JVN#61054671: Phormer vulnerable to cross-site scripting

Phormer contains a cross-site scripting vulnerability CWE-79. Impact An arbitrary script may be executed on the web browser of the user. Solution Update the Software Update the software to the latest version according to the information provided by the developer. Phormer version 3.35 was released...

SUSE-SU-2024:1574-1 Security update for go1.21

This update for go1.21 fixes the following issues: Update to go1.21.10: - CVE-2024-24787: cmd/go: arbitrary code execution during build on darwin bsc1224017 - net/http: TestRequestLimit/h2 becomes significantly more expensive and slower after x/[email protected]...

PT-2024-26774 · WordPress · The Letterpress

Name of the Vulnerable Software and Affected Versions: The LetterPress WordPress plugin versions 1.2.2 and earlier Description: The issue is related to the lack of CSRF checks in some areas, allowing attackers to perform unwanted actions on logged-in users via CSRF attacks, such as deleting...

CVE-2024-29207

CVE-2024-29207 describes an improper certificate validation in Ubiquiti UniFi Connect ecosystem. Affected products and versions: UniFi Connect Application <= v3.7.9, UniFi Connect EV Station <= v1.1.18, UniFi Connect EV Station Pro <= v1.1.18, UniFi Connect Display <= v1.9.324, UniFi ...

Pterodactyl Wings vulnerable to Server-Side Request Forgery during remote file pull

Impact An authenticated user who has access to a game server is able to bypass the previously implemented access control https://github.com/pterodactyl/wings/security/advisories/GHSA-6rg3-8h8x-5xfv that prevents accessing internal endpoints of the node hosting Wings in the pull endpoint. This wou...

PT-2024-25547 · Unknown · Exclusive Addons For Elementor

Name of the Vulnerable Software and Affected Versions: Exclusive Addons Elementor versions through 2.6.9.1 Description: The issue is related to a Missing Authorization vulnerability in Exclusive Addons Elementor. Recommendations: For versions through 2.6.9.1, update to a version later than 2.6.9....

HP Application Enabling Software Driver - Privileged File Overwrite

A potential security vulnerability has been identified in the HP Application Enabling Software Driver for certain HP PC products, which might allow escalation of privilege. HP is releasing software updates to mitigate this potential vulnerability. Mitigation is available in HP Application Enablin...

PT-2024-29140 · WordPress · Slider Revolution

Name of the Vulnerable Software and Affected Versions: Slider Revolution plugin for WordPress versions up to, and including, 6.7.7 Description: The issue allows for Stored Cross-Site Scripting via the htmltag parameter due to insufficient input sanitization and output escaping. This enables...

Pet Manager <= 1.4 - Reflected XSS

Description The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin PoC 1. Add a pet and publish the listing 2. View the pet on the frontend of the site...

PT-2024-26157 · WordPress · Sticky Buttons

Name of the Vulnerable Software and Affected Versions: The Sticky Buttons WordPress plugin versions prior to 3.2.4 Description: The issue is related to the lack of CSRF checks in some bulk actions, which could allow attackers to make logged-in admins perform unwanted actions, such as deleting...

Security Bulletin: NVIDIA Triton Inference Server - April 2024

NVIDIA has released a software update for NVIDIA Triton Inference Server to address the issue disclosed in this bulletin. To protect your system, install the latest release from the Triton Inference Server Releases page on GitHub, and view the Secure Deployment Considerations Guide. Go to NVIDIA...

PT-2025-3930

Name of the Vulnerable Software and Affected Versions Sparkle versions prior to 2.6.4 Description A security issue was found in Sparkle, where an attacker can replace an existing signed update with another payload, bypassing Sparkle’s EdDSA signing checks. This allows the attacker to potentially...

BMC software fails to validate IPMI session.

Overview The Intelligent Platform Management Interface IPMI implementations in multiple manufacturer's Baseboard Management Controller BMC software are vulnerable to IPMI session hijacking. An attacker with access to the BMC network with IPMI enabled can abuse the lack of session integrity to...

PT-2024-25403 · Unknown · Ekojr Advanced Post List

Name of the Vulnerable Software and Affected Versions: EkoJR Advanced Post List versions 0.5.6.1 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker c...

SUSE-SU-2024:1439-1 Security update for python-idna

This update for python-idna fixes the following issues: - CVE-2024-3651: Fixed potential DoS via resource consumption via specially crafted inputs to idna.encode bsc1222842...

PT-2024-22695 · WordPress · Agca Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: AGCA WordPress plugin versions prior to 7.2.2 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This is possible because some settings are not properly sanitised and escaped, a...

PT-2024-4545 · 8Theme · 8Theme Xstore

Name of the Vulnerable Software and Affected Versions: 8theme XStore versions n/a through 9.3.5 Description: The issue is related to improper neutralization of special elements used in an SQL command, which allows SQL injection. This can enable a remote attacker to execute arbitrary SQL queries t...

Cisco Adaptive Security Appliance and Firepower Threat Defense Software Command Injection Vulnerability

A vulnerability in the Cisco Adaptive Security Appliance ASA restore functionality that is available in Cisco ASA Software and Cisco Firepower Threat Defense FTD Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system with root-level...

PT-2025-31939 · Thinkphp · Thinkphp

Name of the Vulnerable Software and Affected Versions: thinkphp version 5.1 Description: An issue in thinkphp version 5.1 allows a remote attacker to execute arbitrary code via the routecheck function. This flaw enables remote, unauthenticated users to include files and run code. Recommendations:...

PT-2024-18268 · WordPress · Woocommerce Customers Manager

Name of the Vulnerable Software and Affected Versions: WooCommerce Customers Manager WordPress plugin versions prior to 29.8 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because the plugin does not properly sanitise and escape various parameters before...