CVE-2023-40550 affecting package shim for versions less than 15.8-5

CVE-2023-40550 affecting package shim for versions less than 15.8-5. An upgraded version of the package is available that resolves this issue...

CVE-2022-4968 affecting package netplan for versions less than 1.0.1-1

CVE-2022-4968 affecting package netplan for versions less than 1.0.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2023-40551 affecting package shim for versions less than 15.8-5

CVE-2023-40551 affecting package shim for versions less than 15.8-5. An upgraded version of the package is available that resolves this issue...

PT-2024-10156 · Gitlab · Gitlab Ce/Ee

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 11.0 through 17.4.6 GitLab CE/EE versions 17.5 through 17.5.4 GitLab CE/EE versions 17.6 through 17.6.2 Description: The issue is related to the GraphQL Mutation Handler component of the GitLab platform, which can lead t...

Microsoft Edge (Chromium) < 131.0.2903.86 (CVE-2024-49041)

The version of Microsoft Edge installed on the remote Windows host is prior to 131.0.2903.86. It is, therefore, affected by a vulnerability as referenced in the December 5, 2024 advisory. - Microsoft Edge Chromium-based Spoofing Vulnerability CVE-2024-49041 Note that Nessus has not tested for thi...

PT-2024-35953 · Rpgp · Rpgp

Name of the Vulnerable Software and Affected Versions: rPGP versions prior to 0.14.1 Description: The issue allows an attacker to trigger crashes in rPGP by providing crafted data. This can occur in various scenarios, including parsing OpenPGP messages, decrypting messages via decrypt with...

Check Point response to Apache HTTP CVE-2024-38473, CVE-2024-38474, CVE-2024-38475, CVE-2024-38476, CVE-2024-38477, CVE-2024-39573, CVE-2024-39884

Symptoms - These issues were reported in the Apache HTTP Server version 2.4.60 and lower: 1. CVE-2024-38473 - Apache HTTP Server: proxy encoding problem 2. CVE-2024-38474 - Apache HTTP Server: weakness with encoded question marks in backreferences 3. CVE-2024-38475 - Apache HTTP Server: weakness...

GHSA-JCXM-7WVP-G6P5 Modified package published to npm, containing malware that exfiltrates private key material

Earlier today, a publish-access account was compromised for @solana/web3.js, a JavaScript library that is commonly used by Solana dapps. This allowed an attacker to publish unauthorized and malicious packages that were modified, allowing them to steal private key material and drain funds from...

Build corruption when using `PYO3_CONFIG_FILE` environment variable

In PyO3 0.23.0 the PYO3CONFIGFILE environment variable used to configure builds regressed such that changing the environment variable would no longer trigger PyO3 to reconfigure and recompile. In combination with workflows using tools such as maturin to build for multiple versions in a single...

PT-2024-9187

Name of the Vulnerable Software and Affected Versions: Django versions 4.2 through 4.2.17 Django versions 5.0 through 5.0.10 Django versions 5.1 through 5.1.4 Description: An issue was discovered in Django when using an Oracle database. Direct usage of the django.db.models.fields.json.HasKey look...

Slackware Linux 15.0 / current python3 Vulnerability (SSA:2024-339-01)

The version of python3 installed on the remote host is prior to 3.12.8 / 3.9.21. It is, therefore, affected by a vulnerability as referenced in the SSA:2024-339-01 advisory. New python3 packages are available for Slackware 15.0 and -current to fix security issues. Tenable has extracted the...

PT-2024-35839 · Unknown · April'S Call Posts

Name of the Vulnerable Software and Affected Versions: April's Call Posts versions n/a through 2.1.1 Description: The issue is related to a Cross-Site Request Forgery CSRF problem that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web...

PT-2024-31436 · Apache · Apache Ozone

Name of the Vulnerable Software and Affected Versions: Apache Ozone version 1.4.0 Description: The issue is related to improper authentication of an HTTP endpoint in the S3 Gateway of Apache Ozone. This allows any authenticated Kerberos user to revoke and regenerate the S3 secrets of any other...

PT-2024-36001

Name of the Vulnerable Software and Affected Versions: rails-html-sanitizer versions 1.6.0 Description: The issue is related to a possible XSS vulnerability with certain configurations of Rails::HTML::Sanitizer when used with Rails = 7.1.0. This vulnerability may allow an attacker to inject conte...

Race Condition

Overview fastapi-sso is a FastAPI plugin to enable SSO to most common providers such as Facebook login, Google login and login via Microsoft Office 365 Account Affected versions of this package are vulnerable to Race Condition. When multiple concurrent login requests are processed simultaneously,...

Deserialization of Untrusted Data

Overview chattts is an A generative speech model for daily dialogue Affected versions of this package are vulnerable to Deserialization of Untrusted Data when loading the tokenizer with torch.load. An attacker can exploit this by supplying a malicious tokenizer.pt file, leading to code execution...

PT-2024-35871 · Unknown · Capitalize My Title

Name of the Vulnerable Software and Affected Versions: Capitalize My Title versions 0.5.3 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Stored XSS. A Cross-site Scripting XSS...

CVE-2024-53983

The Backstage Scaffolder plugin Houses types and utilities for building scaffolder-related modules. A vulnerability is identified in Backstage Scaffolder template functionality where Server-Side Template Injection SSTI can be exploited to perform Git config injection. The vulnerability allows an...

Incorrect Comparison

Overview PyJWT is a Python implementation of RFC 7519. Affected versions of this package are vulnerable to Incorrect Comparison due to an incorrect string comparison in the iss verification process. Remediation Upgrade PyJWT to version 2.10.1 or higher. References - GitHub Commit - Vulnerable Cod...

PT-2024-35452 · Xid +1 · Xid +1

Name of the Vulnerable Software and Affected Versions: sftpgo versions prior to v2.6.4 Description: The OpenID Connect implementation in sftpgo allows authenticated users to brute force session cookies, gaining access to other users' data. This is because the cookies are generated predictably usi...