PT-2024-34994 · Unknown · Agnel Waghela Shortcode Collection

Name of the Vulnerable Software and Affected Versions: Agnel Waghela Shortcode Collection versions 1.4 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows stored cross-site scripting XSS. This means that an attacker can inject...

PT-2024-34987 · Unknown · Umar Social Locker

Name of the Vulnerable Software and Affected Versions: Umar Social Locker versions n/a through 1.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as 'Cross-site Scripting', which allows Stored XSS. This means that an attacker can injec...

PT-2024-34312 · Unknown · World Prayer Time

Name of the Vulnerable Software and Affected Versions: World Prayer Time versions n/a through 2.0 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on the web...

PT-2024-34786 · Seo Free · Seo Free

Name of the Vulnerable Software and Affected Versions: Seo Free versions n/a through 1.4 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web application, and also stor...

SUSE-SU-2024:4006-1 Security update for SUSE Manager Server 4.3

This update fixes the following issues: cobbler: - Security issues fixed: CVE-2024-47533: Prevent privilege escalation from none to admin bsc1231332 - Other bugs fixed: Increase start timeout for cobblerd unit bsc1219450 Provide syncsinglesystem for DHCP modules to improve performance bsc1219450...

DEBIAN-CVE-2024-52317

Incorrect object re-cycling and re-use vulnerability in Apache Tomcat. Incorrect recycling of the request and response used by HTTP/2 requests could lead to request and/or response mix-up between users. This issue affects Apache Tomcat: from 11.0.0-M23 through 11.0.0-M26, from 10.1.27 through...

CVE-2024-52317 Apache Tomcat: Request/response mix-up with HTTP/2

Incorrect object re-cycling and re-use vulnerability in Apache Tomcat. Incorrect recycling of the request and response used by HTTP/2 requests could lead to request and/or response mix-up between users. This issue affects Apache Tomcat: from 11.0.0-M23 through 11.0.0-M26, from 10.1.27 through...

WordPress GoQSmile plugin <= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Mika Patchstack Alliance in WordPress Plugin GoQSmile versions = 1.0.1...

WordPress GoQMieruca plugin <= 1.0.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Mika Patchstack Alliance in WordPress Plugin GoQMieruca versions = 1.0.3...

WordPress QRMenu Restaurant QR Menu Lite plugin <= 1.0.4 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by LVT-tholv2k Patchstack Alliance in WordPress Plugin QRMenu Restaurant QR Menu Lite versions = 1.0.4...

WordPress Xpresslane Fast Checkout plugin <= 1.0.0 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by LVT-tholv2k Patchstack Alliance in WordPress Plugin Xpresslane Fast Checkout versions = 1.0.0...

Apache Tomcat HTTP/2 Vulnerability (Nov 2024) - Linux

Apache Tomcat is prone to vulnerability in HTTP/2. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:apache:tomcat"; if description...

PT-2024-35276 · Post Smtp · Post Smtp

Name of the Vulnerable Software and Affected Versions: Post SMTP versions n/a through 2.9.9 Description: The issue is related to an Improper Neutralization of Special Elements used in an SQL Command, also known as 'SQL Injection' vulnerability, which allows Blind SQL Injection. Recommendations: F...

CVE-2024-0793 Kube-controller-manager: malformed hpa v1 manifest causes crash

A flaw was found in kube-controller-manager. This issue occurs when the initial application of a HPA config YAML lacking a .spec.behavior.scaleUp block causes a denial of service due to KCM pods going into restart churn...

PT-2024-16897 · Altenergy · Altenergy Power Control

Name of the Vulnerable Software and Affected Versions: Altenergy Power Control Software versions up to 20241108 Description: A critical vulnerability has been found in the Altenergy Power Control Software, affecting the get status zigbee function of the file /index.php/display/status zigbee. The...

WordPress MooWoodle plugin <= 3.2.4 - Sensitive Data Exposure vulnerability

Sensitive Data Exposure vulnerability discovered by Joshua Chan in WordPress Plugin MooWoodle versions = 3.2.4...

PT-2024-16427 · WordPress · Blogger 301 Redirect

Name of the Vulnerable Software and Affected Versions: Blogger 301 Redirect plugin for WordPress versions up to, and including, 2.5.3 Description: The issue is a blind time-based SQL Injection vulnerability via the br parameter. This vulnerability is due to insufficient escaping on the...

WordPress Real 3D FlipBook plugin <= 4.8 - Authenticated (Author+) Arbitrary File Upload vulnerability

Authenticated Author+ Arbitrary File Upload vulnerability discovered by Aitor F kr0no in WordPress Plugin Real 3D FlipBook versions = 4.6...

WordPress Popup by Supsystic plugin <= 1.10.29 - Remote Code Execution (RCE) vulnerability

Remote Code Execution RCE vulnerability discovered by Hakiduck Patchstack Alliance in WordPress Plugin Popup by Supsystic versions = 1.10.29...

WordPress Blogger 301 Redirect plugin <= 2.5.3 - Unauthenticated SQL Injection vulnerability

Unauthenticated SQL Injection vulnerability discovered by kr0d in WordPress Plugin Blogger 301 Redirect versions = 2.5.3...