PT-2024-33413 · Infomaniak · Vod Infomaniak

Name of the Vulnerable Software and Affected Versions: VOD Infomaniak versions 1.5.7 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on the affected system. This problem affects VOD Infomaniak, allowin...

JVN#31982676: MUSASI version 3 performing authentication on client-side

MUSASI provided by NEUMANN CO.LTD. is an e-learning system for driving schools. MUSASI version 3 performs authentication within the client-side code CWE-603, and the client in pre-authentication state retrieves the credential information from the server just when a user ID is input. This behavior...

SUSE-SU-2024:3696-1 Security update for the Linux Kernel (Live Patch 25 for SLE 15 SP4)

This update for the Linux Kernel 5.14.21-15040024116 fixes several issues. The following security issues were fixed: - CVE-2024-35861: Fixed potential UAF in cifssignalcifsdforreconnect bsc1225312. - CVE-2024-36899: gpiolib: cdev: Fix use after free in lineinfochangednotify bsc1225739. -...

Cisco Unified Contact Center Management Portal Reflected Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco Unified Contact Center Management Portal Unified CCMP could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting XSS attack against a user of the interface. This vulnerability exists because the...

Server-Side Request Forgery (SSRF)

Gradio is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to SSRF in the /queue/join endpoint, allowing attackers to exploit the asyncsaveurltocache function to make HTTP requests to user-controlled URLs. This can enable attackers to target internal servers, exfiltrate...

Improper Authentication vulnerability in Apache Solr

Solr instances using the PKIAuthenticationPlugin, which is enabled by default when Solr Authentication is used, are vulnerable to Authentication bypass. A fake ending at the end of any Solr API URL path, will allow requests to skip Authentication while maintaining the API contract with the origin...

PT-2024-29362 · Unknown · Codeigniter

Name of the Vulnerable Software and Affected Versions: Codeigniter version 3.1.13 Description: A Cross-Site Request Forgery CSRF issue allows attackers to arbitrarily change the Administrator password and escalate privileges. Recommendations: For Codeigniter version 3.1.13, update to a newer...

PT-2024-36912

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.74 Description A vulnerability in the Linux kernel's Bluetooth RFCOMM implementation could lead to a use-after-free issue. This occurs because bt sock alloc attaches an allocated sk object to the provided soc...

Security Bulletin: NVIDIA NeMo - October 2024

NVIDIA has released a software update for NVIDIA® NeMo. To protect your system, download and install this software update from the Releases tab on the NeMo Github page. Go to NVIDIA Product Security. Details This section provides a summary of potential vulnerabilities that this security update...

RHSA-2024:8026 Red Hat Security Advisory: thunderbird security update

Bulletin has no description...

PYSEC-2024-248

OpenCanary, a multi-protocol network honeypot, directly executed commands taken from its config file. Prior to version 0.9.4, where the config file is stored in an unprivileged user directory but the daemon is executed by root, it’s possible for the unprivileged user to change the config file and...

CGA-2PJ6-CQ6H-3WG7

Bulletin has no description...

PT-2024-39313 · Looker · Looker

Name of the Vulnerable Software and Affected Versions: Looker versions prior to 23.12.123 Looker versions prior to 23.18.117 Looker versions prior to 24.0.92 Looker versions prior to 24.6.77 Looker versions prior to 24.8.66 Looker versions prior to 24.10.78 Looker versions prior to 24.12.56 Looke...

CVE-2024-9180 Vault Operators in Root Namespace May Elevate Their Privileges

A privileged Vault operator with write permissions to the root namespace’s identity endpoint could escalate their own or another user’s privileges to Vault’s root policy. Fixed in Vault Community Edition 1.18.0 and Vault Enterprise 1.18.0, 1.17.7, 1.16.11, and 1.15.16...

CGA-3652-MR4R-QQJ4

Bulletin has no description...

PT-2024-32050 · Te Informatics · Nova Cms

Name of the Vulnerable Software and Affected Versions: TE Informatics Nova CMS versions prior to 5.0 Description: A SQL Injection vulnerability exists in TE Informatics Nova CMS due to a Hibernate flaw. This issue allows for SQL Injection, which can be exploited. Recommendations: For TE Informati...

PT-2024-21144 · Openfyde +1 · Openfyde +3

Name of the Vulnerable Software and Affected Versions: FydeOS for PC version 17.1 R114 FydeOS for VMware version 17.0 R114 FydeOS for You version 17.1 R114 OpenFyde version R114 Description: The issue allows attackers to gain root access without a password due to the root password being saved as ...

PT-2024-7462 · Mitel · Mitel Micollab

Name of the Vulnerable Software and Affected Versions: Mitel MiCollab versions prior to 9.8 SP1 FP2 9.8.1.201 Description: A vulnerability in the AWV component of Mitel MiCollab could allow an unauthenticated attacker to conduct a CRLF injection attack due to inadequate encoding of user input in...

Use After Free

Overview Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 is a package providing a default set of APIs for building an ASP.NET Core application. Contains assets used for self-contained deployments. Affected versions of this package are vulnerable to Use After Free that could allow remote code...

HPESBGN04708 rev.1 - HPE Unified OSS Console Assurance Monitoring (UOCAM), Multiple Vulnerabilities

Potential Security Impact: Local: Arbitrary Code Execution, Unauthorized Access to Files, Server-Side Request Forgery SSRF; Remote: Arbitrary Code Execution, Unauthorized Access to Files, Server-Side Request Forgery SSRF SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Unified...