Improper restriction of XML external entity references (XXE) in Electronic Deliverables Creation Support Tool provided by Ministry of Defense

Overview Electronic Deliverables Creation Support Tool provided by Ministry of Defense improperly restricts XML external entity references XXE CWE-611. Toyama Taku of NEC Corporation reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early...

PT-2024-1389 · Google +4 · Google Chrome +4

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 121.0.6167.85 Description: The issue is related to incorrect security UI in Payments, allowing a remote attacker to potentially spoof security UI via a crafted HTML page. This could enable the attacker to bypas...

PT-2024-14958 · WordPress · Eventprime

Name of the Vulnerable Software and Affected Versions: EventPrime WordPress plugin versions prior to 3.3.6 Description: The issue allows unauthenticated visitors to access private and password-protected events by guessing their numeric id or event name due to a lack of authentication and...

PT-2024-6078 · Apple +9 · Ipados +14

Name of the Vulnerable Software and Affected Versions: watchOS versions prior to 10.3 tvOS versions prior to 17.3 iOS versions prior to 17.3 iPadOS versions prior to 17.3 macOS Sonoma versions prior to 14.3 iOS versions prior to 16.7.5 iPadOS versions prior to 16.7.5 Safari versions prior to 17.3...

Medium: haproxy

Issue Overview: HAProxy before 2.8.2 accepts as part of the URI component, which might allow remote attackers to obtain sensitive information or have unspecified other impact upon misinterpretation of a pathend rule, such as routing index.html.png to a static server. CVE-2023-45539 Affected...

Important: sqlite

Issue Overview: A vulnerability was found in SQLite SQLite3 up to 3.43.0 and classified as critical. This issue affects the function sessionReadRecord of the file ext/session/sqlite3session.c of the component make alltest Handler. The manipulation leads to heap-based buffer overflow. It is...

Important: wireshark

Issue Overview: GVCP dissector crash in Wireshark 4.2.0, 4.0.0 to 4.0.11, and 3.6.0 to 3.6.19 allows denial of service via packet injection or crafted capture file CVE-2024-0208 IEEE 1609.2 dissector crash in Wireshark 4.2.0, 4.0.0 to 4.0.11, and 3.6.0 to 3.6.19 allows denial of service via packe...

Medium: haproxy

Issue Overview: HAProxy before 2.8.2 accepts as part of the URI component, which might allow remote attackers to obtain sensitive information or have unspecified other impact upon misinterpretation of a pathend rule, such as routing index.html.png to a static server. CVE-2023-45539 Affected...

PT-2024-1289

Name of the Vulnerable Software and Affected Versions Linux kernel versions through 6.7.1 Description The issue is related to the btrfs get root ref function in the Linux kernel, specifically in fs/btrfs/disk-io.c. It can cause an assertion failure and crash because a subvolume can be read out to...

PT-2024-12006 · Beaver Builder · Ultimate Addons For Beaver Builder – Lite

Name of the Vulnerable Software and Affected Versions: Ultimate Addons for Beaver Builder – Lite versions 1.5.5 and earlier Description: The issue is related to a Missing Authorization vulnerability. There is no information provided about the estimated number of potentially affected devices...

GHSA-XGFM-FJX6-62MJ readthedocs-sphinx-search vulnerable to cross-site scripting when including search results from malicious projects

Impact This vulnerability could have allowed an attacker to include arbitrary HTML content in search results by having a user search a malicious project. This was due to our search client not correctly escaping all user content from search results. You can find more information in the advisory...

PT-2024-1188 · Oracle · Oracle Zfs Storage Appliance Kit

Name of the Vulnerable Software and Affected Versions: Oracle ZFS Storage Appliance Kit version 8.8 Description: The issue is related to insufficient input validation in the Core component of the Oracle ZFS Storage Appliance Kit. This allows a high-privileged attacker with logon to the...

PT-2024-1228

Name of the Vulnerable Software and Affected Versions Oracle Java SE versions 8u391, 8u391-perf, 11.0.21, 17.0.9, 21.0.1 Oracle GraalVM for JDK versions 17.0.9, 21.0.1 Oracle GraalVM Enterprise Edition versions 20.3.12, 21.3.8, 22.3.4 Description The issue exists due to insufficient input...

PT-2024-1339 · Oracle +8 · Mysql Server +7

Name of the Vulnerable Software and Affected Versions: MySQL Server versions 8.0.35 and prior MySQL Server versions 8.2.0 and prior Description: The issue is related to insufficient input validation in the Server: Optimizer component of Oracle MySQL Server. It allows a high-privileged attacker wi...

CVE-2023-46749 Apache Shiro before 1.13.0 or 2.0.0-alpha-4, may be susceptible to a path traversal attack that results in an authentication bypass when used together with path rewriting

Apache Shiro before 1.13.0 or 2.0.0-alpha-4, may be susceptible to a path traversal attack that results in an authentication bypass when used together with path rewriting Mitigation: Update to Apache Shiro 1.13.0+ or 2.0.0-alpha-4+, or ensure blockSemicolon is enabled this is the default...

PT-2024-19223 · Mailmunch · Constant Contact Forms By Mailmunch

Name of the Vulnerable Software and Affected Versions: Constant Contact Forms by MailMunch versions 2.0.11 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an...

PT-2024-15072 · WordPress · Envira Photo Gallery

Name of the Vulnerable Software and Affected Versions: Envira Photo Gallery plugin for WordPress versions up to, and including, 1.8.7.1 Description: The issue allows authenticated attackers with contributor access and above to modify galleries on other users' posts due to an improper capability...

PT-2024-1149 · Microsoft · Windows +1

Name of the Vulnerable Software and Affected Versions: Remote Desktop Client versions prior to 1.2.5105 Description: The issue is related to errors in synchronization when using a shared resource in the Remote Desktop Protocol RDP of the Windows operating system. This can allow a remote attacker ...

PT-2024-1040 · Siemens · Solid Edge

Name of the Vulnerable Software and Affected Versions: Solid Edge SE2023 versions prior to V223.0 Update 10 Description: A vulnerability has been identified in the affected application, which contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted PAR...

PT-2024-1025 · Adobe · Substance3D - Stager

Name of the Vulnerable Software and Affected Versions: Adobe Substance 3D Stager versions 2.1.3 and earlier Description: The issue is related to insufficient input validation, which may allow an attacker to execute arbitrary code. It is an out-of-bounds read vulnerability that could lead to...