PT-2024-15332 · Hypr · Hypr Workforce Access

Name of the Vulnerable Software and Affected Versions: HYPR Workforce Access versions prior to 8.7.1 Description: The issue is related to an Improper Link Resolution Before File Access, also known as 'Link Following', which allows file manipulation in HYPR Workforce Access on MacOS...

PT-2024-20584 · Espocrm · Espocrm

Name of the Vulnerable Software and Affected Versions: EspoCRM versions prior to 8.1.2 Description: The issue allows an attacker to inject arbitrary IP or domain in the "Password Change" page, potentially redirecting the victim to a malicious page. This could lead to credential stealing or other...

PT-2024-21168 · Blesta · Blesta

Name of the Vulnerable Software and Affected Versions: Blesta versions prior to 5.9.2 Description: A path traversal vulnerability in the "/path/to/uploads/" directory allows attackers to takeover user accounts and execute arbitrary code. Recommendations: For versions prior to 5.9.2, update to...

PT-2024-15223 · WordPress · Wp Dashboard Notes

Name of the Vulnerable Software and Affected Versions: WP Dashboard Notes WordPress plugin versions prior to 1.0.11 Description: The issue allows authenticated users to delete private notes associated with different user accounts due to Insecure Direct Object References IDOR in the post id=...

PT-2024-21643 · Unknown · Hoppscotch

Name of the Vulnerable Software and Affected Versions: Hoppscotch versions prior to 2023.12.6 Description: Hoppscotch is an API development ecosystem. Due to the lack of validation for fields like Label Edit Team - TeamName, bad actors can send emails with spoofed content as Hoppscotch. Part of t...

PT-2024-1927

Name of the Vulnerable Software and Affected Versions Rack versions prior to 2.2.8.1 Rack versions prior to 3.0.9.1 Description The issue is related to a denial of service vulnerability in Rack's content type parsing, where carefully crafted content type headers can cause the media type parser to...

LockBit Attempts to Stay Afloat With a New Version

This research is the result of our collaboration with the National Crime Agency in the United Kingdom, who took action against LockBit as part of Operation Cronos, an international effort resulting in the undermining of its operations...

PT-2024-13191 · Basercms · Basercms

Name of the Vulnerable Software and Affected Versions: baserCMS versions prior to 5.0.9 Description: The issue is related to a cross-site scripting vulnerability in the site search feature of baserCMS, a website development framework. This vulnerability allows malicious code to be executed in the...

PYSEC-2024-226

Pymatgen Python Materials Genomics is an open-source Python library for materials analysis. A critical security vulnerability exists in the JonesFaithfulTransformation.fromtransformationstr method within the pymatgen library prior to version 2024.2.20. This method insecurely utilizes eval for...

PT-2024-16346 · WordPress · Event Tickets/Registration

Name of the Vulnerable Software and Affected Versions: Event Tickets and Registration plugin for WordPress versions up to, and including, 5.8.1 Description: The issue is related to a missing capability check on the email action, allowing authenticated attackers with contributor-level access and...

PT-2024-20566 · Unknown · Soninow Team Debug

Name of the Vulnerable Software and Affected Versions: SoniNow Team Debug versions 1.10 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web application that...

PT-2024-15241 · Openvpn +1 · Openvpn +1

Name of the Vulnerable Software and Affected Versions: OpenVPN versions prior to 2.6.9 Description: The OpenVPN GUI installer did not set proper access control restrictions to the installation directory of OpenVPN binaries when using a non-standard installation path. This allows an attacker to...

PT-2024-3058 · Qemu +5 · Qemu +5

Name of the Vulnerable Software and Affected Versions: QEMU versions prior to 8.2.0 Description: The issue is related to an integer underflow and a resultant buffer overflow in QEMU, which can occur through a TI command when the expected non-DMA transfer length is less than the length of the...

PT-2024-6085

Name of the Vulnerable Software and Affected Versions Botan versions prior to 2.19.4 and 3.3.0 Description The issue is related to the parsing of X.509 certificates with explicit encoding of elliptic curve parameters. An attacker can present a certificate with very large parameters, causing...

CVE-2024-25619 Destroying OAuth Applications doesn't notify Streaming of Access Tokens being destroyed in mastodon

Mastodon is a free, open-source social network server based on ActivityPub. When an OAuth Application is destroyed, the streaming server wasn't being informed that the Access Tokens had also been destroyed, this could have posed security risks to users by allowing an application to continue...

PT-2024-1964 · Siemens · Simcenter Femap

Name of the Vulnerable Software and Affected Versions: Simcenter Femap versions prior to V2401.0000 Simcenter Femap versions prior to V2306.0001 Description: A vulnerability has been identified in Simcenter Femap that is related to an out of bounds read past the end of an allocated structure whil...

Intel® SSU Software Advisory

Summary: A potential security vulnerability in some Intel® System Support Utility SSU software may allow escalation of privilege. Intel is releasing software updates to mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2023-40156 Description: Uncontrolled search path elemen...

PT-2024-1911 · Intel · Intel Mpi Library

Name of the Vulnerable Software and Affected Versions: IntelR MPI Library Software versions prior to 2021.11 Description: The issue is related to an uncontrolled search path in the IntelR MPI Library Software, which may allow an authenticated user to potentially enable escalation of privilege via...

CVE-2024-23833 OpenRefine JDBC Attack Vulnerability

OpenRefine is a free, open source power tool for working with messy data and improving it. A jdbc attack vulnerability exists in OpenRefineversion=3.7.7 where an attacker may construct a JDBC query which may read files on the host filesystem. Due to the newer MySQL driver library in the latest...

SUSE-SU-2024:0441-1 Security update for kubevirt, virt-api-container, virt-controller-container, virt-exportproxy-container, virt-exportserver-container, virt-handler-container, virt-launcher-container, virt-libguestfs-tools-container, virt-operator-container, virt-pr-helper-container

This update for kubevirt, virt-api-container, virt-controller-container, virt-exportproxy-container, virt-exportserver-container, virt-handler-container, virt-launcher-container, virt-libguestfs-tools-container, virt-operator-container, virt-pr-helper-container fixes the following issues: Update ...