PT-2024-17581 · WordPress · Wp On Aws

Name of the Vulnerable Software and Affected Versions: WP on AWS plugin for WordPress versions up to, and including, 5.2.1 Description: The issue is related to Reflected Cross-Site Scripting via $ POST data due to insufficient input sanitization and output escaping. This allows unauthenticated...

Fedora 41 : ofono (2024-0051a464f1)

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-0051a464f1 advisory. Update to v2.14 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested fo...

openSUSE Security Advisory (SUSE-SU-2024:4396-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

openSUSE Security Advisory (SUSE-SU-2024:4390-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Discourse 3.4.x < 3.4.0.beta3 Multiple Vulnerabilities

Discourse is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:discourse:discourse"; ifdescripti...

SUSE: Security Advisory (SUSE-SU-2024:4284-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2024-16364 · WordPress · Maxbuttons

Name of the Vulnerable Software and Affected Versions: MaxButtons WordPress plugin versions prior to 9.8.1 Description: The issue is related to the MaxButtons WordPress plugin, which does not properly sanitise and escape some of its settings. This could allow high-privilege users, such as...

Discourse < 3.3.3 Multiple Vulnerabilities

Discourse is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:discourse:discourse"; ifdescripti...

PT-2024-39664 · WordPress · Maintenance & Coming Soon Redirect Animation

Name of the Vulnerable Software and Affected Versions: Maintenance & Coming Soon Redirect Animation plugin for WordPress versions up to, and including, 2.1.3 Description: The issue is related to unauthorized modification of data due to a missing capability check on the wploti add whitelisted role...

PT-2024-16969 · WordPress · Spotlight

Name of the Vulnerable Software and Affected Versions: Spotlightr plugin for WordPress versions up to, and including, 0.1.9 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'spotlightr-v' shortcode due to insufficient input sanitization and output escaping on...

CVE-2024-56327

The pyrage Python bindings for the rage file encryption library are vulnerable to a flaw in the underlying Rust age crate. Due to improper validation of plugin names, an attacker could potentially cause arbitrary binary execution by supplying a crafted recipient or identity string. This vulnerabi...

Medium: jetty

Issue Overview: There exists a security vulnerability in Jetty's DosFilter which can be exploited by unauthorized users to cause remote denial-of-service DoS attack on the server using DosFilter. By repeatedly sending crafted requests, attackers can trigger OutofMemory errors and exhaust the...

Fedora 41 : golang-github-chainguard-dev-git-urls / golang-github-task (2024-40d4ab1c94)

The remote Fedora 41 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2024-40d4ab1c94 advisory. Bugfix to mitigate CVE-2023-46402 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...

Medium: avahi

Issue Overview: avahi: Avahi Wide-Area DNS Uses Constant Source Port CVE-2024-52615 avahi: Avahi Wide-Area DNS Predictable Transaction IDs CVE-2024-52616 Affected Packages: avahi Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference...

Rockwell Automation PowerMonitor 1000 Unprotected Alternate Channel (CVE-2024-12371)

A device takeover vulnerability exists in the affected product. This vulnerability allows configuration of a new Policyholder user without any authentication via API. Policyholder user is the most privileged user that can perform edit operations, creating admin users and performing factory reset...

Medium: dovecot

Issue Overview: Dovecot reports: A DoS is possible with a large number of address headers or abnormally large email headers. CVE-2024-23185 Affected Packages: dovecot Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL2 Cor...

Fedora 40 : ColPack (2024-dd633679a9)

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-dd633679a9 advisory. - Fix for CVE-2024-55566. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...

Google Chrome Security Update (stable-channel-update-for-desktop_18-2024-12) - Linux

Google Chrome is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:google:chrome"; ifdescription...

GHSA-2P6P-9RC9-62J9 Craft CMS has potential RCE when PHP `register_argc_argv` config setting is enabled

Impact You are affected if your php.ini configuration has registerargcargv enabled. Patches Update to 3.9.14, 4.13.2, or 5.5.2. Workarounds If you can't upgrade yet, and registerargcargv is enabled, you can disable it to mitigate the issue...

PT-2024-11634 · Microsoft · Windows 11 +1

Name of the Vulnerable Software and Affected Versions: Windows 11 version 10.0.22000.593 Windows Server 2022 version 10.0.20348.643 Description: An access violation vulnerability exists in the DirectComposition functionality of the win32kbase.sys driver. A specially-crafted set of syscalls can le...