BELL-CVE-2024-40997

Bulletin has no description...

BELL-CVE-2024-41000

Bulletin has no description...

BELL-CVE-2024-39495

Bulletin has no description...

BELL-CVE-2024-39494

Bulletin has no description...

Citrix uberAgent Security Bulletin for CVE-2024-3902

A vulnerability has been discovered in Citrix uberAgent, which, if exploited, may result in the escalation of privileges of the attacker. This vulnerability only impacts uberAgent and does not impact any other Citrix and or Cloud Software Group products. Affected Versions: The following supported...

BIT-GITLAB-2024-2880 Improper Access Control in GitLab

An issue was discovered in GitLab CE/EE affecting all versions starting from 16.5 prior to 16.11.6, starting from 17.0 prior to 17.0.4, and starting from 17.1 prior to 17.1.2 in which a user with admingroupmember custom role permission could ban group members...

OSV-2024-635 Null-dereference READ in do_evp_kdf

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=69243 Crash type: Null-dereference READ Crash state: doevpkdf FuzzerTestOneInput...

PT-2024-35458 · Unknown · Wp-Affiliate-Platform

Name of the Vulnerable Software and Affected Versions: wp-affiliate-platform versions prior to 6.5.1 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back in the page. This cou...

PT-2024-35465 · Unknown · Wp-Affiliate-Platform

Name of the Vulnerable Software and Affected Versions: wp-affiliate-platform versions prior to 6.5.1 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back in the page. This cou...

MAL-2024-7750 Malicious code in discord-api-ts (npm)

This package is considered malicious because it contains a heavily obfuscated postinstall.js script with multiple stages of payload execution, resulting in the delivery of QuasarRAT. This allows command and control by a malicious actor. --- -= Per source details. Do not edit below this line.=-...

BELL-CVE-2024-6655

Bulletin has no description...

The vulnerability of the “Document Approval Service” software lies in the improper limitation of the path name to the catalog, allowing a violator to gain read access to local files.

The vulnerability of the “Service for Document Approval” software is related to incorrect restrictions on the path to the catalog. Exploiting this vulnerability can allow a remote attacker to gain read access to local files...

CVE-2024-40547

PublicCMS v4.0.202302.e was discovered to contain an arbitrary file content replacement vulnerability via the component /admin/cmsTemplate/replace...

BELL-CVE-2024-39493

Bulletin has no description...

BELL-CVE-2024-39489

Bulletin has no description...

BELL-CVE-2024-39487

Bulletin has no description...

MAL-2024-7699 Malicious code in bootrun (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2fe0b4ba6593b11b85748383f8075db213c342a34223f8a3fda3f166008e5eff Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7456 Malicious code in kontolq (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eb20ed455cfe8cf16c5643efa4bb8b5d2c696159dd00577cd8c648e194294a8e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7481 Malicious code in yorz (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 45c5ff0124b5fef27210916da169a670acebe845cde5013de7e183430795bcff Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

@discordjs/opus vulnerable to Denial of Service

All versions of the package @discordjs/opus are vulnerable to Denial of Service DoS due to providing an input object with a property toString to several different functions. Exploiting this vulnerability could lead to a process crash...