12981 matches found
CVE-2024-21527
Versions of the package github.com/gotenberg/gotenberg/v8/pkg/gotenberg before 8.1.0; versions of the package github.com/gotenberg/gotenberg/v8/pkg/modules/chromium before 8.1.0; versions of the package github.com/gotenberg/gotenberg/v8/pkg/modules/webhook before 8.1.0 are vulnerable to Server-si...
CVE-2024-21527
Versions of the package github.com/gotenberg/gotenberg/v8/pkg/gotenberg before 8.1.0; versions of the package github.com/gotenberg/gotenberg/v8/pkg/modules/chromium before 8.1.0; versions of the package github.com/gotenberg/gotenberg/v8/pkg/modules/webhook before 8.1.0 are vulnerable to Server-si...
PT-2024-37871 · Yith · Yith Essential Kit For Woocommerce
Name of the Vulnerable Software and Affected Versions: YITH Essential Kit for WooCommerce versions up to, and including, 2.34.0 Description: The issue allows authenticated attackers with Subscriber-level access and above to modify data without proper authorization. This is due to a missing...
PT-2024-5343 · D Link · D-Link Dir-823X Ax3000 Dual-Band Gigabit Wireless Router
Name of the Vulnerable Software and Affected Versions: D-Link DIR-823X AX3000 Dual-Band Gigabit Wireless Router version v21 D240126 Description: The issue is related to a remote code execution vulnerability in the ntp zone val parameter at the /goform/set ntp API endpoint. This vulnerability can ...
PT-2024-29460 · Spina Cms · Spina Cms
Name of the Vulnerable Software and Affected Versions: Spina CMS version 2.18.0 Description: A Cross-Site Request Forgery CSRF issue was found in Spina CMS. The issue is related to the API endpoint "/admin/layout". Recommendations: For Spina CMS version 2.18.0, as a temporary workaround, consider...
Sentry's Python SDK unintentionally exposes environment variables to subprocesses
Impact The bug in Sentry's Python SDK subprocess.checkoutput"env", env="TEST":"1" b'TEST=1\n' If you'd want to not pass any variables, you can set an empty dict: subprocess.checkoutput"env", env= b'' However, the bug in Sentry SDK 2.8.0 causes all environment variables to be passed to the...
Vulnerability fixed in SonicOS
A vulnerability has been fixed in SonicWall SonicOS IPSec. The vulnerability in SonicWall SonicOS IPSec allows an unauthenticated remote malicious person to cause Denial of Service DoS. SonicWall has made available a workaround and patch to fix the vulnerability. See the reference for more...
SUSE CVE-2024-39305
Envoy is a cloud-native, open source edge and service proxy. Prior to versions 1.30.4, 1.29.7, 1.28.5, and 1.27.7. Envoy references already freed memory when route hash policy is configured with cookie attributes. Note that this vulnerability has been fixed in the open as the effect would be...
PT-2024-5331 · Duckdb · Duckdb
Name of the Vulnerable Software and Affected Versions: DuckDB versions 1.0.0 and prior Description: The issue is related to the sniff csv function in DuckDB, which allows access to the filesystem even when enable external access is set to false. This provides an attacker with unauthorized access ...
PT-2024-5332 · Argo Cd · Argo Cd
Name of the Vulnerable Software and Affected Versions: Argo CD versions 2.6.0 through 2.11.6 Argo CD versions 2.7.0 through 2.10.15 Argo CD versions 2.8.0 through 2.9.20 Description: The issue is related to the Argo CD web terminal, which allows users to get a shell inside a running pod. When the...
GHSA-55RF-8Q29-4G43 Sylius has a security vulnerability via adjustments API endpoint
Impact A security vulnerability was discovered in the /api/v2/shop/adjustments/id endpoint, which retrieves order adjustments based on incremental integer IDs. The vulnerability allows an attacker to enumerate valid adjustment IDs and retrieve order tokens. Using these tokens, an attacker can...
Sylius has a security vulnerability via adjustments API endpoint
Impact A security vulnerability was discovered in the /api/v2/shop/adjustments/id endpoint, which retrieves order adjustments based on incremental integer IDs. The vulnerability allows an attacker to enumerate valid adjustment IDs and retrieve order tokens. Using these tokens, an attacker can...
PT-2024-21813 · Zohocorp · Manageengine Ddi Central
Name of the Vulnerable Software and Affected Versions: Zohocorp ManageEngine DDI Central versions 4001 and prior Description: The issue allows a user to upload new files to the server folder due to a directory traversal vulnerability. Recommendations: For versions 4001 and prior, consider...
Security advisory: Recently discovered HTTP2 handling issue impacts Qt
Whenever a TLS connection is started for a server that supports HTTP2 and has sent some data to the application then Qt will send data to the server even if the TLS certificate does not match the address it has been redirected too. This has been assigned the CVE id CVE-2024-39936. This is known t...
PYSEC-2024-66
dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. When a user installs a package in dbt, it has the ability to override macros, materializations, and other core components of dbt. This is by design, as it...
CVE-2022-48811 ibmvnic: don't release napi in __ibmvnic_open()
In the Linux kernel, the following vulnerability has been resolved: ibmvnic: don't release napi in ibmvnicopen If ibmvnicopen encounters an error such as when setting link state, it calls releaseresources which frees the napi structures needlessly. Instead, have ibmvnicopen only clean up the work...
CVE-2021-47623
In the Linux kernel, the following vulnerability has been resolved: powerpc/fixmap: Fix VM debug warning on unmap Unmapping a fixmap entry is done by calling setfixmap with FIXMAPPAGECLEAR as flags. Today, powerpc setfixmap calls mapkernelpage. mapkernelpage is not happy when called a second time...
PT-2024-25143 · Tenda · Tenda Ac18
Name of the Vulnerable Software and Affected Versions: Tenda AC18 version 15.03.3.10 EN Description: A stack-based buffer overflow issue was discovered via the deviceMac parameter at the "ip/goform/addWifiMacFilter" endpoint. This issue can be exploited, potentially leading to unintended...
PT-2024-28805 · Jfinalcms · Jfinalcms
Name of the Vulnerable Software and Affected Versions: JFinalCMS version 5.0.0 Description: A SQL injection issue was discovered via the "/admin/div data/data" API endpoint. This allows for potential exploitation. No information is provided about the estimated number of potentially affected devic...