Slackware Linux 15.0 / current xorg-server Vulnerability (SSA:2024-304-04)

The version of xorg-server installed on the remote host is prior to 1.20.14 / 21.1.14 / 21.1.4 / 24.1.4. It is, therefore, affected by a vulnerability as referenced in the SSA:2024-304-04 advisory. New xorg-server packages are available for Slackware 15.0 and -current to fix security issues...

Slackware Linux 15.0 / current mozilla-firefox Multiple Vulnerabilities (SSA:2024-304-02)

The version of mozilla-firefox installed on the remote host is prior to 128.4.0esr. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2024-304-02 advisory. New mozilla-firefox packages are available for Slackware 15.0 and -current to fix security issues. Tenable has...

PT-2024-34154

Name of the Vulnerable Software and Affected Versions: I, Librarian versions prior to 5.11.2 Description: The issue arises from a broken logic in handling Supplemental Files, allowing unsafe files with Javascript to be executed within the application context. An attacker can exploit this by...

PT-2024-34219 · Postx · Postx

Name of the Vulnerable Software and Affected Versions: PostX versions prior to 4.1.13 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS attacks. Recommendations: For versions prior t...

PT-2024-34668 · Tiki · Tiki

Name of the Vulnerable Software and Affected Versions: Tiki versions prior to 27.1 Description: The issue allows users with specific permissions to insert a stored XSS payload in the description, potentially leading to security breaches. Recommendations: For versions prior to 27.1, update to...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : go1.21-openssl (SUSE-SU-2024:3755-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3755-1 advisory. - CVE-2024-24791: Fixed denial of service due to improper 100-continue handling bsc1227314 -...

FreeBSD : chromium -- multiple security fixes (fafaef4d-f364-4a07-bbdd-bf53448c593c)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the fafaef4d-f364-4a07-bbdd-bf53448c593c advisory. Chrome Releases reports: This update includes 3 security fixes: Tenable has extracted the...

Security update for go1.21-openssl

This update for go1.21-openssl fixes the following issues: CVE-2024-24791: Fixed denial of service due to improper 100-continue handling bsc1227314 CVE-2024-24789: Fixed mishandling of corrupt central directory record in archive/zip bsc1225973 CVE-2024-24790: Fixed unexpected behavior from Is...

PT-2024-7940

Name of the Vulnerable Software and Affected Versions Botan versions prior to 3.6.0 Description The issue is related to a compiler-induced secret-dependent operation in the lib/utils/donna128.h component of the Botan cryptographic library. This can lead to information disclosure through...

PT-2024-33852

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.6.58 Description: A vulnerability in the Linux kernel's cpufreq function has been resolved. The issue occurred in the parse perf domain function, where a bad reference count on the CPU node could happen if the...

PT-2024-33414 · Martin Gibson · Ideapush

Name of the Vulnerable Software and Affected Versions: IdeaPush versions n/a through 8.69 Description: A Cross-Site Request Forgery CSRF issue is found in Martin Gibson's IdeaPush, allowing hackers to perform actions on behalf of a user without their knowledge. This can lead to unauthorized chang...

CVE-2024-47240

Dell Secure Connect Gateway SCG 5.24 contains an Incorrect Default Permissions vulnerability. A local attacker with low privileges can access the file system and could potentially exploit this vulnerability to gain write access to unauthorized data and cause a version update failure condition...

CVE-2024-47240

Dell Secure Connect Gateway SCG 5.24 contains an Incorrect Default Permissions vulnerability. A local attacker with low privileges can access the file system and could potentially exploit this vulnerability to gain write access to unauthorized data and cause a version update failure condition...

CVE-2024-47240

Dell Secure Connect Gateway SCG 5.24 contains an Incorrect Default Permissions vulnerability. A local attacker with low privileges can access the file system and could potentially exploit this vulnerability to gain write access to unauthorized data and cause a version update failure condition...

CVE-2024-47240

CVE-2024-47240 concerns Dell Secure Connect Gateway (SCG) version 5.24. The vulnerability is described as an incorrect default permissions issue, where a local attacker with low privileges can access the file system and potentially gain write access to unauthorized data, which could also cause a ...

PT-2024-10749 · WordPress · Wp Responsive Photo Gallery +1

Name of the Vulnerable Software and Affected Versions: The Photo Gallery Slideshow & Masonry Tiled Gallery plugin for WordPress versions prior to 1.0.4 WP Responsive Photo Gallery plugin for WordPress versions prior to 1.0.4 WP Responsive Photo Gallery plugin for WordPress version 1.0.3...

java-1.8.0-openjdk security update

1.8.0.432.b06-2.0.1 - Add Oracle vendor bug URL Orabug: 34340155 1:1.8.0.432.b06-1 - Update to shenandoah-jdk8u432-b06 GA - Update release notes for shenandoah-8u432-b06. - Drop JDK-8281096,7,8/PR3836 patch following integration of upstream version - Regenerate JDK-8199936/PR3533 patch following...

PT-2024-31923 · Unknown · Redaxo Cms

Name of the Vulnerable Software and Affected Versions: REDAXO CMS version 2.11.0 Description: A remote code execution RCE vulnerability was discovered in REDAXO CMS. This issue allows for remote code execution, which can lead to severe consequences. Recommendations: For version 2.11.0, update to ...

PT-2024-9995 · Drupal +1 · Drupal Core +1

Name of the Vulnerable Software and Affected Versions: Drupal Core versions 10.0.0 through 10.2.9 Description: A vulnerability in Drupal Core allows file manipulation. This issue is related to weaknesses in handling error situations, which could allow a remote attacker to impact the integrity of...

PT-2024-33265 · Unknown · Agent Dart

Name of the Vulnerable Software and Affected Versions: Agent Dart versions prior to 1.0.0-dev.29 Description: The issue is related to improper certificate verification in the lib/agent/certificate.dart file. Specifically, during delegation verification in the checkDelegation function, the caniste...