CVE-2023-4895

Affected product: GitLab Enterprise Edition (GitLab EE). Vulnerable components: environment details exposure via bypassing group IP restriction, across versions 12.0–16.7.6, 16.8 before 16.8.3, and 16.9 before 16.9.1. Root cause: bypass of group IP restriction settings enabling unauthorized acces...

PT-2024-21332 · Unknown · Focus For Ios

Name of the Vulnerable Software and Affected Versions: Focus for iOS versions prior to 123 Description: This issue allows an attacker to conduct a Universal Cross-Site Scripting UXSS attack on a victim website using a 302 redirect, provided the victim has a link to the attacker's website...

PT-2024-1927

Name of the Vulnerable Software and Affected Versions Rack versions prior to 2.2.8.1 Rack versions prior to 3.0.9.1 Description The issue is related to a denial of service vulnerability in Rack's content type parsing, where carefully crafted content type headers can cause the media type parser to...

PT-2024-19386 · Apache · Apache Answer

Name of the Vulnerable Software and Affected Versions: Apache Answer versions through 1.2.1 Description: The issue affects Apache Answer, allowing a logged-in user to cause a Pixel Flood Attack by uploading large pixel files, which can cause the server to run out of memory. This can be done by...

PT-2024-14104 · Snakeyaml +1 · Snakeyaml +1

Name of the Vulnerable Software and Affected Versions: Hertzbeat versions prior to 1.4.1 Description: Hertzbeat is a real-time monitoring system. At the interface of "/define/yml", SnakeYAML is used as a parser to parse yml content, but no security configuration is used, resulting in a YAML...

CVE-2024-25117

Summary: CVE-2024-25117 affects php-svg-lib prior to 0.5.2. The library does not validate that font-family values are not PHAR URLs in SVG font rendering, which can lead to unsafe fontName values being passed to downstream libraries and, in PHP

Incorrect Authorization

liferay portal is vulnerable to Incorrect Authorization. The vulnerability is caused due to not restricting membership of a child site when the Limit membership to members of the parent site option is enabled. This allows remote authenticated users to add users who are not a member of the parent...

Code injection

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sonoma 14.1. An app may gain unauthorized access to Bluetooth...

Code injection

A permissions issue was addressed with additional restrictions. This issue is fixed in tvOS 17.1, watchOS 10.1, macOS Sonoma 14.1, iOS 17.1 and iPadOS 17.1. An app may be able to access sensitive user data...

PT-2024-20571 · John Tendik · Jtrt Responsive Tables

Name of the Vulnerable Software and Affected Versions: JTRT Responsive Tables versions through 4.1.9 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability in John Tendik JTRT Responsive Tables. This type of vulnerability allows an attacker to trick a user into performing...

PT-2024-20704 · Ibm · Vios +1

Name of the Vulnerable Software and Affected Versions: IBM AIX version 7.3 VIOS version 4.1 Description: The issue allows a non-privileged local user to execute arbitrary commands due to a vulnerability in the Perl implementation. A remote attacker could bypass security restrictions by exploiting...

PT-2024-20862 · Slims · Slims

Name of the Vulnerable Software and Affected Versions: SLIMS Senayan Library Management Systems 9 Bulian version 9.6.1 Description: The issue is related to SQL Injection via the pop-scope-vocabolary.php file. This allows for potential exploitation. No information is provided about the estimated...

PT-2024-16346 · WordPress · Event Tickets/Registration

Name of the Vulnerable Software and Affected Versions: Event Tickets and Registration plugin for WordPress versions up to, and including, 5.8.1 Description: The issue is related to a missing capability check on the email action, allowing authenticated attackers with contributor-level access and...

Gitlab -- Vulnerabilities

Gitlab reports: Stored-XSS in user's profile page User with "admingroupmembers" permission can invite other groups to gain owner access ReDoS issue in the Codeowners reference extractor LDAP user can reset password using secondary email and login using direct authentication Bypassing group ip...

GitLab 12.0 < 16.7.6 / 16.8 < 16.8.3 / 16.9 < 16.9.1 (CVE-2023-4895)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - An issue has been discovered in GitLab EE affecting all versions starting from 12.0 to 16.7.6, all versions starting from 16.8 before 16.8.3, all versions starting from 16.9 before 16.9.1. This...

Liferay Portal and Liferay DXP Does Not Properly Restrict Membership to Child Site Based on Parent Site Options

Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions does not properly restrict membership of a child site when the "Limit membership to members of the parent site" option is enabled,...

CVE-2024-25149

Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions does not properly restrict membership of a child site when the "Limit membership to members of the parent site" option is enabled,...

CVE-2024-25149

CVE-2024-25149 affects Liferay Portal 7.2.0–7.4.1 and Liferay DXP 7.3 before SP3 (and older/unsupported versions), where the policy to limit membership to the parent site does not properly restrict membership in a child site. This enables remote authenticated users to add non-members of the paren...

CVE-2024-25149

Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and older unsupported versions does not properly restrict membership of a child site when the "Limit membership to members of the parent site" option is enabled,...

PT-2024-3058 · Qemu +5 · Qemu +5

Name of the Vulnerable Software and Affected Versions: QEMU versions prior to 8.2.0 Description: The issue is related to an integer underflow and a resultant buffer overflow in QEMU, which can occur through a TI command when the expected non-DMA transfer length is less than the length of the...