AZL-40307 CVE-2024-34062 affecting package python-tqdm for versions less than 4.63.1-3

tqdm is an open source progress bar for Python and CLI. Any optional non-boolean CLI arguments e.g. --delim, --buf-size, --manpath are passed through python's eval, allowing arbitrary code execution. This issue is only locally exploitable and had been addressed in release version 4.66.3. All user...

PT-2024-25575 · Unknown · Happykite Ultimate Under Construction

Name of the Vulnerable Software and Affected Versions: HappyKite Ultimate Under Construction versions 1.9.3 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for stored cross-site scripting XSS. This means that an attacker c...

PT-2024-25674

Name of the Vulnerable Software and Affected Versions tqdm versions prior to 4.66.3 Description tqdm is an open source progress bar for Python and CLI. Any optional non-boolean CLI arguments e.g. --delim, --buf-size, --manpath are passed through python's eval, allowing arbitrary code execution...

AZL-43369 CVE-2024-30251 affecting package python-aiohttp 3.6.2-3

aiohttp is an asynchronous HTTP client/server framework for asyncio and Python. In affected versions an attacker can send a specially crafted POST multipart/form-data request. When the aiohttp server processes it, the server will enter an infinite loop and be unable to process any further request...

freerdp: Out-Of-Bounds Read in nsc_rle_decompress_data

FreeRDP is a free implementation of the Remote Desktop Protocol RDP, released under the Apache license. Affected versions are subject to an Out-Of-Bounds Read in the nscrledecompressdata function. The Out-Of-Bounds Read occurs because it processes context-Planes without checking if it contains da...

PT-2024-25412 · Matthew Fries · Mf Gig Calendar

Name of the Vulnerable Software and Affected Versions: Matthew Fries MF Gig Calendar versions 1.2.1 and earlier Description: A Cross-Site Request Forgery CSRF issue has been identified. This type of issue allows an attacker to trick a user into performing unintended actions on a web application...

PT-2024-11637 · Aazztech · Aazztech Post Slider

Name of the Vulnerable Software and Affected Versions: Aazztech Post Slider versions 1.6.7 and earlier Description: The issue is related to a Missing Authorization vulnerability. This vulnerability affects Aazztech Post Slider, allowing potential unauthorized access. Recommendations: For versions...

PT-2024-25429 · Veritas · Veritas Backup Exec

Name of the Vulnerable Software and Affected Versions: Veritas Backup Exec versions prior to 22.2 HotFix 917391 Description: An issue was discovered in the Veritas Backup Exec software, where the Backup Exec Deduplication Multi-threaded Streaming Agent can be used to perform arbitrary file deleti...

PT-2024-24998 · Unknown · Max Addons Pro For Bricks

Name of the Vulnerable Software and Affected Versions: Max Addons Pro for Bricks versions 1.6.1 and earlier Description: The issue is related to a Missing Authorization vulnerability. This vulnerability affects Max Addons Pro for Bricks, allowing unauthorized access. Recommendations: For Max Addo...

DEBIAN-CVE-2024-32460

FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based based clients using /bpp:32 legacy GDI drawing path with a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, use modern drawin...

Important: tomcat

Issue Overview: Denial of Service via incomplete cleanup vulnerability in Apache Tomcat. It was possible for WebSocket clients to keep WebSocket connections open leading to increased resource consumption.This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.0-M16, from 10.1.0-M1 through...

PT-2024-24705 · 10Web · Photo Gallery

Name of the Vulnerable Software and Affected Versions: Photo Gallery by 10Web versions 1.8.21 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Reflected XSS. Recommendations: For...

PT-2024-3091

Name of the Vulnerable Software and Affected Versions Airflow versions 2.7.0 through 2.8.4 Description The issue is related to insufficient protection of internal data, allowing an authenticated user to access sensitive provider configuration via the "configuration" UI page when the...

PT-2024-24391 · Aitthemes · Aitthemes Citadela Listing

Name of the Vulnerable Software and Affected Versions: AitThemes Citadela Listing versions through 5.18.1 Description: The issue is related to the exposure of sensitive information to an unauthorized actor. This is a problem where sensitive data is made available to individuals who should not hav...

SUSE CVE-2024-32019

Netdata is an open source observability tool. In affected versions the ndsudo tool shipped with affected versions of the Netdata Agent allows an attacker to run arbitrary programs with root permissions. The ndsudo tool is packaged as a root-owned executable with the SUID bit set. It only runs a...

Memory Allocation with Excessive Size Value

Overview Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value due to the processing of specially crafted files that can lead to excessive memory usage in image decoders. This flaw can be exploited to deplete process memory, causing a denial of service an...

PT-2024-24560 · Activecampaign · Activecampaign

Name of the Vulnerable Software and Affected Versions: ActiveCampaign versions n/a through 8.1.14 Description: The issue is a Server-Side Request Forgery SSRF vulnerability. This means an attacker could potentially force the server to make requests to arbitrary domains, which could lead to...

PT-2024-24028 · Rebelcode · Rebelcode Spotlight Social Media Feeds

Name of the Vulnerable Software and Affected Versions: RebelCode Spotlight Social Media Feeds versions 1.6.10 and earlier Description: A Cross-Site Request Forgery CSRF issue affects RebelCode Spotlight Social Media Feeds. This issue allows an attacker to perform unintended actions on a user's...

TIBCO Security Advisory: April 9, 2024 - TIBCO JasperReports Server - CVE-2024-3327

TIBCO JasperReports Server SQL Injection vulnerability Original release date: April 9, 2023 Last revised: --- CVE-2024-3327 Source: TIBCO Software Inc. Products Affected TIBCO JasperReports Server versions 8.0.4 and below TIBCO JasperReports Server versions 8.2.0 and below Component Affected Quer...

GHSA-86JX-WR74-XR74 Improper escaping in Apache Zeppelin

Improper Encoding or Escaping of Output vulnerability in Apache Zeppelin. The attackers can execute shell scripts or malicious code by overriding configuration like ZEPPELININTPCLASSPATHOVERRIDES. This issue affects Apache Zeppelin: from 0.8.2 before 0.11.1. Users are recommended to upgrade to...