PT-2024-7465 · Fortinet · Fortimanager

Name of the Vulnerable Software and Affected Versions: FortiManager versions 7.4.2 and below FortiManager versions 7.2.5 and below FortiManager versions 7.0.12 and below Description: The issue is related to the exposure of sensitive information to unauthorized actors. It allows a remote...

WordPress myCred plugin <= 2.7.3 - Missing Authorization to Unauthenticated Database Upgrade vulnerability

Missing Authorization to Unauthenticated Database Upgrade vulnerability discovered by Mika in WordPress Plugin myCred versions = 2.7.3...

Error: ".NET (`dotnet-`) must be added to the blacklist to prevent unattended upgrades that could impact the availability of the Linux proxy."

Challenge Attempting to add a Linux-base proxy in Veeam Backup for Microsoft 365 fails with the error: Error: .NET dotnet- must be added to the blacklist to prevent unattended upgrades that could impact the availability of the Linux proxy. Cause This error occurs when the proxy deployment process...

CVE-2024-46979

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to get access to notification filters of any user by using a URL such as...

Security Bulletin: Vulnerabilities in Go affects IBM watsonx.data

Summary Vulnerabilities in the Go package could allow a remote attacker to either inject malicious HTML code into a template causing an HTML injection or execute arbritray code on the system. These vulnerabilities may impact watsonx.data. Vulnerability Details CVEID:CVE-2023-24540 DESCRIPTION: Go...

PT-2024-6621

Name of the Vulnerable Software and Affected Versions Next.js versions 13.5.1 through 14.2.9 Description The issue allows an attacker to poison the cache of a non-dynamic server-side rendered route in the pages router by sending a crafted HTTP request. This could coerce Next.js to cache a route...

PT-2024-37586 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab-CE/EE versions 17.0 through 17.1.7 GitLab-CE/EE versions 17.2 through 17.2.5 GitLab-CE/EE versions 17.3 through 17.3.2 Description: An issue was discovered in GitLab-CE/EE where an attacker, as a guest user, was able to access commit...

Security Bulletin: Vulnerability in Apache Hadoop affects watsonx.data

Summary For CVE-2018-11768, a remote hacker could exploit a vulnerability in Apache Hadoop caused by a mismatch in the size of the fields used to store user/group information between memory and disk representation. For CVE-2020-9492, a remote attacker could gain elevated privileges on the system,...

Security Bulletin: Vulnerability in Google OAuth Client Library affects watsonx.data

Summary Google OAuth Client Library for Java could allow a remote attacker to bypass security restrictions, caused by improper verification of token signatures. By sending a specially-crafted request, an attacker could exploit this vulnerability to bypass verification on the client side or to gai...

Taipy 3.1.1 affected by CVEs on flask-core and pymongo

Summary Indirect CVEs affect Taipy 3.1.1 Details Taipy 3.1.1 is affected by two existing CVEs: CVE-2024-1681 affects flask-core =3.1.2 and on major releases: =4.0.0 Impact pre-commit breaks when using dependency Taipy 3.1.1...

DEBIAN-CVE-2024-42369

matrix-js-sdk is a Matrix messaging protocol Client-Server SDK for JavaScript. A malicious homeserver can craft a room or room structure such that the predecessors form a cycle. The matrix-js-sdk's getRoomUpgradeHistory function will infinitely recurse in this case, causing the code to hang. This...

PT-2024-29903 · Unknown +1 · Matrix-Js-Sdk +1

Name of the Vulnerable Software and Affected Versions: matrix-js-sdk versions prior to 34.3.1 Description: A malicious homeserver can craft a room or room structure such that the predecessors form a cycle. The getRoomUpgradeHistory function will infinitely recurse in this case, causing the code t...

PT-2024-7296

Name of the Vulnerable Software and Affected Versions: org.springframework:spring-web versions 5.3.0 through 5.3.37 org.springframework:spring-web versions 6.0.0 through 6.0.22 org.springframework:spring-web versions 6.1.0 through 6.1.11 Description: Applications that parse ETags from If-Match or...

June 11, 2024—KB5039260 (Monthly Rollup)

None None...

August 13, 2024—KB5041850 (Monthly Rollup)

None None...

July 9, 2024—KB5040498 (Security-only update)

None None...

July 9, 2024—KB5040485 (Monthly Rollup)

None None...

Important: tomcat

Issue Overview: Improper Handling of Exceptional Conditions, Uncontrolled Resource Consumption vulnerability in Apache Tomcat. When processing an HTTP/2 stream, Tomcat did not handle some cases of excessive HTTP headers correctly. This led to a miscounting of active HTTP/2 streams which in turn l...

Important: Red Hat Security Advisory: Red Hat JBoss Web Server 6.0.3 release and security update

An update is now available for Red Hat JBoss Web Server 6.0.3 on Red Hat Enterprise Linux versions 8 and 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

Security Bulletin: Security vulnerabilities may affect IBM Java shipped with IBM CICS TX Advanced

Summary Security vulnerabilities may affect IBM Java shipped with IBM CICS TX Advanced. IBM CICS TX Advanced has addressed the applicable issues. Vulnerability Details CVEID:CVE-2024-21094 DESCRIPTION: An unspecified vulnerability in Java SE related to the VM component could allow a remote attack...