CVE-2024-52338 Apache Arrow R package: Arbitrary code execution when loading a malicious data file

Deserialization of untrusted data in IPC and Parquet readers in the Apache Arrow R package versions 4.0.0 through 16.1.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parquet data from untrusted sources for example, user-supplied input files. This...

CVE-2024-53860 Potential Abuse for Sending Arbitrary Emails in sp-php-email-handler

sp-php-email-handler is a PHP package for handling contact form submissions. Messages sent using this script are vulnerable to abuse, as the script allows anybody to specify arbitrary email recipients and include user-provided content in confirmation emails. This could enable malicious actors to...

Veeam Backup and Replication 10.x < 12.2.0.334 Authentication Bypass (November 2024) (KB4682)

The version of Veeam Backup and Replication installed on the remote Windows host is prior to 12.2.0.334. It is, therefore, affected by an authentication bypass vulnerability. Attackers must be able to perform Man-in-the-Middle MITM attack to exploit this vulnerability. Note that Nessus has not...

[SECURITY] [DSA 5819-1] php8.2 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5819-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff November 26, 2024 https://www.debian.org/security/faq -...

CVE-2024-47250 Apache NimBLE: Lack of input validation in HCI advertising report could lead to potential out-of-bound access

Out-of-bounds Read vulnerability in Apache NimBLE. Missing proper validation of HCI advertising report could lead to out-of-bound access when parsing HCI event and thus bogus GAP 'device found' events being sent. This issue requires broken or bogus Bluetooth controller and thus severity is...

GitLab 16.9.8 < 17.4.5 / 17.5 < 17.5.3 / 17.6 < 17.6.1 (CVE-2024-11669)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - Incorrect Authorization in GitLab CVE-2024-11669 Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C...

CVE-2024-10978 affecting package postgresql for versions less than 16.5-1

CVE-2024-10978 affecting package postgresql for versions less than 16.5-1. An upgraded version of the package is available that resolves this issue...

CVE-2024-53268 Lack of validation on openExternal allows 1 click remote code execution in joplin

Joplin is an open source, privacy-focused note taking app with sync capabilities for Windows, macOS, Linux, Android and iOS. In affected versions attackers are able to abuse the fact that openExternal is used without any filtering of URI schemes to obtain remote code execution in Windows...

CVE-2024-53262 Unescaped error message included on error page in SvelteKit

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. The static error.html template for errors contains placeholders that are replaced without escaping the content first. error.html is the page that is rendered when everything else fails. It can contai...

Time-of-check Time-of-use (TOCTOU) Race Condition

Overview mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models. Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition due to excessive...

PT-2024-35460 · Ngtcp2 · Ngtcp2

Name of the Vulnerable Software and Affected Versions: ngtcp2 versions prior to 1.9.1 Description: The issue arises from the lack of validation of acks before they are written to the qlog, leading to a buffer overflow. This occurs in the ngtcp2 conn::conn recv pkt function when handling an ACK,...

com.amazonaws:aws-java-sdk-s3 Dependency in Bamboo Data Center and Server

This High severity com.amazonaws:aws-java-sdk-s3 Dependency vulnerability was introduced in versions 9.0.0, 9.1.0, and 9.2.1 of Bamboo Data Center and Server. This com.amazonaws:aws-java-sdk-s3 Dependency vulnerability, with a CVSS Score of 7.9 and a CVSS Vector of...

[SECURITY] [DSA 5812-2] postgresql-15 regression update

------------------------------------------------------------------------- Debian Security Advisory DSA-5812-2 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff November 21, 2024 https://www.debian.org/security/faq -...

CVE-2024-52797 Searching Opencast may cause a denial of service

Opencast is free and open source software for automated video capture and distribution. First noticed in Opencast 13 and 14, Opencast's Elasticsearch integration may generate syntactically invalid Elasticsearch queries in relation to previously acceptable search queries. From Opencast version 11....

PHP 8.1.x < 8.1.31 Multiple Vulnerabilities

The version of PHP installed on the remote host is prior to 8.1.31. It is, therefore, affected by multiple vulnerabilities as referenced in the Version 8.1.31 advisory. Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number...

PYSEC-2024-160

lxmlhtmlclean is a project for HTML cleaning functionalities copied from lxml.html.clean. Prior to version 0.4.0, the HTML Parser in lxml does not properly handle context-switching for special HTML tags such as , and . This behavior deviates from how web browsers parse and interpret such tags...

Debian dla-3959 : guix - security update

The remote Debian 11 host has a package installed that is affected by a vulnerability as referenced in the dla-3959 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3959-1 [email protected] https://www.debian.org/lts/security/...

Improper Authentication

Overview cobbler is a network install server. Affected versions of this package are vulnerable to Improper Authentication due to the utils.getsharedsecret function. An attacker can gain full control of the server by connecting to the cobbler XML-RPC server using a hardcoded user and password...

SUSE-SU-2024:4036-1 Security update for httpcomponents-client, httpcomponents-core

This update for httpcomponents-client, httpcomponents-core fixes the following issues: httpcomponents-client: - Update to version 4.5.14 HTTPCLIENT-2206: Corrected resource de-allocation by fluent response objects. HTTPCLIENT-2174: URIBuilder to return a new empty list instead of unmodifiable...

PYSEC-2024-313

OpenCTI is an open source platform allowing organizations to manage their cyber threat intelligence knowledge and observables. Prior to version 6.1.9, the regex validation used to prevent Introspection queries can be bypassed by removing the extra whitespace, carriage return, and line feed...