PT-2024-24235

Name of the Vulnerable Software and Affected Versions: tiagorlampert CHAOS version 5.0.1 Description: A Cross Site Scripting XSS vulnerability exists in tiagorlampert CHAOS. A remote attacker may be able to escalate privileges via the sendCommandHandler function in the handler.go component. A...

PT-2024-5633 · Dell · Dell Storage Resource Manager

Name of the Vulnerable Software and Affected Versions: Dell Storage Resource Manager version 4.9.0.0 and below Description: The issue is related to a session fixation problem in the SRM Windows Host Agent. An unauthenticated attacker on an adjacent network could exploit this, potentially leading ...

SUSE CVE-2024-26789

In the Linux kernel, the following vulnerability has been resolved: crypto: arm64/neonbs - fix out-of-bounds access on short input The bit-sliced implementation of AES-CTR operates on blocks of 128 bytes, and will fall back to the plain NEON version for tail blocks or inputs that are shorter than...

VulnCheck KEV: CVE-2023-6114

The Duplicator WordPress plugin before 1.5.7.1, Duplicator Pro WordPress plugin before 4.5.14.2 does not disallow listing the backups-dup-lite/tmp directory or the backups-dup-pro/tmp directory in the Pro version, which temporarily stores files containing sensitive data. When directory...

CVE-2024-31492

An external control of file name or path vulnerability CWE-73 in FortiClientMac version 7.2.3 and below, version 7.0.10 and below installer may allow a local attacker to execute arbitrary code or commands via writing a malicious configuration file in /tmp before starting the installation process...

PT-2024-5072 · Nozomi · Nozomi Central Management Console +1

Name of the Vulnerable Software and Affected Versions: Nozomi Guardian and Nozomi Central Management Console CMC affected versions not specified OpenAPI affected versions not specified Description: The issue is related to insufficient protection of audit records for OpenAPI requests, which may...

FortiClientMac 安全漏洞

Fortinet FortiClientMAC is a security tool for the macOS platform from Fortinet, Inc. A security vulnerability exists in FortiClientMac versions 7.2.3 and earlier, 7.0.10 and earlier, which stems from a vulnerability that could allow a local attacker to execute arbitrary code or commands by writi...

GHSA-V6F3-GH5H-MQWX DIRAC: Unauthorized users can read proxy contents during generation

Impact During the proxy generation process e.g., when using dirac-proxy-init it is possible for unauthorized users on the same machine to gain read access to the proxy. This allows the user to then perform any action that is possible with the original proxy. This vulnerability only exists for a...

PT-2024-22324 · Contao · Contao

Name of the Vulnerable Software and Affected Versions: Contao versions 4.0.0 through 4.13.39 Contao versions 5.0.0 through 5.3.3 Description: Contao is an open source content management system. Users can inject malicious code in filenames when uploading files, which is then executed in tooltips a...

SUSE SLES15 Security Update : guava (SUSE-SU-2024:1138-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:1138-1 advisory. - Upgrade to guava from v30.1.1 to v32.0.1 - CVE-2023-2976: Fixed Predictable temporary files and directories used in FileBackedOutputStream...

PT-2024-3008 · Microsoft +1 · Visual Studio +3

Name of the Vulnerable Software and Affected Versions: .NET Framework versions affected versions not specified .NET versions affected versions not specified Visual Studio versions affected versions not specified Description: The issue is related to the use of memory after it has been freed, which...

SUSE-SU-2024:1162-1 Security update for python310

This update for python310 fixes the following issues: - CVE-2024-0450: Fixed 'quoted-overlap' in zipfile module is python310 bsc1221854 - CVE-2023-52425: Fixed denial of service caused by processing large tokens in expat module in python310 bsc1219559 - CVE-2023-6597: Fixed...

SUSE-SU-2024:1138-1 Security update for guava

This update for guava fixes the following issues: - Upgrade to guava from v30.1.1 to v32.0.1 - CVE-2023-2976: Fixed Predictable temporary files and directories used in FileBackedOutputStream. bsc1212401 - CVE-2020-8908: Fixed a bug that could allow an attacker with access to the machine to...

PT-2024-20336 · Newq · Secdiskapp

Name of the Vulnerable Software and Affected Versions: secdiskapp version 1.5.1 Description: An issue in the management program for NewQ Fingerprint Encryption Super Speed Flash Disk allows attackers to gain escalated privileges via vsVerifyPassword and vsSetFingerPrintPower functions...

PT-2024-26069 · Sourcecodester · Sourcecodester Loan Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Laundry Management System version 1.0 Description: A critical issue has been found in the SourceCodester Laundry Management System. The laporan filter function of the file /application/controller/Transaki.php is affected. The...

PT-2024-23560 · Unknown · Ros2 Iron Irwini

Name of the Vulnerable Software and Affected Versions: ROS2 Iron Irwini versions 2 Description: An issue has been discovered where the system transmits messages in plaintext, exposing sensitive information and making it vulnerable to man-in-the-middle MitM attacks. This allows attackers to...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : gradle, gradle-bootstrap (SUSE-SU-2024:1119-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:1119-1 advisory. - CVE-2021-29429: Fixed information disclosure through temporary directory permissions bsc118479...

PT-2024-3188

Name of the Vulnerable Software and Affected Versions Telesquare TLR-2005Ksh versions 1.0.0 and 1.1.4 Description A firmware issue in the control plane fails to properly sanitize data, allowing an unauthenticated remote attacker to execute arbitrary system commands. This is achieved by exploiting...

PT-2024-20526 · Apache · Apache Nimble

Name of the Vulnerable Software and Affected Versions: Apache NimBLE versions through 1.6.0 Description: A specially crafted GATT operation can cause an infinite loop in the GATT server, leading to a denial of service in the Bluetooth stack or device. Recommendations: For Apache NimBLE versions...

DEBIAN-CVE-2024-26789

In the Linux kernel, the following vulnerability has been resolved: crypto: arm64/neonbs - fix out-of-bounds access on short input The bit-sliced implementation of AES-CTR operates on blocks of 128 bytes, and will fall back to the plain NEON version for tail blocks or inputs that are shorter than...