MAL-2024-1165 Malicious code in pt-api-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 78627b7277f79f6b0febc6c2efde348085a7bf7363ebc2986ac5d3e2ce2329d1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2024-19260 · Unknown · Openharmony

Name of the Vulnerable Software and Affected Versions: OpenHarmony versions prior to 4.0.0 OpenHarmony version 4.0.0 Description: The issue allows a local attacker to cause a denial of service DOS through a use after free exploit. Recommendations: For OpenHarmony versions prior to 4.0.0, update t...

pt.openfoodfacts.org Cross Site Scripting vulnerability OBB-3885069

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

PT-2024-2245 · Microsoft · Windows Kernel +1

Name of the Vulnerable Software and Affected Versions: Windows Kernel affected versions not specified Description: The issue is related to insufficient protection of internal data in the Windows operating system kernel. It allows attackers to obtain sensitive information and potentially affect th...

PT-2024-2718 · Doctor Web · Dr.Web Anti-Rootkit Api

Name of the Vulnerable Software and Affected Versions: Dr.Web Anti-rootkit API affected versions not specified Description: The issue is related to the use of a fixed or uncontrolled path for resource search in the Dr.Web Anti-rootkit API module. Exploitation of this issue may allow an attacker t...

CVE-2024-25987

In ptsysctlcommand of pt.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation...

PT-2024-21262 · Google · Android

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue is related to an incorrect bounds check in the pt sysctl command function of pt.c, which could lead to a possible out of bounds write. This...

PT-2024-40652 · Aom · Aom

Name of the Vulnerable Software and Affected Versions: aom affected versions not specified Description: The issue is related to a heap-use-after-free error, which occurs when the program attempts to access memory that has already been freed. This error is identified in the get ls tile buffers...

CVE-2023-52580 net/core: Fix ETH_P_1588 flow dissector

In the Linux kernel, the following vulnerability has been resolved: net/core: Fix ETHP1588 flow dissector When a PTP ethernet raw frame with a size of more than 256 bytes followed by a 0xff pattern is sent to skbflowdissect, nhoff value calculation is wrong. For example: hdr-messagelength takes t...

PT-2024-21338 · Aruba · Clearpass Policy Manager

Name of the Vulnerable Software and Affected Versions: ClearPass Policy Manager affected versions not specified Description: Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host. A successf...

PT-2024-40882 · Git +1 · Mruby

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a heap-buffer-overflow read crash. Technical details about the crash include the functions mrb memsearch, str convert range, and...

CVE-2024-24878

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Marco Almeida | Webdados Portugal CTT Tracking for WooCommerce portugal-ctt-tracking-woocommerce.This issue affects Portugal CTT Tracking for WooCommerce: from n/a through = 2.1...

Cross site scripting

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PT Woo Plugins by Webdados Portugal CTT Tracking for WooCommerce allows Reflected XSS.This issue affects Portugal CTT Tracking for WooCommerce: from n/a through 2.1...

CVE-2024-24878

CVE-2024-24878 affects the Portugal CTT Tracking for WooCommerce plugin (PT Woo Plugins by Webdados). The issue is a reflected cross-site scripting (XSS) vulnerability in the plugin, exploitable via an attacker-supplied input that is reflected in web pages. Affected versions are up to 2.1; a fix ...

CVE-2024-24848

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in MJS Software PT Sign Ups – Beautiful volunteer sign ups and management made easy allows Stored XSS.This issue affects PT Sign Ups – Beautiful volunteer sign ups and management made easy: from n/a...

Cross site scripting

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in MJS Software PT Sign Ups – Beautiful volunteer sign ups and management made easy allows Stored XSS.This issue affects PT Sign Ups – Beautiful volunteer sign ups and management made easy: from n/a...

CVE-2024-24848

PT Sign Ups – Beautiful volunteer sign ups and management made easy (WordPress plugin by MJS Software PT)

CVE-2024-24848 WordPress PT Sign Ups Plugin <= 1.0.4 is vulnerable to Cross Site Scripting (XSS)

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in MJS Software PT Sign Ups – Beautiful volunteer sign ups and management made easy allows Stored XSS.This issue affects PT Sign Ups – Beautiful volunteer sign ups and management made easy: from n/a...

CVE-2024-24848 WordPress PT Sign Ups Plugin <= 1.0.4 is vulnerable to Cross Site Scripting (XSS)

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in MJS Software PT Sign Ups – Beautiful volunteer sign ups and management made easy allows Stored XSS.This issue affects PT Sign Ups – Beautiful volunteer sign ups and management made easy: from n/a...

WordPress PT Sign Ups Plugin <= 1.0.4 is vulnerable to Cross Site Scripting (XSS)

Software PT Sign Ups Type Plugin Vulnerable versions = 1.0.4 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-24848 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID c0bd535867dc Credits Faizal Abroni Required privilege...