NetApp SnapCenter Improper Authorization Vulnerability - Lenovo Support US

No description provided...

PT-2024-2014 · Veritas · Veritas Netbackup Appliance +1

Name of the Vulnerable Software and Affected Versions: Veritas NetBackup versions prior to 8.1.2 Veritas NetBackup Appliance versions prior to 3.1.2 Description: The issue is related to inadequate validation of the file path by the BPCD process, allowing an unauthenticated attacker to upload and...

PT-2024-2626

Name of the Vulnerable Software and Affected Versions Nix versions prior to 2.3.18 Nix versions prior to 2.18.2 Nix versions prior to 2.19.4 Nix versions prior to 2.20.5 Description The issue is related to errors in synchronization when using a shared resource in the Nix package manager for Unix...

BIT-TENSORFLOW-2020-26266 Uninitialized memory access in Eigen types in TensorFlow

In affected versions of TensorFlow under certain cases a saved model can trigger use of uninitialized values during code execution. This is caused by having tensor buffers be filled with the default value of the type but forgetting to default initialize the quantized floating point types in Eigen...

BIT-TENSORFLOW-2021-29576 Heap buffer overflow in `MaxPool3DGradGrad`

TensorFlow is an end-to-end open source platform for machine learning. The implementation of tf.rawops.MaxPool3DGradGrad is vulnerable to a heap buffer overflow. The...

BIT-TENSORFLOW-2023-25674 TensorFlow has Null Pointer Error in RandomShuffle with XLA enable

TensorFlow is an open source machine learning platform. Versions prior to 2.12.0 and 2.11.1 have a null pointer error in RandomShuffle with XLA enabled. A fix is included in TensorFlow 2.12.0 and 2.11.1...

BIT-DISCOURSE-2023-48297 Discourse vulnerable to unlimited mentioned users in message serializer

Discourse is a platform for community discussion. The message serializer uses the full list of expanded chat mentions @all and @here which can lead to a very long array of users. This issue was patched in versions 3.1.4 and beta 3.2.0.beta5...

PT-2024-20544 · Unknown · Casaos-Userservice

Name of the Vulnerable Software and Affected Versions: CasaOS-UserService versions 0.4.4.3 through 0.4.6 Description: The CasaOS Login page has a username enumeration issue, allowing an attacker to enumerate CasaOS usernames using the application response. If the username is incorrect, the...

PT-2024-21167 · Foxit · Foxit Pdf Reader +1

Name of the Vulnerable Software and Affected Versions: Foxit PDF Reader versions prior to 2024.1 Foxit PDF Editor versions prior to 2024.1 Description: The issue allows code execution via JavaScript due to an unoptimized prompt message for users to review parameters of commands. Recommendations:...

PT-2024-21389 · Prestashop · Prestashop Product Designer Module

Name of the Vulnerable Software and Affected Versions: PrestaShop Product Designer module versions prior to 1.178.36 Description: A Server-Side Request Forgery SSRF issue allows remote attackers to cause a denial of service DoS and escalate privileges via the url parameter in the postProcess...

PT-2024-15952 · WordPress · Widget For Social Page Feeds

Name of the Vulnerable Software and Affected Versions: Widget for Social Page Feeds WordPress plugin versions prior to 6.4 Description: The issue concerns the Widget for Social Page Feeds WordPress plugin, which does not properly sanitise and escape some of its settings. This could allow high...

CVE-2024-27295 Directus MySQL accent insensitive email matching

Directus is a real-time API and App dashboard for managing SQL database content. The password reset mechanism of the Directus backend allows attackers to receive a password reset email of a victim user, specifically having it arrive at a similar email address as the victim with a one or more...

PT-2024-20584 · Espocrm · Espocrm

Name of the Vulnerable Software and Affected Versions: EspoCRM versions prior to 8.1.2 Description: The issue allows an attacker to inject arbitrary IP or domain in the "Password Change" page, potentially redirecting the victim to a malicious page. This could lead to credential stealing or other...

PT-2024-15332 · Hypr · Hypr Workforce Access

Name of the Vulnerable Software and Affected Versions: HYPR Workforce Access versions prior to 8.7.1 Description: The issue is related to an Improper Link Resolution Before File Access, also known as 'Link Following', which allows file manipulation in HYPR Workforce Access on MacOS...

PT-2024-21168 · Blesta · Blesta

Name of the Vulnerable Software and Affected Versions: Blesta versions prior to 5.9.2 Description: A path traversal vulnerability in the "/path/to/uploads/" directory allows attackers to takeover user accounts and execute arbitrary code. Recommendations: For versions prior to 5.9.2, update to...

PT-2024-15223 · WordPress · Wp Dashboard Notes

Name of the Vulnerable Software and Affected Versions: WP Dashboard Notes WordPress plugin versions prior to 1.0.11 Description: The issue allows authenticated users to delete private notes associated with different user accounts due to Insecure Direct Object References IDOR in the post id=...

PT-2024-21643 · Unknown · Hoppscotch

Name of the Vulnerable Software and Affected Versions: Hoppscotch versions prior to 2023.12.6 Description: Hoppscotch is an API development ecosystem. Due to the lack of validation for fields like Label Edit Team - TeamName, bad actors can send emails with spoofed content as Hoppscotch. Part of t...

PT-2024-1927

Name of the Vulnerable Software and Affected Versions Rack versions prior to 2.2.8.1 Rack versions prior to 3.0.9.1 Description The issue is related to a denial of service vulnerability in Rack's content type parsing, where carefully crafted content type headers can cause the media type parser to...

LockBit Attempts to Stay Afloat With a New Version

This research is the result of our collaboration with the National Crime Agency in the United Kingdom, who took action against LockBit as part of Operation Cronos, an international effort resulting in the undermining of its operations...

PT-2024-13191 · Basercms · Basercms

Name of the Vulnerable Software and Affected Versions: baserCMS versions prior to 5.0.9 Description: The issue is related to a cross-site scripting vulnerability in the site search feature of baserCMS, a website development framework. This vulnerability allows malicious code to be executed in the...