PT-2024-26524

Name of the Vulnerable Software and Affected Versions sqlitedict versions up to v2.1.0 Description The issue is related to insecure deserialization, which allows attackers to execute arbitrary code. Recommendations For versions up to v2.1.0, update to a version later than v2.1.0 to resolve the...

GHSA-3XQ2-W6J4-C99R Apache Seata Deserialization of Untrusted Data vulnerability

Deserialization of Untrusted Data vulnerability in Apache Seata. When developers disable authentication on the Seata-Server and do not use the Seata client SDK dependencies, they may construct uncontrolled serialized malicious requests by directly sending bytecode based on the Seata private...

CVE-2024-22399 Apache Seata: Remote Code Execution vulnerability via Hessian Deserialization in Apache Seata Server

Deserialization of Untrusted Data vulnerability in Apache Seata. When developers disable authentication on the Seata-Server and do not use the Seata client SDK dependencies, they may construct uncontrolled serialized malicious requests by directly sending bytecode based on the Seata private...

CVE-2024-22399 Apache Seata: Remote Code Execution vulnerability via Hessian Deserialization in Apache Seata Server

Deserialization of Untrusted Data vulnerability in Apache Seata. When developers disable authentication on the Seata-Server and do not use the Seata client SDK dependencies, they may construct uncontrolled serialized malicious requests by directly sending bytecode based on the Seata private...

CVE-2024-22399 Apache Seata: Remote Code Execution vulnerability via Hessian Deserialization in Apache Seata Server

Deserialization of Untrusted Data vulnerability in Apache Seata. When developers disable authentication on the Seata-Server and do not use the Seata client SDK dependencies, they may construct uncontrolled serialized malicious requests by directly sending bytecode based on the Seata private...

RHEA-2021:4051 Red Hat Enhancement Advisory: Red Hat OpenShift Service Mesh 2.1.0 RPMs

Bulletin has no description...

Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-20230302.2008)

The version of AHV installed on the remote host is prior to 20230302.102005. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AHV-20230302.2008 advisory. - A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBCTUNABL...

Use of Less Trusted Source

Overview Affected versions of this package are vulnerable to Use of Less Trusted Source via the handling of X-Forwarded-For or Client-Ip headers. An attacker can falsify their IP address in log files by specifying an arbitrary IP in these headers while making HTTP requests. Remediation Upgrade...

CVE-2024-45046 PhpSpreadsheet HTML writer is vulnerable to Cross-Site Scripting via style information

PHPSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In affected versions \PhpOffice\PhpSpreadsheet\Writer\Html doesn't sanitize spreadsheet styling information such as font names, allowing an attacker to inject arbitrary JavaScript on the page. As a result an attacker...

CVE-2024-45046

Technical details about CVE-2024-45046 are not publicly provided in the documents you shared. No explicit affected products/versions, impact, or remediation are stated here. Monitor for updates from the sources for concrete information.

PT-2024-31397 · Phpoffice · Phpspreadsheet

Name of the Vulnerable Software and Affected Versions: PHPSpreadsheet versions prior to 2.1.0 Description: The issue concerns the PhpOfficePhpSpreadsheetWriterHtml component, which fails to sanitize spreadsheet styling information, such as font names. This allows an attacker to inject arbitrary...

CVE-2024-7848

The User Private Files – WordPress File Sharing Plugin plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.1.0 via the 'dpkupvfupdatedoc' due to missing validation on the 'docid' user controlled key. This makes it possible for authenticat...

WordPress User Private Files plugin <= 2.1.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Private File Access vulnerability

Insecure Direct Object Reference to Authenticated Subscriber+ Private File Access vulnerability discovered by Peter Thaleikis in WordPress Plugin User Private Files versions = 2.1.0...

PT-2024-14475 · WordPress · Wpforms User Registration

Name of the Vulnerable Software and Affected Versions: WPForms User Registration versions n/a through 2.1.0 Description: The issue is related to Improper Privilege Management, allowing Privilege Escalation in WPForms User Registration. Recommendations: For versions n/a through 2.1.0, update to a...

WordPress plugin WPForms User Registration 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exist...

WordPress Donation Block for PayPal plugin <= 2.1.0 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by Bob Matyas in WordPress Plugin Donation Block For PayPal versions = 2.1.0...

CVE-2024-5765 WpStickyBar <= 2.1.0 - Unauthenticated SQLi

The WpStickyBar WordPress plugin through 2.1.0 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection...

PT-2024-28161 · Google · Events Calendar

Name of the Vulnerable Software and Affected Versions: Events Calendar for Google versions through 2.1.0 Description: The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as 'Path Traversal', which allows PHP Local File Inclusion. Recommendations: For...

WordPress Events Calendar for Google plugin <= 2.1.0 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro Soares de Alcântara - Kinorth Patchstack Alliance in WordPress Plugin Events Calendar for Google versions = 2.1.0...

CVE-2024-39897 Cache driver GetBlob() allows read access to any blob without access control check

zot is an OCI image registry. Prior to 2.1.0, the cache driver GetBlob allows read access to any blob without access control check. If a Zot accessControl policy allows users read access to some repositories but restricts read access to other repositories and dedupe is enabled it is enabled by...