SUSE CVE-2024-53264

bunkerweb is an Open-source and next-generation Web Application Firewall WAF. A open redirect vulnerability exists in the loading endpoint, allowing attackers to redirect authenticated users to arbitrary external URLs via the "next" parameter. The loading endpoint accepts and uses an unvalidated...

EulerOS 2.0 SP12 : docker-runc (EulerOS-SA-2024-2934)

According to the versions of the docker-runc package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : runc is a CLI tool for spawning and running containers according to the OCI specification. runc 1.1.13 and earlier, as well as 1.2.0-rc2 and...

GHSA-C7XH-GJV4-4JGV kcp's impersonation allows access to global administrative groups

Impact Impersonation is a feature of the Kubernetes API, allowing to override user information. As downstream project, kcp inherits this feature. As per the linked documentation a specific level of privilege usually assigned to cluster admins is required for impersonation. The vulnerability in kc...

Chromium: Monthly Vulnerability Updates

Palo Alto Networks incorporated the following Chromium security fixes into our products: https://chromereleases.googleblog.com/2024/11/stable-channel-update-for-desktop19.html https://chromereleases.googleblog.com/2024/12/stable-channel-update-for-desktop.html Work around: No work around availabl...

libvirt: Multiple Vulnerabilities

Background libvirt is a C toolkit for manipulating virtual machines. Description Multiple vulnerabilities have been discovered in libvirt. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details. Workaround There is no known...

PT-2024-36562

Name of the Vulnerable Software and Affected Versions python-libarchive versions 4.2.1 and earlier Description The issue allows directory traversal, enabling the creation of files in extract in zip.py for ZipFile.extractall and ZipFile.extract functions. This can be exploited to create files...

OpenSC: Multiple Vulnerabilities

Background OpenSC contains tools and libraries for smart cards. Description Multiple vulnerabilities have been discovered in OpenSC. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details. Workaround There is no known...

Angular Expressions - Remote Code Execution when using locals

Impact An attacker can write a malicious expression that escapes the sandbox to execute arbitrary code on the system. Example of vulnerable code: js const expressions = require"angular-expressions"; const result = expressions.compile"proto.constructor", ; // result should be undefined, however fo...

GHSA-5462-4VCX-JH7J Angular Expressions - Remote Code Execution when using locals

Impact An attacker can write a malicious expression that escapes the sandbox to execute arbitrary code on the system. Example of vulnerable code: js const expressions = require"angular-expressions"; const result = expressions.compile"proto.constructor", ; // result should be undefined, however fo...

CVE-2024-54152

Angular Expressions provides expressions for the Angular.JS web framework as a standalone module. Prior to version 1.4.3, an attacker can write a malicious expression that escapes the sandbox to execute arbitrary code on the system. With a more complex undisclosed payload, one can get full access...

CVE-2024-54152 Angular Expressions - Remote Code Execution when using locals

Angular Expressions provides expressions for the Angular.JS web framework as a standalone module. Prior to version 1.4.3, an attacker can write a malicious expression that escapes the sandbox to execute arbitrary code on the system. With a more complex undisclosed payload, one can get full access...

PT-2024-9873 · Adobe · Indesign Desktop

Name of the Vulnerable Software and Affected Versions: InDesign Desktop versions ID19.5, ID18.5.4 and earlier Description: The issue is related to a NULL Pointer Dereference that could result in an application denial-of-service. An attacker could exploit this to crash the application, leading to ...

PT-2024-9627 · Adobe · Experience Manager

Name of the Vulnerable Software and Affected Versions: Adobe Experience Manager versions 6.5.21 and earlier Description: The issue is related to a DOM-based Cross-Site Scripting XSS vulnerability. This vulnerability could be exploited by an attacker to execute arbitrary code in the context of the...

PT-2024-34456 · Silicon · Z-Wave Series 700 +1

Name of the Vulnerable Software and Affected Versions: Silicon Labs SiLabs Z-Wave Series 700 and 800 version 7.21.1 Description: The issue is related to insecure permissions in the Silicon Labs SiLabs Z-Wave Series 700 and 800, which allows attackers to cause a Denial of Service DoS by repeatedly...

PT-2024-9949 · Adobe · Substance3D - Modeler

Name of the Vulnerable Software and Affected Versions: Substance3D - Modeler versions 1.14.1 and earlier Description: The issue is related to a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue...

DEBIAN-CVE-2024-55601

Hugo is a static site generator. Starting in version 0.123.0 and prior to version 0.139.4, some HTML attributes in Markdown in the internal templates listed below not escaped in internal render hooks. Those whoa re impacted are Hugo users who do not trust their Markdown content files and are usin...

CVE-2024-55601 Hugo does not escape some attributes in internal templates

Hugo is a static site generator. Starting in version 0.123.0 and prior to version 0.139.4, some HTML attributes in Markdown in the internal templates listed below not escaped in internal render hooks. Those whoa re impacted are Hugo users who do not trust their Markdown content files and are usin...

PT-2024-12236 · Sparkle Themes · Sparkle Themes Blogger Buzz

Name of the Vulnerable Software and Affected Versions: Sparkle Themes Blogger Buzz versions 1.2.2 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: For Sparkle...

PT-2024-9970

Name of the Vulnerable Software and Affected Versions: Apache Superset versions 2.0.0 through 4.1.0 Description: The issue is related to an improper authorization procedure in the FAB ADD SECURITY API component of Apache Superset, allowing lower privilege users to use this API. This can potential...

PT-2024-12311 · Realwebcare · Realwebcare Wrc Pricing Tables

Name of the Vulnerable Software and Affected Versions: Realwebcare WRC Pricing Tables versions 2.3.7 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: For versions...