PT-2024-33344 · Keyfactor · Keyfactor Command

Name of the Vulnerable Software and Affected Versions: Keyfactor Command versions prior to 12.5.0 Description: The issue concerns incorrect access control where access tokens have more permissions than allowed. Recommendations: For versions prior to 12.5.0, update to one of the fixed versions:...

Remote File Orchestrator Extension Security Vulnerability

Remote File Orchestrator Extension is an open source remote file orchestrator extension for Keyfactor. It is used to remotely manage various file-based certificate stores and can be easily extended to manage other certificate stores. A security vulnerability exists in Remote File Orchestrator...

WordPress plugin WPLMS has a security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

PT-2024-35387

Name of the Vulnerable Software and Affected Versions Misskey versions prior to 2024.11.0-alpha.3 Description The issue concerns missing validation in ApRequestService.signedGet, allowing an attacker to create fake user profiles that appear to be from a different instance. These profiles can be...

CVE-2024-12741: Deserialization of Untrusted Data

A deserialization of untrusted data vulnerability exists in NI DAQExpress that may result in remote code execution. Successful exploitation requires an attacker to get a user to open a specially crafted project file. This vulnerability affects DAQExpress 5.1 and prior versions. Please note that...

CVE-2024-54125

Improper authorization in handler for custom URL scheme issue in "Shonen Jump+" App for Android versions prior to 4.0.0 allows an attacker to lead a user to access an arbitrary website via the vulnerable App. As a result, the user may become a victim of a phishing attack...

PT-2024-39346 · Unknown · Saha365 App

Name of the Vulnerable Software and Affected Versions: Saha365 App versions prior to 30.09.2024 Description: The issue is related to the improper neutralization of special elements used in an SQL command, allowing SQL injection. This problem affects the Saha365 App. Recommendations: For versions...

LDAP Account Manager security vulnerabilities

LDAP Account Manager LAM is a web front-end to the LDAP Account Manager open source for managing entries e.g. users, groups, DHCP settings stored in the LDAP directory. A security vulnerability exists in LDAP Account Manager versions prior to 9.0 that stems from incorrect input validation of...

PT-2024-39041 · Unknown · Wifiburada

Name of the Vulnerable Software and Affected Versions: WiFiBurada versions prior to 1.0.5 Description: The issue is related to an authentication bypass by assumed-immutable data, allowing the manipulation of user-controlled variables. This can potentially be exploited to gain unauthorized access...

WordPress plugin with a cross-site request forgeing vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site reques...

WordPress plugin AppMaps has a cross-site request forgeing vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request...

Lumos security vulnerabilities

Lumos is a tool by Andrew Nguonly personal developer. It is used for browsing web pages. A security vulnerability exists in Lumos versions prior to 1.0.17, which stems from the use of the markdown-to-jsx package without disableParsingRawHTML set to true, where ChatBar.tsx parses raw HTML from...

WordPress plugin Tickera – Vulnerability in WordPress Event Ticketing system

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. WordPress plugin Tickera -...

PT-2024-16428 · Fluent Forms · Contact Form Plugin By Fluent Forms

Name of the Vulnerable Software and Affected Versions: Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder versions prior to 5.2.6 Description: The issue is related to Stored Cross-Site Scripting via the form's subject parameter due to insufficient input...

PT-2024-9589

Name of the Vulnerable Software and Affected Versions Ucum-java versions prior to 1.0.9 Description The issue is related to XML external entity injections in the UcumEssenceService. This occurs when XML parsing is performed, allowing a malicious DTD tag in a processed XML file to produce XML...

PT-2024-36610 · Unknown · Graphics::Colornames

Name of the Vulnerable Software and Affected Versions: Graphics::ColorNames versions prior to 3.2.0 Description: The issue is related to an ambiguity between modules and filenames in the Graphics::ColorNames package for Perl, which can lead to HTML injection by an attacker who can create a file i...

PT-2024-13004 · Miniorange · Miniorange Saml Sp Single Sign On

Name of the Vulnerable Software and Affected Versions: miniOrange SAML SP Single Sign On versions prior to 5.0.4 Description: The issue affects the miniOrange SAML SP Single Sign On plugin, allowing for broken access control due to missing authorization. This enables exploitation of incorrectly...

WordPress plugin ReDi Restaurant Reservation has a security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2024-36603 · Phpmyfaq · Phpmyfaq

Name of the Vulnerable Software and Affected Versions: phpMyFAQ versions prior to 3.2.10 Description: A vulnerability exists in the FAQ Record component where a privileged attacker can trigger a file download on a victim's machine upon page visit by embedding it in an iframe element without user...

PT-2024-36146 · Unknown · Imagerecycle Pdf & Image Compression

Name of the Vulnerable Software and Affected Versions: ImageRecycle pdf & image compression versions prior to 3.1.17 Description: The issue is related to improper neutralization of input during web page generation, which allows reflected Cross-site Scripting XSS. This problem affects the...