PT-2024-2760 · Mongodb +3 · Mongodb C Driver +3

Name of the Vulnerable Software and Affected Versions: MongoDB C Driver versions prior to 1.25.0 Description: The issue is related to the bson utf8 validate function in the MongoDB C Driver, which can cause an infinite loop when called with certain inputs. This may allow a remote attacker to caus...

PT-2024-13803 · Unknown · Lif Auth Server

Name of the Vulnerable Software and Affected Versions: Lif Auth Server versions prior to 1.4.0 Description: The issue relates to the get pfp and get banner routes on Auth Server, where there is no check to ensure that the file received through these URLs is correct. This could allow an attacker...

SUSE: Security Advisory (SUSE-SU-2024:0075-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2024-14892 · WordPress · The Eventon

Name of the Vulnerable Software and Affected Versions: The EventON - WordPress Virtual Event Calendar Plugin versions 2.2.7 and earlier for free The EventON - WordPress Virtual Event Calendar Plugin versions 4.5.4 and earlier for Pro Description: The issue is related to a missing capability check...

PT-2024-14: Path Traversal and Untrusted Upload File in Pandora FMS

The vulnerability was identified in Pandora FMS, versions from 700 through 776. The vulnerability allows to modify directories, create and upload files outside of authorized directories. The vulnerability is a part of a chain that leads to remote code execution and complete server compromise...

Microsoft ASP.NET Core project templates vulnerable to denial of service

A Denial of Service vulnerability exists in ASP.NET Core project templates which utilize JWT-based authentication tokens. This vulnerability allows an unauthenticated client to consume arbitrarily large amounts of server memory, potentially triggering an out-of-memory condition on the server and...

CVE-2023-1032

The Linux kernel iouring IORINGOPSOCKET operation contained a double free in function syssocketfile in file net/socket.c. This issue was introduced in da214a475f8bd1d3e9e7a19ddfeb4d1617551bab and fixed in 649c15c7691e9b13cbe9bf6c65c365350e056067...

SUSE-SU-2024:0057-1 Security update for eclipse-jgit, jsch

This update for eclipse-jgit, jsch fixes the following issues: Security fix: - CVE-2023-4759: Fixed an arbitrary file overwrite which might have occurred with a specially crafted git repository and a case-insensitive filesystem. bsc1215298 Other fixes: jsch was updated to version 0.2.9: - Added...

PT-2024-14893 · WordPress · Wp Crowdfunding

Name of the Vulnerable Software and Affected Versions: WP Crowdfunding WordPress plugin versions prior to 2.1.9 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back in the pag...

PT-2024-18999 · Xwiki +1 · Xwiki Platform +2

Name of the Vulnerable Software and Affected Versions: XWiki Platform versions prior to 14.10.18 XWiki Platform versions prior to 15.5.3 XWiki Platform versions prior to 15.8 RC1 Description: A user able to attach a file to a page can post a malformed TAR file by manipulating file modification...

PT-2024-18994

Name of the Vulnerable Software and Affected Versions pyLoad versions prior to 0.5.0b3.dev77 Description Any unauthenticated user can browse to a specific URL to expose the Flask config, including the SECRET KEY variable. This issue allows attackers to access sensitive information, which could ha...

Input validation

A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vulnerability in the following versions:...

Code injection

A prototype pollution vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to override existing attributes with ones that have incompatible type, which may lead to a crash via a network. We have already fixed the...

CVE-2023-45039 QTS, QuTS hero

A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vulnerability in the following versions:...

CVE-2023-47560 QuMagie

An OS command injection vulnerability has been reported to affect QuMagie. If exploited, the vulnerability could allow authenticated users to execute commands via a network. We have already fixed the vulnerability in the following version: QuMagie 2.2.1 and later...

PT-2024-19186 · Unknown · Firefly-Iii

Name of the Vulnerable Software and Affected Versions: Firefly III versions prior to 6.1.1 Description: The issue allows for HTML injection in webhooks. It is related to a Client-Side Path Traversal CSPT vulnerability, which can be used to control data that was assumed to be uncontrollable. This...

PT-2024-18977 · Sidequest · Sidequest

Name of the Vulnerable Software and Affected Versions: SideQuest versions prior to 0.10.35 Description: The SideQuest desktop application uses deep links with a custom protocol sidequest:// to trigger actions in the application from its web contents. Due to improper sanitization of deep link URLs...

SUSE-SU-2024:0004-1 Security update for webkit2gtk3

This update for webkit2gtk3 fixes the following issues: - CVE-2023-42890: Fixed processing malicious web content may lead to arbitrary code execution bsc1218033. - CVE-2023-42883: Fixed processing a malicious image may lead to a denial-of-service bsc1218032. - CVE-2023-41074: Fixed use-after-free...

SUSE-SU-2024:0003-1 Security update for webkit2gtk3

This update for webkit2gtk3 fixes the following issues: - CVE-2023-42890: Fixed processing malicious web content may lead to arbitrary code execution bsc1218033. - CVE-2023-42883: Fixed processing a malicious image may lead to a denial-of-service bsc1218032. - CVE-2023-41074: Fixed use-after-free...

SUSE-SU-2024:0002-1 Security update for webkit2gtk3

This update for webkit2gtk3 fixes the following issues: - CVE-2023-42890: Fixed processing malicious web content may lead to arbitrary code execution bsc1218033. - CVE-2023-42883: Fixed processing a malicious image may lead to a denial-of-service bsc1218032. - CVE-2023-41074: Fixed use-after-free...