Informational Bulletin: Impact of OpenSSL Vulnerabilities CVE-2024-5535 and CVE-2024-6119

The Palo Alto Networks Product Security Assurance team has evaluated CVE-2024-5535 and CVE-2024-6119 as they relate to our products. PAN-OS, Cloud NGFW, Prisma Access, and Cortex XDR Agent are not affected by CVE-2024-5535 or CVE-2024-6119. At present, no other Palo Alto Networks products are kno...

BELL-CVE-2024-43849

Bulletin has no description...

BELL-CVE-2024-42276

Bulletin has no description...

CVE-2023-52902

creationtimestamp| type| source ---|---|--- 2024-08-21 09:53:01+00:00| seen| https://t.me/cvedetector/3759...

Important: gtk3

Issue Overview: gtk3: gtk2: Library injection from CWD CVE-2024-6655 Affected Packages: gtk3 Issue Correction: Run dnf update gtk3 --releasever 2023.5.20240805 to update your system. New Packages: aarch64: gtk3-immodules-3.24.43-1.amzn2023.0.1.aarch64 ...

CVE-2024-42737

The TOTOLINK X5000r router (version v9.1.0cu.2350_b20230313 ) is vulnerable to an OS command injection vulnerability within the delBlacklist function located in the /cgi-bin/cstecgi.cgi file. Authenticated attackers can exploit this flaw by sending malicious packets to execute arbitrary commands ...

Security Advisory: Ivanti Virtual Traffic Manager (vTM ) (CVE-2024-7593)

Created Date Aug 12, 2024 6:40:06 PM...

BELL-CVE-2024-42155

Bulletin has no description...

BELL-CVE-2024-41063

Bulletin has no description...

Important: java-11-amazon-corretto

Issue Overview: Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE component: Hotspot. Supported versions that are affected are Oracle Java SE: 8u411, 8u411-perf, 11.0.23, 17.0.11, 21.0.3, 22.0.1; Oracle GraalVM for JDK: 17.0.1...

CVE-2024-40543

PublicCMS v4.0.202302.e was discovered to contain a Server-Side Request Forgery SSRF via the component /admin/ueditor?action=catchimage...

CVE-2024-40034

idccms v1.35 was discovered to contain a Cross-Site Request Forgery CSRF vulnerability via /admin/userLeveldeal.php?mudi=del...

CVE-2024-27709

SQL Injection vulnerability in Eskooly Web Product v.3.0 allows a remote attacker to execute arbitrary code via the searchby parameter of the allstudents.php component and the id parameter of the requestmanager.php component...

CVE-2024-39313 toy-blog Improper Input Validation vulnerability

toy-blog is a headless content management system implementation. Starting in version 0.5.4 and prior to version 0.6.1, articles with private visibility can be read if the reader does not set credentials for the request. Users should upgrade to 0.6.1 or later to receive a patch. No known workaroun...

Exploit for CVE-2023-6553

CVE-2023-6553 Due to a incorrect include statement in the "...

[SECURITY] [DLA 3848-1] org-mode security update

Debian LTS Advisory DLA-3848-1 [email protected] https://www.debian.org/lts/security/ Sean Whitton June 29, 2024 https://wiki.debian.org/LTS Package : org-mode Version : org-mode 9.1.14+dfsg-3+deb10u3 CVE ID : CVE-2024-39331 Debian Bug : 1074136 A vulnerability was discovered in Org-mod...

CVE-2024-39209

The software luci-app-sms-tool version 1.9-6 is susceptible to a command injection vulnerability. The root cause is located in the score parameter, which allows for improper control of code generation (CWE-94). While no specific exploit links are provided, the impact is categorized as having tota...

BELL-CVE-2024-38585

Bulletin has no description...

BELL-CVE-2024-38582

Bulletin has no description...

CVE-2024-38538 net: bridge: xmit: make sure we have at least eth header len bytes

In the Linux kernel, the following vulnerability has been resolved: net: bridge: xmit: make sure we have at least eth header len bytes syzbot triggered an uninit value1 error in bridge device's xmit path by sending a short less than ETHHLEN bytes skb. To fix it check if we can actually pull that...