipsam-ad (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2b2f53a6196965b028d7b07e0a24722319b3da058b627fd598edee431d0a12b7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-8620 Malicious code in @diotoborg/sapiente-error (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c0b589ba30419dc49921cf11769970c733f6a570311948437935a21b72ca7e4a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2024-6139 · Zyxel · Wax655E +4

Name of the Vulnerable Software and Affected Versions: Zyxel NWA1123ACv3 versions 6.70ABVT.4 and earlier Zyxel WAC500 versions 6.70ABVS.4 and earlier Zyxel WAX655E versions 7.00ACDO.1 and earlier Zyxel WBE530 versions 7.00ACLE.1 and earlier Zyxel USG LITE 60AX version V2.00ACIP.2 Description: The...

PT-2024-37958

Name of the Vulnerable Software and Affected Versions NACPremium versions through 01082024 Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Stored XSS attacks. The estimated number of potentially...

CVE-2024-21658 Insufficient control of region value length in discourse-calendar

discourse-calendar is a discourse plugin which adds the ability to create a dynamic calendar in the first post of a topic. The limit on region value length is too generous. This allows a malicious actor to cause a Discourse instance to use excessive bandwidth and disk space. This issue has been...

[SECURITY] [DSA 5761-1] chromium security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5761-1 [email protected] https://www.debian.org/security/ Andres Salomon August 29, 2024 https://www.debian.org/security/faq -...

PT-2024-28661 · Ibm · Ibm Sterling Connect:Direct Web Services

Name of the Vulnerable Software and Affected Versions: IBM Sterling Connect:Direct Web Services versions 6.0 through 6.3 Description: The issue concerns the use of default credentials for potentially critical functionality in IBM Sterling Connect:Direct Web Services. This could pose a significant...

PT-2024-37737 · Lightdash · Lightdash

Name of the Vulnerable Software and Affected Versions: Lightdash version 0.1024.6 Description: Multiple stored cross-site scripting XSS vulnerabilities in the markdown dashboard and dashboard comment functionality allow remote authenticated threat actors to inject malicious scripts into vulnerabl...

PT-2024-38949 · Unknown · Master-Nan Sweet-Cms

Name of the Vulnerable Software and Affected Versions: master-nan Sweet-CMS up to 5f441e022b8876f07cde709c77b5be6d2f262e3f Description: A vulnerability was found in master-nan Sweet-CMS, affecting the function LogHandler of the file middleware/log.go. The manipulation leads to improper output...

Delta Electronics DTN Soft

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.4 ATTENTION : Low attack complexity Vendor : Delta Electronics Equipment : DTN Soft Vulnerability : Deserialization of Untrusted Data 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to achieve remote code execution...

PT-2024-27139 · WordPress · Web Directory Free Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Web Directory Free WordPress plugin versions prior to 1.7.3 Description: The issue is related to a Local File Inclusion problem. It occurs because the plugin does not validate a parameter before using it in an include, which could lead to Loc...

PT-2024-33715

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.6.58 Description: A dentry leak may occur in the Linux kernel when a lookup cookie and a cull are concurrent. This happens because the reference count obtained by lookup one positive unlocked in cachefiles loo...

PT-2024-38583 · WordPress · The 140+ Widgets | Xpro Addons For Elementor

Name of the Vulnerable Software and Affected Versions: The 140+ Widgets | Xpro Addons For Elementor – FREE plugin for WordPress versions up to, and including, 1.4.4.3 Description: The issue is related to Stored Cross-Site Scripting via the arrow parameter within the Post Grid widget due to...

UBUNTU-CVE-2024-43802

Vim is an improved version of the unix vi text editor. When flushing the typeahead buffer, Vim moves the current position in the typeahead buffer but does not check whether there is enough space left in the buffer to handle the next characters. So this may lead to the tboff position within the...

PT-2024-30432 · WordPress · Wpbackitup Backup/Restore

Name of the Vulnerable Software and Affected Versions: WPBackItUp Backup and Restore WordPress versions 1.50 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the WPBackItUp Backup and Restore WordPress plugin. This allows an attacker to perform unintended actions on a user...

PT-2024-31514 · Req · Req

Name of the Vulnerable Software and Affected Versions: req package versions prior to 3.43.4 Description: The req package may send an unintended request when a malformed URL is provided, due to the cleanHost function in http.go using a "garbage in, garbage out" design. This can lead to security...

PT-2024-32180

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.52 Description The main threat to data consistency in ice xdp is a possible asynchronous PF reset, which can be triggered by a user or by TX timeout handler. XDP setup and PF reset code access the same...

PT-2024-30262 · Autman · Autman

Name of the Vulnerable Software and Affected Versions: autMan version 2.9.6 Description: The issue is related to an access control problem. It is reported that this problem can be exploited in autMan version 2.9.6. Recommendations: For autMan version 2.9.6, upgrade to version 3.0.1 to secure your...