PT-2024-26994 · Targit · Targit Decision Suite

Name of the Vulnerable Software and Affected Versions: TARGIT Decision Suite versions prior to 24.06.19002 Description: The issue allows authenticated attackers to read or write to server files via a crafted file request, potentially enabling code execution via a .xview file. Recommendations: For...

PT-2024-3966 · Jetbrains · Teamcity

Name of the Vulnerable Software and Affected Versions: JetBrains TeamCity versions prior to 2024.03.2 Description: The issue is related to insufficient authorization procedures in the continuous integration and continuous delivery CI/CD system, allowing users to perform actions that should not be...

WordPress FooBox plugin < 2.7.28 - Authenticated Stored Cross-Site Scripting vulnerability

Authenticated Stored Cross-Site Scripting vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin FooBox Image Lightbox versions 2.7.28...

ZKsync Era 安全漏洞

ZKsync Era is an open source compiler from Matter Labs. A security vulnerability exists in ZKsync Era versions prior to 1.3.10, which stems from checkifaexeculatedlast exposing a bug in the order in which Yul function arguments are evaluated...

Foxit PDF Editor < 13.1.2 Vulnerability

According to its version, the Foxit PDF Editor application previously named Foxit PhantomPDF installed on the remote Windows host is prior to 13.1.2. It is, therefore affected by vulnerability: - A privilege escalation vulnerability exists in the Foxit Reader 2024.2.0.25138. The vulnerability...

MongoDB 5.0.x < 5.0.25 / 6.0.x < 6.0.14 / 7.0.x < 7.0.6 Improper Input Validation (SERVER-85263)

The version of MongoDB installed on the remote host is prior to 5.0.25, 6.0.14, or 7.0.6. It is, therefore, affected by a vulnerability as referenced in the SERVER-85263 advisory. - Improper validation of certain metadata input may result in the server not correctly serialising BSON. This can be...

PT-2024-26388

Name of the Vulnerable Software and Affected Versions OpenProject versions prior to 13.4.2 OpenProject versions prior to 14.0.2 OpenProject versions prior to 14.1.0 Description The issue concerns OpenProject, a leading open source project management software, which utilizes tablesorter inside of...

PT-2024-4243 · Google +6 · Google Chrome +7

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 126.0.6478.54 Microsoft Edge versions affected versions not specified Description: The issue is related to a type confusion in the V8 JavaScript engine, allowing a remote attacker to potentially perform out of...

CVE-2024-4563

The Progress MOVEit Automation configuration export function prior to 2024.0.0 uses a cryptographic method with insufficient bit length...

PT-2024-24157 · Unknown · Openlitespeed

Name of the Vulnerable Software and Affected Versions: OpenLiteSpeed versions prior to 1.8.1 Description: The issue is related to the mishandling of chunked encoding. Recommendations: For versions prior to 1.8.1, update to version 1.8.1 or later to resolve the issue...

xmedcon 安全漏洞

xmedcon is an open source toolkit for medical image conversion from xmedcon open source. A security vulnerability exists in versions prior to xmedcon v.0.24.0, which stems from vulnerability to buffer overflows that could allow an attacker to execute arbitrary code...

GHSA-6WQP-7G94-F69J sensiolabs/connect has a Cross-Site Request Forgery Vulnerability

Versions of sensiolabs/connect prior to 4.2.3 are affected by a Cross-Site Request Forgery CSRF vulnerability due to the absence of the state parameter in OAuth requests. The lack of proper state parameter handling exposes applications to CSRF attacks during the OAuth authentication flow...

PT-2024-25435 · WordPress · All In One Seo

Name of the Vulnerable Software and Affected Versions: All in One SEO WordPress plugin versions prior to 4.6.1.1 Description: The issue allows users with the contributor role and above to perform Stored Cross-Site Scripting attacks due to the plugin not validating and escaping some of its Post...

Aqua Security Trivy 安全漏洞

Aqua Security Trivy is a comprehensive and versatile security scanner from Aqua Security. A security vulnerability exists in Aqua Security Trivy versions prior to 0.51.2, which stems from a potential leak of registry credentials when scanning images from a malicious registry...

Accellion Kiteworks 安全漏洞

Accellion Kiteworks is a private cloud file sharing solution. A security vulnerability exists in Accellion Kiteworks version 7.x and version 8.x prior to 8.3.0, which stems from the presence of directory traversal that can lead to unauthenticated file read, file delete, and file write operations...

SUSE CVE-2024-4948

Use after free in Dawn in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

PT-2024-23984 · Cozmoslabs · Cozmoslabs Profile Builder

Name of the Vulnerable Software and Affected Versions: Cozmoslabs Profile Builder versions prior to 3.11.2 Description: The issue is related to Insufficient Verification of Data Authenticity, allowing Functionality Bypass in Cozmoslabs Profile Builder. Recommendations: For versions prior to 3.11....

WordPress plugin Shortcodes and extra features for Phlox theme 路径遍历漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. WordPress plugin Shortcodes and extra...

WordPress plugin WordPress Manutenção 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. A security vulnerability...

PT-2024-23470 · Unknown · Guido Vs Contact Form

Name of the Vulnerable Software and Affected Versions: Guido VS Contact Form versions prior to 14.7 Description: A Guessable CAPTCHA vulnerability in Guido VS Contact Form allows functionality bypass. Recommendations: For Guido VS Contact Form versions prior to 14.7, update to a version that...