CVE-2024-52798

CVE-2024-52798 concerns the path-to-regexp library. The DoS arises when path-to-regexp outputs regex patterns that backtrack, enabling high CPU/blocked event loop in vulnerable inputs. Public sources reference the 0.1.x line as the origin and recommend upgrading specifically to 0.1.12; later advi...

PT-2024-9186 · Abb · Abb Aspect +2

Name of the Vulnerable Software and Affected Versions: ABB ASPECT - Enterprise version 3.08.02 NEXUS Series version 3.08.02 MATRIX Series version 3.08.02 Description: The issue is related to Denial of Service vulnerabilities, which could potentially cause device service disruptions. It is...

Build corruption when using `PYO3_CONFIG_FILE` environment variable

In PyO3 0.23.0 the PYO3CONFIGFILE environment variable used to configure builds regressed such that changing the environment variable would no longer trigger PyO3 to reconfigure and recompile. In combination with workflows using tools such as maturin to build for multiple versions in a single...

Veeam Issues Patch for Critical RCE Vulnerability in Service Provider Console

Veeam has released security updates to address a critical flaw impacting Service Provider Console VSPC that could pave the way for remote code execution on susceptible instances. The vulnerability, tracked as CVE-2024-42448, carries a CVSS score of 9.9 out of a maximum of 10.0. The company noted...

PT-2024-15152 · WordPress · Wp Job Manager – Company Profiles

Name of the Vulnerable Software and Affected Versions: WP Job Manager – Company Profiles versions up to and including 1.7 Description: The issue is related to insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts in pages through t...

Exposure of Sensitive System Information to an Unauthorized Control Sphere

Overview matrix-synapse is an ecosystem for open federated Instant Messaging and VoIP. Affected versions of this package are vulnerable to Exposure of Sensitive System Information to an Unauthorized Control Sphere via the Sliding Sync feature. An attacker can leak partial room state changes to...

Missing Authentication for Critical Function

Overview matrix-synapse is an ecosystem for open federated Instant Messaging and VoIP. Affected versions of this package are vulnerable to Missing Authentication for Critical Function due to the unauthenticated writes to the media repository. An attacker can plant problematic content into the med...

PT-2024-16911 · WordPress · Aweber Forms

Name of the Vulnerable Software and Affected Versions: AWeber Forms by Optin Cat plugin for WordPress versions up to, and including, 2.5.7 Description: The issue is related to Reflected Cross-Site Scripting due to the use of add query arg without appropriate escaping on the URL. This allows...

PT-2024-17331 · WordPress · Scratch & Win – Giveaways/Contests

Name of the Vulnerable Software and Affected Versions: Scratch & Win – Giveaways and Contests plugin for WordPress versions up to and including 2.6.9 Description: The issue concerns a stored cross-site scripting vulnerability due to insufficient input sanitization and output escaping on...

Google Chrome < 131.0.6778.108 Vulnerability

The version of Google Chrome installed on the remote Windows host is prior to 131.0.6778.108. It is, therefore, affected by a vulnerability as referenced in the 202412stable-channel-update-for-desktop advisory. - Type Confusion in V8 in Google Chrome prior to 131.0.6778.108 allowed a remote...

PT-2024-9236 · Sonicwall · Sonicwall Sma100 Sslvpn

Name of the Vulnerable Software and Affected Versions: SonicWall SMA100 SSLVPN versions prior to 10.2.1.13-72sv Description: The issue is related to a heap-based buffer overflow vulnerability in the SonicWall SMA100 SSLVPN, caused by the use of strcpy. This allows remote authenticated attackers t...

PT-2024-35876 · Unknown · Mins To Read

Name of the Vulnerable Software and Affected Versions: Mins To Read versions 1.2.2 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF problem that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web application,...

PT-2024-35300 · Woocommerce · Atarapay Woocommerce Payment Gateway

Name of the Vulnerable Software and Affected Versions: AtaraPay WooCommerce Payment Gateway versions 2.0.13 and earlier Description: The issue is related to improper neutralization of input during web page generation, also known as 'Cross-site Scripting', which allows Reflected XSS. This means th...

PT-2024-35292 · Edx · Open Edx Lms

Name of the Vulnerable Software and Affected Versions: Open edX LMS versions n/a through 2.6.1 Description: The issue is related to improper neutralization of input during web page generation, also known as 'Cross-site Scripting', which allows Reflected XSS. This enables potential attackers to...

CVE-2024-53983 Server-side request forgery in Backstage Scaffolder plugin

The Backstage Scaffolder plugin Houses types and utilities for building scaffolder-related modules. A vulnerability is identified in Backstage Scaffolder template functionality where Server-Side Template Injection SSTI can be exploited to perform Git config injection. The vulnerability allows an...

CVE-2024-53864 Cross-site Scripting in a field that is used in the Content name pattern in ibexa/admin-ui

Ibexa Admin UI Bundle is all the necessary parts to run the Ibexa DXP Back Office interface. The Content name pattern is used to build Content names from one or more fields. An XSS vulnerability has been found in this mechanism. Content edit permission is required to exploit it. After the fix, an...

CVE-2024-52809 Cross-site Scripting vulnerability with prototype pollution in vue-i18n

vue-i18n is an internationalization plugin for Vue.js. In affected versions vue-i18n can be passed locale messages to createI18n or useI18n. When locale message ASTs are generated in development mode there is a possibility of Cross-site Scripting attack. This issue has been addressed in versions...

SUSE CVE-2024-53859

go-gh is a Go module for interacting with the gh utility and the GitHub API from the command line. A security vulnerability has been identified in go-gh that could leak authentication tokens intended for GitHub hosts to non-GitHub hosts when within a codespace. go-gh sources authentication tokens...

PT-2024-32406 · Checkmk · Checkmk

Name of the Vulnerable Software and Affected Versions: Checkmk versions prior to 2.3.0p22 Checkmk versions prior to 2.2.0p37 Checkmk versions prior to 2.1.0p50 EOL Description: The issue concerns the insertion of sensitive information into log files in Checkmk, causing remote site secrets to be...

PT-2024-35457 · Vue-I18N · Vue-I18N

Name of the Vulnerable Software and Affected Versions: vue-i18n versions prior to 9.14.2 vue-i18n versions prior to 10.0.5 Description: The issue concerns a Cross-site Scripting XSS attack possibility in vue-i18n, an internationalization plugin for Vue.js. This occurs when locale message ASTs are...