PT-2024-9170 · Jetbrains · Jetbrains Youtrack

Name of the Vulnerable Software and Affected Versions: JetBrains YouTrack versions prior to 2024.3.52635 Description: The issue is related to an uncontrolled modification of object prototype attributes in the data merge functions of JetBrains YouTrack. This can allow a remote attacker to implemen...

PT-2024-27100 · Zulip · Zulip

Name of the Vulnerable Software and Affected Versions: Zulip version 8.3 Description: The issue is related to Cross Site Scripting XSS via the construct copy div function in copy and paste.js. This allows for potential malicious script execution. Recommendations: For Zulip version 8.3, consider...

CVE-2024-52338 Apache Arrow R package: Arbitrary code execution when loading a malicious data file

Deserialization of untrusted data in IPC and Parquet readers in the Apache Arrow R package versions 4.0.0 through 16.1.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parquet data from untrusted sources for example, user-supplied input files. This...

PT-2024-17009 · WordPress · Faq Builder Ays Plugin

Name of the Vulnerable Software and Affected Versions: FAQ Builder AYS plugin for WordPress versions up to and including 1.7.1 Description: The FAQ Builder AYS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ays faq tab parameter due to insufficient input sanitization...

PT-2024-16745 · Tumult · Tumult Hype Animations

Name of the Vulnerable Software and Affected Versions: Tumult Hype Animations plugin for WordPress versions up to, and including, 1.9.15 Description: The Tumult Hype Animations plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the hypeanimations...

PT-2024-17372 · Unknown · Netcloud Exchange Client For Windows

Name of the Vulnerable Software and Affected Versions: NetCloud Exchange client for Windows version 1.110.50 Description: The NetCloud Exchange client for Windows contains an insecure file and folder permissions vulnerability. A normal user could exploit the weakness in file and folder permission...

PT-2024-40550 · Mozilla · Seamonkey

Name of the Vulnerable Software and Affected Versions: SeaMonkey versions prior to 2.53.19 Description: The issue is related to a security vulnerability in SeaMonkey. The estimated number of potentially affected devices is not provided. There is no information about real-world incidents where thi...

CVE-2024-41125 Out-of-bounds read in SNMP when decoding a string in Contiki-NG

Contiki-NG is an open-source, cross-platform operating system for IoT devices. An out-of-bounds read of 1 byte can be triggered when sending a packet to a device running the Contiki-NG operating system with SNMP enabled. The SNMP module is disabled in the default Contiki-NG configuration. The...

CVE-2024-41125 Out-of-bounds read in SNMP when decoding a string in Contiki-NG

Contiki-NG is an open-source, cross-platform operating system for IoT devices. An out-of-bounds read of 1 byte can be triggered when sending a packet to a device running the Contiki-NG operating system with SNMP enabled. The SNMP module is disabled in the default Contiki-NG configuration. The...

CVE-2024-41126 Out-of-bounds read when decoding SNMP messages in Contiki-NG

Contiki-NG is an open-source, cross-platform operating system for IoT devices. An out-of-bounds read of 1 byte can be triggered when sending a packet to a device running the Contiki-NG operating system with SNMP enabled. The SNMP module is disabled in the default Contiki-NG configuration. The...

CVE-2024-41126 Out-of-bounds read when decoding SNMP messages in Contiki-NG

Contiki-NG is an open-source, cross-platform operating system for IoT devices. An out-of-bounds read of 1 byte can be triggered when sending a packet to a device running the Contiki-NG operating system with SNMP enabled. The SNMP module is disabled in the default Contiki-NG configuration. The...

PT-2024-16698 · WordPress · Internal Linking For Seo Traffic & Ranking – Auto Internal Links

Name of the Vulnerable Software and Affected Versions: Internal Linking for SEO traffic & Ranking – Auto internal links plugin for WordPress versions up to 1.2.1 Description: The issue is related to a time-based SQL Injection vulnerability via the post id parameter. This vulnerability is caused b...

PT-2024-29280 · Unknown · Contiki-Ng

Name of the Vulnerable Software and Affected Versions: Contiki-NG affected versions not specified Description: An out-of-bounds read of 1 byte can be triggered when sending a packet to a device running the Contiki-NG operating system with SNMP enabled. The issue exists in the...

PT-2024-9657 · Adobe · Connect

Name of the Vulnerable Software and Affected Versions: Adobe Connect versions 11.4.7 and earlier Adobe Connect version 12.6 Description: The issue is related to insufficient protection of the web page structure, allowing for a reflected Cross-Site Scripting XSS vulnerability. If an attacker...

PT-2024-9655 · Adobe · Connect

Name of the Vulnerable Software and Affected Versions: Adobe Connect versions 11.4.7 and earlier Adobe Connect version 12.6 Description: The issue is related to insufficient protection of the web page structure, allowing a remote attacker to execute arbitrary code. This is a reflected Cross-Site...

CVE-2024-43784

lakeFS is an open-source tool that transforms object storage into a Git-like repository. Existing lakeFS users who have issued credentials to users who have been deleted are affected by this vulnerability. When creating a new user with the same username as a deleted user, that user will inherit a...

CVE-2024-43784

CVE-2024-43784 affects lakeFS: when creating a new user with a username that previously belonged to a deleted user, the new user inherits all of the deleted user’s credentials. This is fixed in lakeFS release v1.33.0 and later. Affected users should upgrade to ≥1.33.0; if upgrading is not possibl...

GHSA-W5RQ-G9R6-VRCG @dapperduckling/keycloak-connector-server has Reflected XSS Vulnerability in Authentication Flow URL Handling

Impact A Reflected Cross-Site Scripting XSS vulnerability was discovered in the authentication flow of the application. This issue arises due to improper sanitization of the URL parameters, allowing the URL bar's contents to be injected and reflected into the HTML page. An attacker could craft a...

sigstore-java has vulnerability with bundle verification

Summary sigstore-java has insufficient verification for a situation where a validly-signed but "mismatched" bundle is presented as proof of inclusion into a transparency log Impact This bug impacts clients using any variation of KeylessVerifier.verify The verifier may accept a bundle with an...

PT-2024-9130 · Fuji Electric · V-Simulator 5

Name of the Vulnerable Software and Affected Versions: Fuji Electric Tellus Lite V-Simulator 5 version V8 Description: The issue is a stack-based buffer overflow vulnerability in the V-Simulator 5 component, specifically in the parsing of V8 files. This vulnerability allows remote attackers to...