CVE-2024-25640 Improper Neutralization of Alternate XSS Syntax in iris-web

Iris is a web collaborative platform that helps incident responders share technical details during investigations. A stored Cross-Site Scripting XSS vulnerability has been identified in iris-web, affecting multiple locations in versions prior to v2.4.0. The vulnerability may allow an attacker to...

KLA65144 Multiple vulnerabilities in Apache Tomcat

Multiple vulnerabilities were found in Apache Tomcat. Malicious users can exploit these vulnerabilities to cause denial of service. Below is a complete list of vulnerabilities: 1. A denial of service vulnerability in WebSocket client can be exploited remotely to cause denial of service. 2. A deni...

PT-2024-10825 · Gnome +1 · Gnome Glade +1

Name of the Vulnerable Software and Affected Versions: GNOME Glade versions 3.38.0 through 3.38.1 GNOME Glade versions 3.39.x through 3.39.x before 3.40.0 Description: The issue is related to the mishandling of widget rebuilding for GladeGtkBox in the glade-gtk-box.c file, leading to a denial of...

Updated: New Software Updates and Mitigations to Defend Against Exploitation of Ivanti Connect Secure and Policy Secure Gateways

Note: CISA will update this Alert with more information as it becomes available. Updated Feb. 15, 2024: On Feb. 14, 2024, Ivanti released new software updates for Ivanti Connect Secure and Ivanti Policy Secure. Review Ivanti's updated KB articlelink is external for more information. End of Feb. 1...

a-blog cms vulnerable to URL spoofing

Overview a-blog cms provided by appleple Inc. is a content management system CMS. a-blog cms contains an URL spoofing vulnerability CWE-451. Yuji Tounai of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security...

PAN-OS: Reflected Cross-Site Scripting (XSS) Vulnerability in GlobalProtect Portal

A reflected cross-site scripting XSS vulnerability in the GlobalProtect portal feature of Palo Alto Networks PAN-OS software enables execution of malicious JavaScript in the context of a user’s browser if that user clicks on a malicious link, allowing phishing attacks that could lead to credentia...

PT-2024-13667 · Cu Solutions · Cu Solutions Group Content Management System

Name of the Vulnerable Software and Affected Versions: CU Solutions Group CUSG Content Management System CMS versions prior to 7.75 Description: A Cross Site Scripting XSS issue allows a remote attacker to execute arbitrary code, escalate privileges, and obtain sensitive information via a crafted...

PT-2024-12489 · Intel · Intel Vroc

Name of the Vulnerable Software and Affected Versions: IntelR VROC software versions prior to 8.0.8.1001 Description: The issue allows an authenticated user to potentially enable escalation of privilege via local access due to path transversal in some IntelR VROC software. Recommendations: For...

DSA-5624-1 edk2 - security update

Bulletin has no description...

PT-2024-2124 · Adobe · Acrobat Reader +4

Name of the Vulnerable Software and Affected Versions: Acrobat Reader versions 20.005.30539 through 23.008.20470 and earlier Adobe Acrobat 2020 and earlier Adobe Acrobat Reader Document Cloud versions prior to the fixed version Adobe Acrobat Document Cloud versions prior to the fixed version...

PT-2024-2222 · Intel · Intel Thunderbolt Dch Drivers

Name of the Vulnerable Software and Affected Versions: IntelR ThunderboltTM DCH drivers for Windows versions prior to 88 Description: The issue is related to improper access control in some IntelR ThunderboltTM DCH drivers for Windows, which may allow an authenticated user to potentially enable...

Intel® SUR Advisory

Summary: A potential security vulnerability in some Intel® System Usage Report SUR software may allow denial of service. Intel is releasing software updates to mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2023-39941 Description: Improper access control in some Intel® S...

PT-2024-2714 · Intel · Intel Unite Client

Name of the Vulnerable Software and Affected Versions: Intel Unite Client versions prior to 4.2.35041 Description: The issue is related to improper access control in Intel Unite Client software, which may allow an authenticated user to potentially enable escalation of privilege via local access...

PT-2024-2684 · Zoom · Zoom

Name of the Vulnerable Software and Affected Versions: Zoom versions prior to the fixed version Description: The issue is related to an untrusted search path in some Zoom 32-bit Windows clients. This allows an authenticated user to conduct an escalation of privilege via local access...

Intel® Binary Configuration Tool Software Advisory

Summary: A potential security vulnerability in some Intel® Binary Configuration Tool software may allow escalation of privilege. Intel is releasing software updates to mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2023-24591 Description: Uncontrolled search path in some...

PT-2024-3263 · Intel · Intel Thunderbolt Dch Drivers

Name of the Vulnerable Software and Affected Versions: IntelR ThunderboltTM DCH drivers for Windows versions prior to 88 Description: The issue is related to improper access control in some IntelR ThunderboltTM DCH drivers for Windows, which may allow an authenticated user to potentially enable...

PT-2024-2732 · Intel +1 · Intel Proset/Wireless +2

Name of the Vulnerable Software and Affected Versions: IntelR PROSet/Wireless and IntelR KillerTM Wi-Fi software versions prior to 22.240 Description: The issue is related to improper initialization in the IntelR PROSet/Wireless and IntelR KillerTM Wi-Fi software, which may allow an unauthenticat...

Intel® OFU Software Advisory

Summary: A potential security vulnerability in some Intel® One Boot Flash Update OFU software may allow escalation of privilege. Intel is releasing software updates to mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2023-25945 Description: Protection mechanism failure in...

Intel® XTU Software Advisory

Summary: Potential security vulnerabilities in some Intel® Extreme Tuning Utility XTU software may allow escalation of privilege. Intel is releasing software updates to mitigate these potential vulnerabilities. Vulnerability Details: CVEID: CVE-2023-32647 Description: Improper access control in...

Intel® QAT Software Drivers Advisory

Summary: A potential security vulnerability in some Intel® QuickAssist Technology QAT software drivers for Windows may allow denial of service. Intel is releasing software updates to mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2023-41252 Description: Out-of-bounds rea...