Sylius has potential Cross Site Scripting vulnerability via the "Province" field in the Checkout and Address Book

Impact There is a possibility to save XSS code in province field in the Checkout and Address Book and then execute it on these pages. The problem occurs when you open the address step page in the checkout or edit the address in the address book. This only affects the base UI Shop provided by...

GHSA-V2F9-RV6W-VW8R Sylius potentially vulnerable to Cross Site Scripting via "Name" field (Taxons, Products, Options, Variants) in Admin Panel

Impact There is a possibility to execute javascript code in the Admin panel. In order to perform an XSS attack input a script into Name field in which of the resources: Taxons, Products, Product Options or Product Variants. The code will be executed while using an autocomplete field with one of t...

rhel-system-roles bug fix and enhancement update

An update is available for rhel-system-roles. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky...

python3.12-mod_wsgi bug fix and enhancement update

An update is available for python3.12-modwsgi. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky...

AIX (IJ50602)

The version of AIX installed on the remote host is prior to APAR IJ50602. It is, therefore, affected by a vulnerability as referenced in the IJ50602 advisory. - An issue was discovered in libxml2 before 2.11.7 and 2.12.x before 2.12.5. When using the XML Reader interface with DTD validation and...

AIX (IJ50424)

The version of AIX installed on the remote host is prior to APAR IJ50424. It is, therefore, affected by a vulnerability as referenced in the IJ50424 advisory. - sendmail through 8.17.2 allows SMTP smuggling in certain configurations. Remote attackers can use a published exploitation technique to...

SUSE-SU-2024:1568-1 Security update for ghostscript

This update for ghostscript fixes the following issues: - CVE-2023-52722: Do not allow eexec seeds other than the Type 1 standard while using SAFER mode bsc1223852...

PT-2024-12219 · Phpok · Phpok

Name of the Vulnerable Software and Affected Versions: phpok version 6.4.003 Description: The issue concerns SQL injection in the index f function located in phpok64/framework/api/call control.php. This allows for potential exploitation of the SQL injection vulnerability. Recommendations: For php...

PT-2024-11567 · Nuki · Nuki Keypad +1

Name of the Vulnerable Software and Affected Versions: Nuki Keypad versions prior to 1.9.2 Nuki Fob versions prior to 1.8.1 Description: An issue was discovered on certain Nuki Home Solutions devices, where an attacker with physical access to the JTAG port may be able to connect to the device and...

Pixel Watch Security Bulletin—May 2024Stay organized with collectionsSave and categorize content based on your preferences.

The Pixel Watch Security Bulletin contains details of security vulnerabilities affecting Pixel Watch devices Google Devices. For Google devices, security patch levels of 2024-05-05 or later address all applicable issues in the May 2024 Android Security Bulletin and all issues in this bulletin. To...

CVE-2024-31584 affecting package pytorch for versions less than 2.0.0-5

CVE-2024-31584 affecting package pytorch for versions less than 2.0.0-5. A patched version of the package is available...

PT-2024-28123 · WordPress · Folders Pro

Name of the Vulnerable Software and Affected Versions: Folders Pro plugin for WordPress versions up to, and including, 3.0.2 Description: The issue is related to Stored Cross-Site Scripting, which occurs due to insufficient input sanitization and output escaping of a user's First Name and Last...

GHSA-G7VV-2V7X-GJ9P tqdm CLI arguments injection attack

Impact Any optional non-boolean CLI arguments e.g. --delim, --buf-size, --manpath are passed through python's eval, allowing arbitrary code execution. Example: sh python -m tqdm --manpath="" + strexec"import os\nos.system'echo hi && killall python3'" + "" Patches...

CVE-2024-34067

CVE-2024-34067 affects the Pterodactyl panel. The issue allows cross-site scripting (XSS) via importing a malicious egg or gaining access to a wings instance, potentially enabling an administrator account takeover. The vulnerability impacts Egg Docker images and Egg variables (Name, Environment v...

GHSA-VHXV-FG4M-P2W8 Some CORS middleware allow untrusted origins

Impact Some CORS middleware more specifically those created by specifying two or more origin patterns whose hosts share a proper suffix incorrectly allow some untrusted origins, thereby opening the door to cross-origin attacks from the untrusted origins in question. For example, specifying origin...

CVE-2024-34068 Server-side Request Forgery during remote file pull in Pterodactyl wings

Pterodactyl wings is the server control plane for Pterodactyl Panel. An authenticated user who has access to a game server is able to bypass the previously implemented access control GHSA-6rg3-8h8x-5xfv that prevents accessing internal endpoints of the node hosting Wings in the pull endpoint. Thi...

CVE-2024-30251 Denial of service when trying to parse malformed POST requests in aiohttp

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In affected versions an attacker can send a specially crafted POST multipart/form-data request. When the aiohttp server processes it, the server will enter an infinite loop and be unable to process any further request...

CVE-2024-30251 Denial of service when trying to parse malformed POST requests in aiohttp

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In affected versions an attacker can send a specially crafted POST multipart/form-data request. When the aiohttp server processes it, the server will enter an infinite loop and be unable to process any further request...

USN-6747-2 firefox regressions

USN-6747-1 fixed vulnerabilities in Firefox. The update introduced several minor regressions. This update fixes the problem. Original advisory details: Multiple security issues were discovered in Firefox. If a user were tricked into opening a specially crafted website, an attacker could potential...

PT-2024-26827 · WordPress · Wp Cookie Consent

Name of the Vulnerable Software and Affected Versions: WP Cookie Consent plugin for WordPress versions up to, and including, 3.0.2 Description: The issue is related to a missing capability check on the gdpr policy process delete function, which allows unauthorized loss of data. This makes it...