PT-2024-4355 · NetGear · Netgear Wnr614 N300

Name of the Vulnerable Software and Affected Versions: Netgear WNR614 N300 version JNR1010V2/N300-V1.1.0.54 1.0.1 Description: The issue is related to the implementation of the WPS in the Netgear WNR614 N300 router, which allows attackers to gain access to the router's pin. This can enable a remo...

WordPress Restrict for Elementor plugin <= 1.0.7 - Protection Mechanism Bypass vulnerability

Protection Mechanism Bypass vulnerability discovered by Francesco Carlucci in WordPress Plugin Restrict for Elementor versions = 1.0.7...

CVE-2024-0910

The Restrict for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.6 due to improper restrictions on hidden data that make it accessible through the REST API. This makes it possible for unauthenticated attackers to extract...

CVE-2024-0910

The Restrict for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.7 due to improper restrictions on hidden data that make it accessible through the REST API. This makes it possible for unauthenticated attackers to extract...

CVE-2024-0910

CVE-2024-0910 concerns the WordPress plugin Restrict for Elementor, affecting all versions up to 1.0.6. Root cause: improper restrictions on hidden data exposed via the REST API, enabling unauthenticated attackers to extract potentially sensitive information from post content. Documented impact i...

PT-2024-28840 · WordPress · Post Blocks +5

Name of the Vulnerable Software and Affected Versions: Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks plugin for WordPress versions up to, and including, 2.2.80 Description: The issue is related to Stored Cross-Site Scripting via the class...

PT-2024-27935

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.8 Description The Linux kernel has a vulnerability that can cause rare kernel crashes due to bad page status error messages. This issue is caused by a race condition between thread A allocating an extent buffer...

WordPress plugin Restrict for Elementor security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. A security vulnerability...

PT-2024-34593 · Lunary Ai · Lunary

Name of the Vulnerable Software and Affected Versions: lunary-ai/lunary versions up to and including 1.2.2 Description: An Improper Access Control issue exists, allowing unauthorized users to view any prompts in any projects by supplying a specific prompt ID to an endpoint that does not adequatel...

CVE-2024-0910: Exposure of Sensitive Information to an Unauthorized Actor

The Restrict for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.0.7 due to improper restrictions on hidden data that make it accessible through the REST API. This makes it possible for unauthenticated attackers to extract...

PT-2024-27110 · Idccms · Idccms

Name of the Vulnerable Software and Affected Versions: idccms version 1.35 Description: The issue is a Cross-Site Request Forgery CSRF that affects the component "/admin/idcProType deal.php?mudi=add&nohrefStr=close". This allows for unauthorized requests to be made on behalf of the user...

PT-2024-29756 · WordPress · Themesflat Addons For Elementor

Name of the Vulnerable Software and Affected Versions: Themesflat Addons For Elementor plugin for WordPress versions up to, and including, 2.1.1 Description: The issue is related to Stored Cross-Site Scripting in the Themesflat Addons For Elementor plugin for WordPress. This is due to insufficien...

PT-2024-6302 · Ivanti · Ivanti Epm

Name of the Vulnerable Software and Affected Versions: Ivanti EPM versions prior to 2022 SU6 Ivanti EPM versions prior to the 2024 September update Description: The issue is related to an unspecified SQL injection in Ivanti EPM, which allows a remote authenticated attacker with admin privileges t...

PT-2024-27437 · Jan · Jan

Name of the Vulnerable Software and Affected Versions: Jan version 0.4.12 Description: The issue allows attackers to execute arbitrary code via uploading a crafted file to the "/v1/app/appendFileSync" interface. Recommendations: For Jan version 0.4.12, as a temporary workaround, consider disablin...

PT-2024-36392 · Synology · Synology Camera Firmware

Name of the Vulnerable Software and Affected Versions: Synology Camera Firmware versions prior to 1.1.1-0383 Description: A buffer copy issue without input size checking, known as a 'Classic Buffer Overflow', has been found in the login component. This allows remote attackers to conduct...

PT-2024-19670 · Fortinet · Fortiweb

Name of the Vulnerable Software and Affected Versions: FortiWeb versions 6.3 and all versions prior to 7.0.8 FortiWeb versions 7.2.4 and below FortiWeb version 7.4.0 Description: The issue allows an authenticated attacker to read password hashes of other administrators via CLI commands. This is d...

PT-2024-25669 · Dolibarr · Dolibarr

Name of the Vulnerable Software and Affected Versions: Dolibarr versions prior to 19.0.2 Description: A Reflected Cross-site scripting XSS vulnerability is located in htdocs/compta/paiement/card.php, allowing remote attackers to inject arbitrary web script or HTML via a crafted payload injected...

PT-2024-24277 · Ibm · Ibm Planning Analytics

Name of the Vulnerable Software and Affected Versions: IBM Planning Analytics Local versions 2.0 through 2.1 Description: The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted...

PT-2024-11532 · Waneditor · Waneditor

Name of the Vulnerable Software and Affected Versions: wanEditor version 4.7.11 Description: The issue is related to a cross-site scripting XSS vulnerability. This vulnerability was discovered in the video upload function, allowing potential exploitation. Recommendations: For wanEditor version...

PT-2024-26450 · Unknown · Diño Physics School Assistant

Name of the Vulnerable Software and Affected Versions: Diño Physics School Assistant version 2.3 Description: A vulnerability has been discovered that impacts unidentified code within the file /classes/SystemSettings.php?f=update settings. Manipulating the name parameter results in cross-site...