PT-2024-31713 · Pgpool-Ii +2 · Pgpool-Ii +2

Name of the Vulnerable Software and Affected Versions: Pgpool-II versions up to 4.5.3 Description: Exposure of sensitive information due to incompatible policies issue exists in Pgpool-II. If a database user accesses a query cache, table data unauthorized for the user may be retrieved...

CVE-2024-44335

Affected devices: D-Link DI-7003G (v19.12.24A1), DI-7003GV2 (v24.04.18D1), DI-7100G+V2 (v24.04.18D1), DI-7100GV2 (v24.04.18D1), DI-7200GV2 (v24.04.18E1), DI-7300G+V2 (v24.04.18D1), and DI-7400G+V2 (v24.04.18D1). RedHat and NVD descriptions confirm a Remote Command Execution (RCE) vulnerability vi...

CVE-2024-8572 Gouniverse GoLang CMS FrontendHandler.go PageRenderHtmlByAlias cross site scripting

A vulnerability was found in Gouniverse GoLang CMS 1.4.0. It has been declared as problematic. This vulnerability affects the function PageRenderHtmlByAlias of the file FrontendHandler.go. The manipulation of the argument alias leads to cross site scripting. The attack can be initiated remotely...

PYSEC-2024-212

Apache Airflow versions before 2.10.1 have a vulnerability that allowsDAG authors to add local settings to the DAG folder and get it executed by the scheduler, where the scheduler is not supposed to execute code submitted by the DAG author. Users are advised to upgrade to version 2.10.1 or later,...

OESA-2024-2114 ruby security update

Ruby is a fast and easy interpreted scripting language for object-oriented programming. It has many functions for processing text Files and perform system management tasks such as Perl. Security Fixes: REXML is an XML toolkit for Ruby. The REXML gem before 3.3.1 has some DoS vulnerabilities when ...

[SECURITY] [DLA 3869-1] firefox-esr security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3869-1 [email protected] https://www.debian.org/lts/security/ Emilio Pozuelo Monfort September 04, 2024 https://wiki.debian.org/LTS -...

CVE-2024-45195 Apache OFBiz: Confused controller-view authorization logic (forced browsing)

Direct Request 'Forced Browsing' vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.16. Users are recommended to upgrade to version 18.12.16, which fixes the issue...

PT-2024-31595 · Unknown · @Tinacms/Cli

Name of the Vulnerable Software and Affected Versions: @tinacms/cli versions prior to 1.6.2 Description: Tina is an open-source content management system CMS. Sites building with Tina CMS's command line interface CLI that use a search token may be vulnerable to the search token being leaked via...

[SECURITY] [DLA 3861-1] exfatprogs security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3861-1 [email protected] https://www.debian.org/lts/security/ Adrian Bunk September 02, 2024 https://wiki.debian.org/LTS -...

PT-2024-38060

Name of the Vulnerable Software and Affected Versions Brain Low-Code versions prior to 2.1.0 Description The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This vulnerability affects the Hibernate component in Brain...

PT-2024-10988 · Netiq · Netiq Advance Authentication

Name of the Vulnerable Software and Affected Versions: NetIQ Advance Authentication versions prior to 6.3.5.1 Description: A vulnerability identified in Advance Authentication allows bash command injection in administrative controlled functionality of backup due to improper handling in provided...

Access Restriction Bypass

Overview Shopify/tophat is a package for easily installing and testing mobile applications Affected versions of this package are vulnerable to Access Restriction Bypass in ArtifactProvider, which can be downgraded to HTTP via a malicious URL. An attacker can expose the TOPHATAPPTOKEN by directing...

PT-2024-30413 · Unknown · Bit Form Pro

Name of the Vulnerable Software and Affected Versions: Bit Form Pro versions through 2.6.4 Description: The issue is related to the exposure of sensitive information to an unauthorized actor. This can lead to authenticated sensitive data exposure. Recommendations: For versions through 2.6.4, upda...

PT-2024-38828 · Unknown · Itsourcecode E-Commerce Website

Name of the Vulnerable Software and Affected Versions: itsourcecode E-Commerce Website version 1.0 Description: A critical vulnerability has been found in the itsourcecode E-Commerce Website, affecting an unknown functionality of the file search list.php. The manipulation of the user argument lea...

PT-2024-31501 · Hyperledger · Hyperledger Fabric

Name of the Vulnerable Software and Affected Versions: Hyperledger Fabric versions 2.5.0 through 2.5.9 Description: The issue is related to Hyperledger Fabric not verifying that a request has a timestamp within the expected time window. This problem can be exploited due to the lack of proper...

Cisco Unified Communications Manager DoS (cisco-sa-cucm-dos-kkHq43We)

According to its self-reported version, Cisco Unified Communications Manager running on the report host is affected by a denial of service DoS vulnerability. Due to improper processing of SIP messages, an unauthenticated, remote, attacker can cause the system to reload and thus stop responding...

PT-2024-7449 · Apache · Apache Solr

Name of the Vulnerable Software and Affected Versions: Apache Solr versions 5.3.0 through 8.11.3 Apache Solr versions 9.0.0 through 9.6.9 Description: The issue is related to an improper authentication vulnerability in Apache Solr, where Solr instances using the PKIAuthenticationPlugin are...

PT-2024-37674 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 8.2 through 17.1.6 GitLab CE/EE versions 17.2 through 17.2.4 GitLab CE/EE versions 17.3 through 17.3.1 Description: An issue was discovered in GitLab CE/EE, which allows an attacker to create a branch with the same name ...

PT-2024-29898 · Unknown · Kubernetes

Name of the Vulnerable Software and Affected Versions: Kubernetes versions prior to 3385 Description: The issue arises from the user-controlled role parameter entering the application in the Kubernetes::RoleVerificationsController. This parameter flows into the RoleConfigFile initializer and then...

Uncontrolled Resource Consumption ('Resource Exhaustion')

Overview Affected versions of this package are vulnerable to Uncontrolled Resource Consumption 'Resource Exhaustion' due to the parse and parsenat functions. An attacker can cause a denial of service by sending specially crafted inputs that are excessively long. Workaround Ensure that Fugit.parse...