PT-2024-23057 · Softlab · Softlab Radio Player

Name of the Vulnerable Software and Affected Versions: SoftLab Radio Player versions 2.0.73 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Stored XSS. This means that an attacker can inject...

PT-2024-22827

Name of the Vulnerable Software and Affected Versions Synology Surveillance Station versions prior to 9.2.0-9289 Synology Surveillance Station versions prior to 9.2.0-11289 Description The issue is related to improper validation of array index in the UserPrivilege.Enum webapi component. This allo...

PT-2024-2578 · Cisco · Cisco Ios Xe

Name of the Vulnerable Software and Affected Versions: Cisco IOS XE Software for Wireless LAN Controllers WLCs affected versions not specified Description: A vulnerability in the multicast DNS mDNS gateway feature could allow an unauthenticated, adjacent attacker to cause a denial of service DoS...

JVN#40367518: SonicDICOM Media Viewer may insecurely load Dynamic Link Libraries

SonicDICOM Media Viewer provided by Fujidenolo Solutions Co., Ltd. contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries CWE-427. Impact Arbitrary code may be executed with the privileges of the running application. Solution Update the Software...

SUSE-SU-2024:0999-1 Security update for krb5

This update for krb5 fixes the following issues: - CVE-2024-26458: Fixed memory leak at /krb5/src/lib/rpc/pmaprmt.c bsc1220770. - CVE-2024-26461: Fixed memory leak at /krb5/src/lib/gssapi/krb5/k5sealv3.c bsc1220771...

PT-2024-10418

Name of the Vulnerable Software and Affected Versions FFmpeg version 6.1.1 Description The issue is related to an integer overflow in the FFmpeg CAF decoder. This could potentially allow an attacker to cause a denial of service. Recommendations For version 6.1.1, consider updating to a newer...

PT-2024-22965

Name of the Vulnerable Software and Affected Versions Xpdf versions 4.05 and earlier Description The issue is an out-of-bounds array write in Xpdf, triggered by a negative object number in an indirect reference in the input PDF file. This occurs when the software processes a PDF file containing a...

CVE-2021-47177

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Fix sysfs leak in allociommu iommudevicesysfsadd is called before, so is has to be cleaned on subsequent errors...

PT-2024-2509 · Arm +3 · Mbed Crypto +4

Name of the Vulnerable Software and Affected Versions: Mbed TLS versions 2.18.0 through 2.28.x before 2.28.8 Mbed TLS versions 3.x before 3.6.0 Mbed Crypto affected versions not specified Description: The PSA Crypto API in Mbed TLS and Mbed Crypto mishandles shared memory, which can be exploited ...

CVE-2024-29188 Malicious directory junction can cause WiX RemoveFoldersEx to possibly delete elevated files

WiX toolset lets developers create installers for Windows Installer, the Windows installation engine. The custom action behind WiX's RemoveFolderEx functionality could allow a standard user to delete protected directories. RemoveFolderEx deletes an entire directory tree during installation or...

PT-2024-3233 · Brocade · Brocade Sannav

Name of the Vulnerable Software and Affected Versions: Brocade SANnav versions prior to 2.3.1 Brocade SANnav version 2.3.0a Description: A vulnerability in Brocade SANnav is related to insufficient protection of registration data in the PostgreSQL component. This could allow a privileged user to...

PT-2024-23088 · Kerlink +1 · Kerlink Firewall +2

Name of the Vulnerable Software and Affected Versions: ChirpStack chirpstack-mqtt-forwarder versions 4.2.0 and earlier ChirpStack chirpstack-gateway-bridge versions 4.0.10 and earlier Description: The Kerlink firewall in ChirpStack wrongly accepts certain TCP packets when a connection is not in t...

CVE-2024-29916

The CVE describes a vulnerability in dormakaba Saflok systems (pre‑November‑2023 software update) where an attacker who has a valid active or expired keycard for a property can unlock arbitrary doors via forged keycards. The root cause is a UID‑only based key derivation function, affecting Saflok...

Medium: wireshark

Issue Overview: An issue in Wireshark team Wireshark before v.4.2.0 allows a remote attacker to cause a denial of service via the packet-bgp.c, dissectbgpopentvbuffttvb, prototreetree, packetinfopinfo, optlen components. CVE-2024-24478 Affected Packages: wireshark Issue Correction: Run dnf update...

PT-2024-23089 · Distrobox · Distrobox

Name of the Vulnerable Software and Affected Versions: Distrobox versions prior to 1.7.0.1 Description: The issue allows attackers to execute arbitrary code via command injection into exported executables. Recommendations: For versions prior to 1.7.0.1, update to version 1.7.0.1 or later to resol...

CVE-2024-27105 Frappe File Permissions can by bypassed using certain endpoints

Frappe is a full-stack web application framework. Prior to versions 14.66.3 and 15.16.0, file permission can be bypassed using certain endpoints, granting less privileged users permission to delete or clone a file. Versions 14.66.3 and 15.16.0 contain a patch for this issue. No known workarounds...

PT-2024-22416 · Unknown · Myprestamodules Ordersexport

Name of the Vulnerable Software and Affected Versions: MyPrestaModules ordersexport versions 6.0.2 and earlier Description: The issue allows a remote attacker to execute arbitrary code via the "download.php" component. Recommendations: For versions 6.0.2 and earlier, update to a version that...

CVE-2024-27439 Apache Wicket: Possible bypass of CSRF protection

An error in the evaluation of the fetch metadata headers could allow a bypass of the CSRF protection in Apache Wicket. This issue affects Apache Wicket: from 9.1.0 through 9.16.0, and the milestone releases for the 10.0 series. Apache Wicket 8.x does not support CSRF protection via the fetch...

PT-2024-15869 · WordPress · Appointment Booking Calendar

Name of the Vulnerable Software and Affected Versions: Appointment Booking Calendar WordPress plugin versions prior to 1.3.83 Description: The issue concerns a lack of CSRF checks in certain areas, potentially allowing attackers to trick logged-in users into performing unwanted actions, such as...

KLA65226 Multiple vulnerabilities in Mozilla Thunderbird

Multiple vulnerabilities were found in Mozilla Thunderbird. Malicious users can exploit these vulnerabilities to cause denial of service, execute arbitrary code, obtain sensitive information, bypass security restrictions, gain privileges. Below is a complete list of vulnerabilities: 1. Out of...