PAN-OS management interface authentication bypass

Added: 11/20/2024 CVE: CVE-2024-0012 Background Palo Alto Networks firewall provides policy-based visibility and control over applications, users and threats. Problem An authentication bypass vulnerability combined with a command injection vulnerability in the PAN-OS management interface allows...

aioHTTP 3.10.6 < 3.10.11 Memory Leak

The version of aioHTTP installed on the remote host is prior to 3.10.11. It is, therefore, affected by a memory leak vulnerability. aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In versions starting with 3.10.6 and prior to 3.10.11, a memory leak can occur when a...

PT-2024-35225 · Unknown · Hebrew Date

Name of the Vulnerable Software and Affected Versions: Hebrew Date versions n/a through 2.1.0 Description: A Cross-Site Request Forgery CSRF issue in Hebrew Date allows Stored XSS. Recommendations: For versions n/a through 2.1.0, update to a version that fixes the CSRF vulnerability to prevent...

PT-2024-35260 · Unknown · Disable Admin Notices Individually

Name of the Vulnerable Software and Affected Versions: Disable Admin Notices individually versions 1.3.5 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. This can be achieved by...

Trend Micro Deep Security Agent Local Privilege Escalation (KA-0016724)

A link following vulnerability in Trend Micro Deep Security 20.x agents below build 20.0.1-3180 could allow a local attacker to escalate privileges on affected installations. Note that Nessus has not tested for this issue but has instead relied solely on the application's self-reported version...

Google Chrome < 131.0.6778.85 Vulnerability

The version of Google Chrome installed on the remote Windows host is prior to 131.0.6778.85. It is, therefore, affected by a vulnerability as referenced in the 202411stable-channel-update-for-desktop19 advisory. - Type Confusion in V8 in Google Chrome prior to 131.0.6778.85 allowed a remote...

CVE-2024-51743 Arbitrary File Write leading up to remote code execution (instructor accounts)

MarkUs is a web application for the submission and grading of student assignments. In versions prior to 2.4.8, an arbitrary file write vulnerability in the update/upload/create file methods in Controllers allows authenticated instructors to write arbitrary files to any location on the web server...

Improper Authentication

Overview cobbler is a network install server. Affected versions of this package are vulnerable to Improper Authentication due to the utils.getsharedsecret function. An attacker can gain full control of the server by connecting to the cobbler XML-RPC server using a hardcoded user and password...

PT-2024-35263 · Themify · Themify Builder

Name of the Vulnerable Software and Affected Versions: Themify Builder versions through 7.6.3 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS attacks. Recommendations: For Themify...

PT-2024-35488 · Unknown · Bitcoin Core

Name of the Vulnerable Software and Affected Versions: Bitcoin Core versions prior to 0.20.0 Description: The issue allows remote attackers to cause a denial of service, resulting in an infinite loop, by sending a malformed GETDATA message. This can lead to a node crash. Recommendations: For...

PT-2024-35185 · Unknown · Forex Signals

Name of the Vulnerable Software and Affected Versions: Provide Forex Signals versions n/a through 1.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS, where an attacker can inject...

GnuTLS: Multiple Vulnerabilities

Background GnuTLS is a secure communications library implementing the SSL, TLS, and DTLS protocols Description Multiple vulnerabilities have been discovered in GnuTLS. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details...

PT-2024-8600 · Apache · Apache Ofbiz

Name of the Vulnerable Software and Affected Versions: Apache OFBiz versions prior to 18.12.17 Description: The issue is related to Server-Side Request Forgery SSRF and Improper Control of Generation of Code 'Code Injection' vulnerability in Apache OFBiz. This vulnerability may allow a remote...

Insertion of Sensitive Information into Log File

Overview apache-airflow is a platform to programmatically author, schedule, and monitor workflows. Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File in the form of configuration variables belonging to other DAG author users. If these variables...

PT-2024-34383 · Emlog Pro · Emlog Pro

Name of the Vulnerable Software and Affected Versions: emlog pro versions 2.3.18 and earlier Description: The issue allows attackers to write malicious JavaScript code in published articles, potentially leading to Cross Site Scripting XSS attacks. Recommendations: For emlog pro versions 2.3.18 an...

Debian dla-3952 : libunbound-dev - security update

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-3952 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-3952-1 [email protected] https://www.debian.org/lts/security/...

Authentication Bypass

Overview symfony/security-http is a provides an infrastructure for sophisticated authorization systems, which makes it possible to easily separate the actual authorization logic from so called user providers that hold the users credentials. Affected versions of this package are vulnerable to...

Mozilla Thunderbird < 132.0.1

The version of Thunderbird installed on the remote Windows host is prior to 132.0.1. It is, therefore, affected by a vulnerability as referenced in the mfsa2024-62 advisory. - Using remote content in OpenPGP encrypted messages can lead to the disclosure of plaintext. CVE-2024-11159 Note that Ness...

Mozilla Thunderbird < 128.4.3

The version of Thunderbird installed on the remote Windows host is prior to 128.4.3. It is, therefore, affected by a vulnerability as referenced in the mfsa2024-61 advisory. - Using remote content in OpenPGP encrypted messages can lead to the disclosure of plaintext. CVE-2024-11159 Note that Ness...

Medium: ecs-service-connect-agent

Issue Overview: Envoy is a cloud-native high-performance edge/middle/service proxy. A security vulnerability in Envoy allows external clients to manipulate Envoy headers, potentially leading to unauthorized access or other malicious actions within the mesh. This issue arises due to Envoy's defaul...