PT-2024-24804 · Unknown · Streamweasels Twitch Integration

Name of the Vulnerable Software and Affected Versions: StreamWeasels Twitch Integration versions 1.7.8 and earlier Description: The issue is related to the exposure of sensitive information to an unauthorized actor. This is a problem where sensitive data is made available to individuals who shoul...

PT-2024-24602 · Librenms · Librenms

Name of the Vulnerable Software and Affected Versions: LibreNMS versions prior to 24.4.0 Description: The issue is related to improper sanitization on the Service template name, which can lead to stored Cross-site Scripting. This can be exploited by modifying the template name with crafted...

PT-2024-13216 · Ibm · Ibm Mq

Name of the Vulnerable Software and Affected Versions: IBM MQ versions 9.0 LTS through 9.3 CD Description: The issue is related to an error within the MQ clustering logic, which can lead to a denial-of-service attack. This can be exploited via a remote attack. Recommendations: For IBM MQ versions...

CVE-2024-28252 CoreWCF NetFraming based services can leave connections open when they should be closed

CoreWCF is a port of the service side of Windows Communication Foundation WCF to .NET Core. If you have a NetFraming based CoreWCF service, extra system resources could be consumed by connections being left established instead of closing or aborting them. There are two scenarios when this can...

CVE-2022-34321 Apache Pulsar: Improper Authentication for Pulsar Proxy Statistics Endpoint

Improper Authentication vulnerability in Apache Pulsar Proxy allows an attacker to connect to the /proxy-stats endpoint without authentication. The vulnerable endpoint exposes detailed statistics about live connections, along with the capability to modify the logging level of proxied connections...

Medium: libuv

Issue Overview: libuv is a multi-platform support library with a focus on asynchronous I/O. The uvgetaddrinfo function in src/unix/getaddrinfo.c and its windows counterpart src/win/getaddrinfo.c, truncates hostnames to 256 characters before calling getaddrinfo. This behavior can be exploited to...

PT-2024-12049 · Unknown · Openharmony

Name of the Vulnerable Software and Affected Versions: OpenHarmony versions prior to 3.2.4 Description: The issue allows a local attacker to cause an information leak through an out-of-bounds read. Recommendations: For OpenHarmony versions prior to 3.2.4, update to a version newer than 3.2.4 to...

PT-2024-17034 · Snow · Snow Software Inventory Agent

Name of the Vulnerable Software and Affected Versions: Snow Software Inventory Agent on Unix versions through 7.3.1 Description: The issue is related to an Improper Verification of Cryptographic Signature vulnerability, which allows File Manipulation through Snow Update Packages. Recommendations:...

CVE-2023-46742 CubeFS leaks users key in logs

CubeFS is an open-source cloud-native file storage system. CubeFS prior to version 3.3.1 was found to leak users secret keys and access keys in the logs in multiple components. When CubeCS creates new users, it leaks the users secret key. This could allow a lower-privileged user with access to th...

PT-2023-29876 · Themify · Themify Ultra

Name of the Vulnerable Software and Affected Versions: Themify Ultra versions through 7.3.5 Description: The issue is related to an Unrestricted Upload of File with Dangerous Type, which affects Themify Ultra. No information is provided about the estimated number of potentially affected devices...

CVE-2023-6853 kalcaddle KodExplorer app.php index server-side request forgery

A vulnerability classified as critical was found in kalcaddle KodExplorer up to 4.51.03. Affected by this vulnerability is the function index of the file plugins/officeLive/app.php. The manipulation of the argument path leads to server-side request forgery. The attack can be launched remotely. Th...

PT-2023-31318 · Unknown · Seraphinite Accelerator

Name of the Vulnerable Software and Affected Versions: Seraphinite Accelerator versions through 2.20.28 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. Recommendations: For versions throu...

PT-2023-31399 · Wedevs · Wedevs Wp Project Manager

Name of the Vulnerable Software and Affected Versions: weDevs WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts versions through 2.6.7 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known ...

PT-2023-28108 · Unknown · Pandora Fms

Name of the Vulnerable Software and Affected Versions: Pandora FMS versions 700 through 773 Description: The issue is related to improper neutralization of input during web page generation, allowing Cross-Site Scripting XSS. This enables the execution of Javascript code in the news section of the...

Atlassian JIRA SEoL (6.1.x)

According to its version, Atlassian JIRA is 6.1.x. It is, therefore, no longer maintained by its vendor or provider. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it may contain security vulnerabilities. %NASLMINLEVEL 80900 C...

PT-2023-28597 · Npm · Systeminformation

Name of the Vulnerable Software and Affected Versions: systeminformation versions 5.0.0 through 5.21.6 Description: The systeminformation library for Node.JS has a SSID Command Injection Vulnerability. This issue affects versions 5.0.0 through 5.21.6. The problem was fixed with a parameter check ...

SUSE CVE-2023-40576

FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. Affected versions are subject to an Out-Of-Bounds Read in the RleDecompress function. This Out-Of-Bounds Read occurs because FreeRDP processes the pbSrcBuffer variable without checking if it...

PT-2023-4665 · Freerdp +8 · Freerdp +8

Name of the Vulnerable Software and Affected Versions: FreeRDP versions prior to 2.11.0 FreeRDP versions prior to 3.0.0-beta3 Description: The issue is related to an Out-Of-Bounds Read in the nsc rle decompress data function. This occurs because the function processes context-Planes without...

PT-2023-33059 · Amazon · S2N-Quic

Name of the Vulnerable Software and Affected Versions: s2n-quic versions =v1.24.0 Description: The issue in s2n-quic causes the endpoint to shut down due to a combination of peer-initiated connection migration and duplicate new connection ID frames being received. No AWS services are affected, an...

PT-2023-4091 · Apache · Apache Airflow

Name of the Vulnerable Software and Affected Versions: Apache Airflow versions prior to 2.6.3 Description: The issue is related to the use of a regular expression with inefficient computational complexity in Apache Airflow, which can be exploited by a remote attacker to cause a denial of service...