Apache Tomcat 11.0.0.M23 < 11.0.0 multiple vulnerabilities

The version of Tomcat installed on the remote host is prior to 11.0.0. It is, therefore, affected by multiple vulnerabilities as referenced in the fixedinapachetomcat11.0.0security-11 advisory. - Incorrect object re-cycling and re-use vulnerability in Apache Tomcat. Incorrect recycling of the...

PT-2024-34660 · Librenms · Librenms

Name of the Vulnerable Software and Affected Versions: LibreNMS versions prior to 24.10.0 Description: A Reflected Cross-Site Scripting XSS vulnerability in the metric parameter of the "/wireless" and "/health" endpoints allows attackers to inject arbitrary JavaScript, potentially compromising a...

Fedora 38 : python3.8 (2022-eda83be115)

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2022-eda83be115 advisory. Automatic update for python3.8-3.8.15-2.fc38. Changelog Mon Nov 14 2022 Miro Hronok - 3.8.15-2 - CVE-2022-37454: Fix buffer overflows in sha3 module Related:...

Amazon Linux 2023 : ecs-service-connect-agent (ALAS2023-2024-758)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-758 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks ...

CVE-2024-47073 Dataease arbitrary interface access vulnerability

DataEase is an open source data visualization analysis tool that helps users quickly analyze data and gain insights into business trends. In affected versions a the lack of signature verification of jwt tokens allows attackers to forge jwts which then allow access to any interface. The...

RHEL 5 : security update for Red Hat Network Satellite (Moderate) (RHSA-2011:0434)

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2011:0434 advisory. Red Hat Network Satellite RHN Satellite is a system management tool for Linux-based infrastructures. It allows for the provisioning, remote...

SUSE CVE-2024-47872

Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves Cross-Site Scripting XSS on any Gradio server that allows file uploads. Authenticated users can upload files such as HTML, JavaScript, or SVG files containing malicious scripts. When other users...

CVE-2024-47814

Vim is an open source, command line text editor. A use-after-free was found in Vim 9.1.0764. When closing a buffer visible in a window a BufWinLeave auto command can cause an use-after-free if this auto command happens to re-open the same buffer in a new split window. Impact is low since the user...

PT-2024-31502 · Diebold Nixdorf · Vynamic View

Name of the Vulnerable Software and Affected Versions: Diebold Nixdorf Vynamic View versions up to 5.9.4 Description: The issue concerns the exposure of sensitive information to unauthorized actors, identified as CWE-200. Local access is required for exploitation, and there is no public exploit...

Oracle Siebel CRM SEoL (8.0.x)

According to its version, Oracle Siebel CRM is 8.0.x. It is, therefore, no longer maintained by its vendor or provider. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it may contain security vulnerabilities. %NASLMINLEVEL 80900 C...

Medium: python-tqdm

Issue Overview: tqdm is an open source progress bar for Python and CLI. Any optional non-boolean CLI arguments e.g. --delim, --buf-size, --manpath are passed through python's eval, allowing arbitrary code execution. This issue is only locally exploitable and had been addressed in release version...

PT-2024-27057 · Unknown · Cert-Manager

Name of the Vulnerable Software and Affected Versions: cert-manager version 1.14.4 Description: The issue is related to insecure permissions, allowing attackers to access sensitive data and escalate privileges by obtaining the service account's token. Recommendations: For cert-manager version...

PT-2024-27317 · Unknown · Biplob018 Shortcode Addons

Name of the Vulnerable Software and Affected Versions: biplob018 Shortcode Addons versions 3.2.5 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS attacks. Recommendation...

PT-2024-27383 · Unknown · Transition Slider

Name of the Vulnerable Software and Affected Versions: Transition Slider – Responsive Image Slider and Gallery versions n/a through 2.20.3 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stor...

PT-2024-28626 · Fedify · Fedify

Name of the Vulnerable Software and Affected Versions: Fedify versions prior to 0.9.2, 0.10.1, or 0.11.1 Description: The issue is related to a Server Side Request Forgery attack. When Fedify needs to retrieve an object or activity from a remote activitypub server, it makes a HTTP request to the...

[SECURITY] [DLA 3848-1] org-mode security update

Debian LTS Advisory DLA-3848-1 [email protected] https://www.debian.org/lts/security/ Sean Whitton June 29, 2024 https://wiki.debian.org/LTS Package : org-mode Version : org-mode 9.1.14+dfsg-3+deb10u3 CVE ID : CVE-2024-39331 Debian Bug : 1074136 A vulnerability was discovered in Org-mod...

CVE-2023-38506 Cross-site Scripting (XSS) when pasting HTML into the rich text editor in Joplin

Joplin is a free, open source note taking and to-do application. A Cross-site Scripting XSS vulnerability allows pasting untrusted data into the rich text editor to execute arbitrary code. HTML pasted into the rich text editor is not sanitized or not sanitized properly. As such, the onload...

PT-2024-23426 · WordPress · Site Reviews

Name of the Vulnerable Software and Affected Versions: Site Reviews WordPress plugin versions prior to 7.0.0 Description: The issue allows an attacker to manipulate client IP addresses retrieved from potentially untrusted headers, which can be used to bypass IP-based blocking. Recommendations: Fo...

PT-2024-25863 · Unknown · Canvasio3D Light

Name of the Vulnerable Software and Affected Versions: canvasio3D Light versions n/a through 2.5.0 Description: The issue is related to an Unrestricted Upload of File with Dangerous Type. This allows for the upload of files that could potentially be dangerous. Recommendations: For versions n/a...

PT-2024-15566 · WordPress · The Plus Addons For Elementor

Name of the Vulnerable Software and Affected Versions: The Plus Addons for Elementor plugin for WordPress versions up to, and including, 5.4.2 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping in the plugin's element...