openSUSE: Security Advisory for guava (SUSE-SU-2023:3090-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

DEBIAN-CVE-2023-52526

In the Linux kernel, the following vulnerability has been resolved: erofs: fix memory leak of LZMA global compressed deduplication When stressing microLZMA EROFS images with the new global compressed deduplication feature enabled -Ededupe, I found some short-lived temporary pages weren't properly...

PT-2024-18859 · Unknown · Bdtask Hospita Automanager

Name of the Vulnerable Software and Affected Versions: Bdtask Hospita AutoManager up to 20240223 Description: A vulnerability has been found in the Investigation Report Handler component, affecting unknown code of the file "/investigation/delete/". This issue leads to cross-site request forgery a...

SUSE CVE-2021-46988

In the Linux kernel, the following vulnerability has been resolved: userfaultfd: release page in error path to avoid BUGON Consider the following sequence of events: 1. Userspace issues a UFFD ioctl, which ends up calling into shmemmfillatomicpte. We successfully account the blocks, we...

PT-2024-20866 · Mjml-App · Mjml-App

Name of the Vulnerable Software and Affected Versions: mjml-app versions 3.0.4 through 3.1.0-beta Description: The issue allows for remote code execution RCE via the href attribute. Recommendations: For versions 3.0.4 and 3.1.0-beta, consider restricting access to the href attribute until a patch...

CVE-2023-6565

The InfiniteWP Client plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.12.3 via the multi-call backup option. This makes it possible for unauthenticated attackers to extract sensitive data from a temporary SQL file via repeated GET...

DEBIAN-CVE-2021-47048

In the Linux kernel, the following vulnerability has been resolved: spi: spi-zynqmp-gqspi: fix use-after-free in zynqmpqspiexecop When handling op-addr, it is using the buffer "tmpbuf" which has been freed. This will trigger a use-after-free KASAN warning. Let's use temporary variables to store...

PT-2024-28440 · Rack · Rack

Name of the Vulnerable Software and Affected Versions: Rack versions 3.1.0 through 3.1.4 Rack versions prior to 2.0.9.4 Rack versions prior to 2.1.4.4 Rack versions prior to 2.2.8.1 Rack versions prior to 3.0.9.1 Description: A Regular Expression Denial of Service ReDoS vulnerability exists in th...

PT-2024-18106 · WordPress · Wp Ecommerce

Name of the Vulnerable Software and Affected Versions: WP eCommerce plugin for WordPress versions up to, and including, 3.15.1 Description: The issue is related to unauthorized arbitrary post creation due to a missing capability check on the check for saas push function. This allows unauthenticat...

PT-2024-15555 · WordPress · Gestpay For Woocommerce

Name of the Vulnerable Software and Affected Versions: Gestpay for WooCommerce plugin for WordPress versions up to, and including, 20221130 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the ajax set default card function. This allo...

PT-2024-21927 · Webasyst · Webasyst

Name of the Vulnerable Software and Affected Versions: Webasyst version 2.9.9 Description: The issue allows attackers to create blogs containing malicious code after gaining blog permissions, which can lead to a Cross-Site Scripting XSS attack. Recommendations: For Webasyst version 2.9.9, conside...

Mitsubishi Electric Multiple Factory Automation Products (Update A)

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 5.3 ATTENTION : Exploitable remotely/low attack complexity Vendor : Mitsubishi Electric Corporation Equipment : MELSEC iQ-F Series Vulnerability : Insufficient Resource Pool 2. RISK EVALUATION Successful exploitation of this vulnerability could allow a...

Linux kernel security vulnerabilities

Linux kernel is the kernel used by the Linux Foundation's open source operating system Linux. A security vulnerability exists in the Linux kernel, which stems from overlayfs not placing a temporary directory entry when one exists. A meta-copy error causes a dentry leak when the associated...

PT-2024-2168 · Unknown · Gguf Library

Name of the Vulnerable Software and Affected Versions: GGUF library version Commit 18c2e17 Description: A heap-based buffer overflow vulnerability exists in the GGUF library gguf fread str functionality of llama.cpp. This vulnerability can be triggered by a specially crafted .gguf file, potential...

PT-2024-21634

Name of the Vulnerable Software and Affected Versions ESPHome versions 2023.12.9 through 2024.2.0 Description A security misconfiguration in the edit configuration file API in the dashboard component of ESPHome allows authenticated remote attackers to read and write arbitrary files under the...

Dell SupportAssist for Business PCs Local Authentication Bypass Vulnerability

Dell SupportAssist for Business PCs is a client application for business computers from Dell USA. The program provides automated, proactive and predictive techniques for troubleshooting and more. A local authentication bypass vulnerability exists in Dell SupportAssist for Business PCs version...

PT-2024-11689 · Unknown · Livebox Collaboration Vdesk

Name of the Vulnerable Software and Affected Versions: LIVEBOX Collaboration vDesk versions through v031 Description: An issue was discovered allowing a URL Redirection to an Untrusted Site Open Redirect under the "/api/v1/notification/createnotification" endpoint. This enables an authenticated...

SUSE SLES12: postgresql13 / postgresql13-contrib / postgresql13-devel / etc (SUSE-SU-2024:0541-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:0541-1 advisory. Upgrade to 13.14: - CVE-2024-0985: Tighten security restrictions within REFRESH MATERIALIZED VIEW CONCURRENTLY bsc1219679. Tenable has...

PT-2024-21299 · Discourse · Discourse Calendar

Name of the Vulnerable Software and Affected Versions: Discourse Calendar affected versions not specified Description: The issue allows uninvited users to gain access to private events by crafting a request to update their attendance. This is related to the dynamic calendar feature in the first...

PT-2024-1926

Name of the Vulnerable Software and Affected Versions Rack versions 1.3.0 through 3.0.9 and 2.2.8.1. Description Rack is a modular Ruby web server interface. A denial of service DoS vulnerability exists due to improper handling of Range headers. Carefully crafted Range headers can cause the serve...