PT-2024-36975

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.74 Description The issue is related to an invalid access to prog array in perf event detach bpf prog. A crash occurs when a tracepoint perf event with attr.inherit=1 is created, attached to a process, and a b...

PostgreSQL: Multiple Vulnerabilities

Background PostgreSQL is an open source object-relational database management system. Description Multiple vulnerabilities have been discovered in PostgreSQL. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details. Workaroun...

Spidermonkey: Multiple Vulnerabilities

Background SpiderMonkey is Mozilla’s JavaScript and WebAssembly Engine, used in Firefox, Servo and various other projects. It is written in C++, Rust and JavaScript. You can embed it into C++ and Rust projects, and it can be run as a stand-alone shell. Description Multiple vulnerabilities have be...

OpenJDK: Multiple Vulnerabilities

Background OpenJDK is an open source implementation of the Java programming language. Description Multiple vulnerabilities have been discovered in OpenJDK. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details. Workaround...

Mozilla Firefox: Multiple Vulnerabilities

Background Mozilla Firefox is a popular open-source web browser from the Mozilla project. Description Multiple vulnerabilities have been discovered in Mozilla Firefox. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details...

Mozilla Thunderbird: Multiple Vulnerabilities

Background Mozilla Thunderbird is a popular open-source email client from the Mozilla project. Description Multiple vulnerabilities have been discovered in Mozilla Thunderbird. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for...

Asterisk: Multiple Vulnerabilities

Background Asterisk is an open source telephony engine and toolkit. Description Multiple vulnerabilities have been discovered in Asterisk. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details. Workaround There is no known...

R: Arbitrary Code Execution

Background R is a language and environment for statistical computing and graphics. Description Deserialization of untrusted data can occur in the R statistical programming language, enabling a maliciously crafted RDS R Data Serialization formatted file or R package to run arbitrary code on an end...

Cacti: Multiple Vulnerabilities

Background Cacti is a web-based network graphing and reporting tool. Description Multiple vulnerabilities have been discovered in Cacti. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details. Workaround There is no known...

Image Preparation fails using MCS on GCP due to Google's deprecated images disk export workflow

Symptoms or Error Customers cannot create new catalogs or update the images of existing catalogs. Solution Citrix is currently working on a fix. Workaround: Customers can update the json files to use a newer image and script.Below is the step-by-step process. There are 2 options to update the...

PT-2024-36094

Name of the Vulnerable Software and Affected Versions: ARForms versions n/a through 6.4.1 Description: The issue is related to a Path Traversal vulnerability, specifically a '.../...//' vulnerability, which affects Repute InfoSystems ARForms. This allows for Path Traversal. Recommendations: For...

PT-2024-17422 · WordPress · Wp Media Optimizer (.Webp) Plugin

Name of the Vulnerable Software and Affected Versions: WP Media Optimizer .webp plugin for WordPress versions up to, and including, 1.4.0 Description: The issue is related to Reflected Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows unauthenticated...

PT-2024-17397 · WordPress · Wp System

Name of the Vulnerable Software and Affected Versions: WP System plugin for WordPress versions up to, and including, 1.1.1 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the generate wp system page content function. This allows...

PT-2024-28277 · Open Robotics · Ros2 +1

Name of the Vulnerable Software and Affected Versions: Open Robotics Robotic Operating System 2 ROS2 and Nav2 humble versions Description: A use-after-free vulnerability was discovered in the nav2 amcl process of Open Robotics Robotic Operating System 2 ROS2 and Nav2 humble versions. This issue i...

PT-2025-3061

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.74 Description A possible ABBA deadlock vulnerability has been identified in the Linux kernel, specifically in the netfilter IDLETIMER module. This issue occurs when the deletion of the last rule referencing ...

PT-2024-36092 · Revy · Revy

Name of the Vulnerable Software and Affected Versions: Revy versions 1.1 through 1.18 Description: The issue allows for the unrestricted upload of files with dangerous types, enabling an attacker to upload a web shell to a web server. This can lead to further exploitation and potential takeover o...

PT-2024-36082 · Unknown · Paloma Widget

Name of the Vulnerable Software and Affected Versions: Paloma Widget versions 1.14 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the Paloma Widget, allowing unauthorized requests. This can lead to malicious actions being performed on behalf of the user. Recommendations:...

PT-2024-36411 · Wavlink · Wavlink Wn531P3

Name of the Vulnerable Software and Affected Versions: WAVLINK WN531P3 version 202383 Description: A hardcoded password vulnerability was discovered in /etc/shadow, allowing attackers to log in as root. This issue enables unauthorized access to the system with elevated privileges. Recommendations...

path-to-regexp contains a ReDoS

Impact The regular expression that is vulnerable to backtracking can be generated in versions before 0.1.12 of path-to-regexp, originally reported in CVE-2024-45296 Patches Upgrade to 0.1.12. Workarounds Avoid using two parameters within a single path segment, when the separator is not . e.g. no...

PT-2024-27792 · Open Robotics · Ros2 +1

Name of the Vulnerable Software and Affected Versions: Open Robotics Robotic Operating System 2 ROS2 and Nav2 humble versions Description: The issue is a buffer overflow that occurs via the nav2 amcl process. This is triggered by sending a crafted .yaml file. Recommendations: For Open Robotics...