PT-2024-23125 · Unknown · Codeigniter

Name of the Vulnerable Software and Affected Versions: CodeIgniter versions prior to 4.4.7 Description: A vulnerability was found in the Language class that allowed DoS attacks, which can be exploited by an attacker to consume a large amount of memory on the server. Recommendations: Upgrade to...

PT-2024-23287 · Unknown · Typps Calendarista

Name of the Vulnerable Software and Affected Versions: Typps Calendarista versions prior to 15.5.7 Description: The issue is related to an SQL Injection vulnerability due to the improper neutralization of special elements used in an SQL command. This allows for potential exploitation by injecting...

PT-2024-22636 · Tumult · Tumult Hype Animations

Name of the Vulnerable Software and Affected Versions: Tumult Hype Animations versions 1.9.12 and earlier Description: The issue is related to an Unrestricted Upload of File with Dangerous Type, which affects Tumult Hype Animations. Recommendations: For versions 1.9.12 and earlier, update to a...

PT-2024-21723 · Cloudways · Cloudways Breeze

Name of the Vulnerable Software and Affected Versions: Cloudways Breeze versions through 2.1.3 Description: The issue is related to improper neutralization of input during web page generation, which allows for Stored XSS. This means an attacker could inject malicious scripts into the website,...

Critical: Red Hat Security Advisory: firefox security update

An update for firefox is now available for Red Hat Enterprise Linux 8.4 Advanced Mission critical Update Support, Red Hat Enterprise Linux 8.4 Telecommunications Update Service, and Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as...

[R1] Stand-alone Security Patch Available for Tenable Security Center versions 5.23.1, 6.1.1, 6.2.0 and 6.2.1: SC-202403.1

R1 Stand-alone Security Patch Available for Tenable Security Center versions 5.23.1, 6.1.1, 6.2.0 and 6.2.1: SC-202403.1 Arnie Cabral Mon, 03/25/2024 - 11:58 Security Center leverages third-party software to help provide underlying functionality. One of the third-party components sqlite was found...

PT-2024-13289 · Unknown · Oroplatform

Name of the Vulnerable Software and Affected Versions: OroPlatform versions prior to 5.1.4 Description: A logged in user can access page state data of pinned pages of other users by pageId hash. This issue allows unauthorized access to sensitive information. Recommendations: For versions prior to...

PT-2024-10837 · Unknown · Awesomestcode Livebot

Name of the Vulnerable Software and Affected Versions: AwesomestCode LiveBot affected versions not specified Description: A vulnerability was found in AwesomestCode LiveBot, classified as problematic, affecting the function parseSend of the file js/parseMessage.js. This leads to cross-site...

OESA-2024-1322 python-aiosmtpd security update

This is a server for SMTP and related protocols, similar in utility to the standard library's smtpd.py module, but rewritten to be based on asyncio for Python 3. Security Fixes: aiosmtpd is a reimplementation of the Python stdlib smtpd.py based on asyncio. aiosmtpd is vulnerable to inbound SMTP...

GHSA-9W38-P64V-XPMV Apache Commons Configuration: StackOverflowError calling ListDelimiterHandler.flatten(Object, int) with a cyclical object tree

This Out-of-bounds Write vulnerability in Apache Commons Configuration affects Apache Commons Configuration: from 2.0 before 2.10.1. User can see this as a 'StackOverflowError' calling 'ListDelimiterHandler.flattenObject, int' with a cyclical object tree. Users are recommended to upgrade to versi...

CVE-2024-29131 Apache Commons Configuration: StackOverflowError adding property in AbstractListDelimiterHandler.flattenIterator()

Out-of-bounds Write vulnerability in Apache Commons Configuration.This issue affects Apache Commons Configuration: from 2.0 before 2.10.1. Users are recommended to upgrade to version 2.10.1, which fixes the issue...

PT-2024-23091 · Datalust · Datalust Seq

Name of the Vulnerable Software and Affected Versions: Datalust Seq versions before 2023.4.11151 Datalust Seq version 2024 before 2024.1.11146 Description: The issue is related to Incorrect Access Control, where a Project Owner or Organization Owner can escalate to System privileges. This can be...

Important: javapackages-bootstrap

Issue Overview: Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.3 through 1.25.0. Users are recommended to upgrade to version 1.26.0 which fixes the issue. CVE-2024-25710 Affected Packages:...

PT-2024-22363 · Cilium · Cilium

Name of the Vulnerable Software and Affected Versions: Cilium versions 1.13.9 through 1.13.12 Cilium versions 1.14.0 through 1.14.7 Cilium versions 1.15.0 through 1.15.1 Description: Cilium's HTTP policies are not consistently applied to all traffic in the scope of the policies, leading to HTTP...

PT-2024-3221

Name of the Vulnerable Software and Affected Versions Apache Airflow FTP Provider versions prior to 3.7.0 Description The issue is related to improper certificate validation in FTP TLS connections, which can potentially be leveraged by an attacker. This can impact the confidentiality, integrity,...

CVE-2024-28255 Authentication Bypass in OpenMetadata

OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration. The JwtFilter handles the API authentication by requiring and verifying JWT tokens. When a new request comes in, the request...

CVE-2023-51699 OS Command Injection for Fluid Users with JuicefsRuntime

Fluid is an open source Kubernetes-native Distributed Dataset Orchestrator and Accelerator for data-intensive applications. An OS command injection vulnerability within the Fluid project's JuicefsRuntime can potentially allow an authenticated user, who has the authority to create or update the K8...

PT-2024-22607

Name of the Vulnerable Software and Affected Versions tls-listener versions prior to 0.10.0 Description The default configuration of tls-listener makes any public service using TlsListener::new vulnerable to a slow-loris DoS attack. A malicious user can open 6.4 TcpStreams a second, sending 0...

PT-2024-21637 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to the latest version Description: The issue affects Discourse, an open source platform for community discussion. Users allowed to invite others can inject arbitrarily large data in parameters used in the invite route...

PT-2024-19925 · Elementor · Elementor Pro

Name of the Vulnerable Software and Affected Versions: Elementor Pro versions 3.19.2 and earlier Description: The issue is related to the exposure of sensitive information to an unauthorized actor. This is a problem where sensitive data is made available to individuals who should not have access ...