PT-2024-1964 · Siemens · Simcenter Femap

Name of the Vulnerable Software and Affected Versions: Simcenter Femap versions prior to V2401.0000 Simcenter Femap versions prior to V2306.0001 Description: A vulnerability has been identified in Simcenter Femap that is related to an out of bounds read past the end of an allocated structure whil...

Intel® SSU Software Advisory

Summary: A potential security vulnerability in some Intel® System Support Utility SSU software may allow escalation of privilege. Intel is releasing software updates to mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2023-40156 Description: Uncontrolled search path elemen...

PT-2024-1911 · Intel · Intel Mpi Library

Name of the Vulnerable Software and Affected Versions: IntelR MPI Library Software versions prior to 2021.11 Description: The issue is related to an uncontrolled search path in the IntelR MPI Library Software, which may allow an authenticated user to potentially enable escalation of privilege via...

CVE-2024-23833 OpenRefine JDBC Attack Vulnerability

OpenRefine is a free, open source power tool for working with messy data and improving it. A jdbc attack vulnerability exists in OpenRefineversion=3.7.7 where an attacker may construct a JDBC query which may read files on the host filesystem. Due to the newer MySQL driver library in the latest...

SUSE-SU-2024:0441-1 Security update for kubevirt, virt-api-container, virt-controller-container, virt-exportproxy-container, virt-exportserver-container, virt-handler-container, virt-launcher-container, virt-libguestfs-tools-container, virt-operator-container, virt-pr-helper-container

This update for kubevirt, virt-api-container, virt-controller-container, virt-exportproxy-container, virt-exportserver-container, virt-handler-container, virt-launcher-container, virt-libguestfs-tools-container, virt-operator-container, virt-pr-helper-container fixes the following issues: Update ...

PT-2024-40234 · Unknown +1 · Vng-Api-Common +1

Name of the Vulnerable Software and Affected Versions: vng-api-common versions prior to 1.12.2 Description: This issue is related to a privilege escalation vulnerability, although its impact is negligible and entirely theoretical. It involves the verification of client-supplied JSON Web Tokens JW...

PT-2024-12874

Name of the Vulnerable Software and Affected Versions Atos Unify OpenScape Voice Trace Manager versions prior to V8 R0.9.11 Description The issue allows authenticated path traversal in the user interface. Recommendations For versions prior to V8 R0.9.11, update to V8 R0.9.11 or later to resolve t...

PT-2024-20603 · Unknown · Audrasjb Gdpr Data Request Form

Name of the Vulnerable Software and Affected Versions: Audrasjb GDPR Data Request Form versions n/a through 1.6 Description: The issue is related to improper neutralization of input during web page generation, which allows stored cross-site scripting XSS. This means that an attacker can inject...

PT-2024-20635 · Unknown · Yannick Lefebvre Link Library

Name of the Vulnerable Software and Affected Versions: Yannick Lefebvre Link Library versions n/a through 7.5.13 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. Recommendations: For...

CVE-2024-23673 Apache Sling Servlets Resolver: Malicious code execution via path traversal

Malicious code execution via path traversal in Apache Software Foundation Apache Sling Servlets Resolver.This issue affects all version of Apache Sling Servlets Resolver before 2.11.0. However, whether a system is vulnerable to this attack depends on the exact configuration of the system. If the...

PT-2024-33940

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.6.61 Description: The issue is related to the Linux kernel, where a problem with the dmub psr enable function and Parade 08-01 TCON causes black screens and kernel WARNING traces at bootup and during fullscree...

CVE-2023-41277 QTS, QuTS hero, QuTScloud

A buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute code via a network. We have already fixed the vulnerability in the following versions:...

PT-2024-20466 · Unknown · Stereoscope

Name of the Vulnerable Software and Affected Versions: stereoscope versions prior to 0.0.1 Description: It is possible to craft an OCI tar archive that, when stereoscope attempts to unarchive the contents, will result in writing to paths outside of the unarchive temporary directory. This issue is...

CVE-2024-24558 react-query-streamed-hydration xss

TanStack Query supplies asynchronous state management, server-state utilities and data fetching for the web. The @tanstack/react-query-next-experimental NPM package is vulnerable to a cross-site scripting vulnerability. To exploit this, an attacker would need to either inject malicious input or...

SUSE-SU-2024:0250-1 Security update for sevctl

This update for sevctl fixes the following issues: - CVE-2023-50711: Fixed out of bounds memory accesses in vmm-sys-util bsc1218502, bsc1218499 Non-security fixes: - Updated to version 0.4.3 jscPED-4981...

PYSEC-2024-126

Label Studio is an a popular open source data labeling tool. Versions prior to 1.9.2 have a cross-site scripting XSS vulnerability that could be exploited when an authenticated user uploads a crafted image file for their avatar that gets rendered as a HTML file on the website. Executing arbitrary...

CVE-2024-23340 @hono/node-server can't handle "double dots" in URL

@hono/node-server is an adapter that allows users to run Hono applications on Node.js. Since v1.3.0, @hono/node-server has used its own Request object with url behavior that is unexpected. In the standard API, if the URL contains .., here called "double dots", the URL string returned by Request...

PT-2025-31025 · Shlex +1 · Shlex +1

Name of the Vulnerable Software and Affected Versions: shlex crate versions prior to 1.2.1 Description: The shlex crate before version 1.2.1 for Rust allows unquoted and unescaped instances of the and xa0 characters, which may facilitate command injection. Recommendations: Update the shlex crate ...

PYSEC-2024-103

Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. The concat built-in can write over the bounds of the memory buffer that was allocated for it and thus overwrite existing valid data. The root cause is that the buildIR for concat doesn't properly adhere to the API of co...

PT-2024-19271 · Unknown · Whoogle Search

Name of the Vulnerable Software and Affected Versions: Whoogle Search versions prior to 0.8.4 Description: Whoogle Search is a self-hosted metasearch engine. The issue arises from the element method in app/routes.py not validating the user-controlled src type and element url variables, which are...