CVE-2024-43796 express vulnerable to XSS via response.redirect()

Express.js minimalist web framework for node. In express 4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect may execute untrusted code. This issue is patched in express 4.20.0...

PT-2024-9884

Name of the Vulnerable Software and Affected Versions: Nix versions 2.24 through 2.24.5 Nix version 2.24 prior to 2.24.6 Description: A bug in Nix allows a substituter or malicious user to craft a NAR that, when unpacked by Nix, causes Nix to write to arbitrary file system locations to which the...

PT-2024-6368

Name of the Vulnerable Software and Affected Versions MindsDB versions 23.11.4.2 through 24.7.4.1 Description An arbitrary code execution issue exists when one of several integrations is installed on the server. If a specially crafted UPDATE query containing Python code is run against a database...

PT-2024-6310 · Gitlab +2 · Gitlab +2

Name of the Vulnerable Software and Affected Versions: Ruby-SAML versions prior to 1.17.0 Ruby-SAML versions 1.13.0 through 1.16.0 GitLab versions prior to 17.3.3, 17.2.7, 17.1.8, 17.0.8, and 16.11.10 Description: The vulnerability is related to the Ruby SAML library, which is used for implementi...

Security Bulletin: IBM InfoSphere Information Server is vulnerable to SQL injection (CVE-2024-40689)

Summary A SQL injection vulnerability in IBM InfoSphere Information Server was addressed. Vulnerability Details CVEID:CVE-2024-40689 DESCRIPTION: IBM InfoSphere Server is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to...

PT-2024-9667 · Synology · Synology Router Manager

Name of the Vulnerable Software and Affected Versions: Synology Router Manager versions prior to 1.3.1-9346-10 Description: The issue is related to improper neutralization of input during web page generation, which can lead to Cross-site Scripting attacks. Remote authenticated users with...

OPENSUSE-SU-2024:14325-1 MozillaThunderbird-115.15.0-1.1 on GA media

These are all security issues fixed in the MozillaThunderbird-115.15.0-1.1 package on the GA media of openSUSE Tumbleweed...

CVE-2024-7383 affecting package libnbd for versions less than 1.12.1-4

CVE-2024-7383 affecting package libnbd for versions less than 1.12.1-4. A patched version of the package is available...

CVE-2024-24474 affecting package qemu for versions less than 6.2.0-20

CVE-2024-24474 affecting package qemu for versions less than 6.2.0-20. A patched version of the package is available...

CVE-2022-41717 affecting package containerized-data-importer for versions less than 1.55.0-20

CVE-2022-41717 affecting package containerized-data-importer for versions less than 1.55.0-20. A patched version of the package is available...

CVE-2022-33065 affecting package libsndfile for versions less than 1.0.31-3

CVE-2022-33065 affecting package libsndfile for versions less than 1.0.31-3. A patched version of the package is available...

CVE-2024-45294

A flaw was found in HAPI FHIR - HL7 FHIR Core Artifacts. eXtensible Stylesheet Language Transformations XSLT transforms performed by various components are vulnerable to XML external entity injections. A processed XML file with a malicious DTD tag could produce XML containing data from the host...

CVE-2023-51368 QTS, QuTS hero

A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to launch a denial-of-service DoS attack via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.6.2722...

CVE-2024-45294 `org.hl7.fhir.core` XXE vulnerability in XSLT transforms

The HL7 FHIR Core Artifacts repository provides the java core object handling code, with utilities including validator, for the Fast Healthcare Interoperability Resources FHIR specification. Prior to version 6.3.23, XSLT transforms performed by various components are vulnerable to XML external...

DEBIAN-CVE-2024-45405

gix-path is a crate of the gitoxide project an implementation of git written in Rust dealing paths and their conversions. Prior to version 0.10.11, gix-path runs git to find the path of a configuration file associated with the git installation, but improperly resolves paths containing unusual or...

[SECURITY] Fedora 40 Update: python-django4.2-4.2.16-1.fc40

Django is a high-level Python Web framework that encourages rapid development and a clean, pragmatic design. It focuses on automating as much as possible and adhering to the DRY Don't Repeat Yourself principle...

Cisco NX-OS Software Python Sbox Escape Multiple Vulnerabilities (cisco-sa-nxos-psbe-ce-YvbTn5du)

According to its self-reported version, Cisco NX-OS Software is affected by multiple vulnerabilities. - A vulnerability in the Python interpreter of Cisco NX-OS Software could allow an authenticated, low- privileged, local attacker to escape the Python sandbox and gain unauthorized access to the...

CVE-2024-24759

CVE-2024-24759 (MindsDB) : A DNS rebinding flaw allows bypassing SSRF protection across the MindsDB website prior to version 23.12.4.2, with potential denial-of-service. The issue is fixed in version 23.12.4.2 and later. Remediation: upgrade to 23.12.4.2+ (or later).

PT-2025-18291 · Xwiki · Xwiki

Name of the Vulnerable Software and Affected Versions: XWiki versions 13.5-rc-1 through 15.10.12 XWiki versions 16.0.0-rc-1 through 16.4.3 XWiki versions 16.5.0-rc-1 through 16.7.x Description: The issue is related to an open redirect vulnerability in the HTML conversion request filter. This allo...

sigstore-go has an unbounded loop over untrusted input can lead to endless data attack

Impact sigstore-go is susceptible to a denial of service attack when a verifier is provided a maliciously crafted Sigstore Bundle containing large amounts of verifiable data, in the form of signed transparency log entries, RFC 3161 timestamps, and attestation subjects. The verification of these...