PT-2024-28921

Name of the Vulnerable Software and Affected Versions M-Files Server versions prior to 24.4.13592.4 M-Files Server versions after 23.11 excluding 24.2 LTS Description A denial of service condition in M-Files Server allows an unauthenticated user to consume computing resources. Recommendations For...

PT-2024-24897 · Unknown · Implecode Reviews Plus

Name of the Vulnerable Software and Affected Versions: impleCode Reviews Plus versions 1.3.4 and earlier Description: A Missing Authorization vulnerability has been identified in impleCode Reviews Plus. This issue allows unauthorized access, potentially leading to data breaches or other security...

PT-2024-5144 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 12.5 through 16.9.5 GitLab CE/EE versions 16.10 through 16.10.3 GitLab CE/EE versions 16.11 through 16.11.0 Description: An issue has been discovered in GitLab CE/EE where a crafted wildcard filter in FileFinder may lead...

PT-2024-15253 · WordPress · Import Wp

Name of the Vulnerable Software and Affected Versions: Import WP WordPress plugin versions prior to 2.13.1 Description: The issue allows users with the administrator role to conduct SSRF attacks, which may be a problem in multisite configurations. This is due to the lack of prevention of pinging ...

PT-2024-23876 · WordPress · Webtoffee Wordpress Comments Import & Export

Name of the Vulnerable Software and Affected Versions: WebToffee WordPress Comments Import & Export versions 2.3.5 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended action...

PT-2024-21279 · Unknown · Ninja Forms

Name of the Vulnerable Software and Affected Versions: Ninja Forms versions prior to 3.8.1 Description: The issue is related to a cross-site scripting vulnerability in submit processing. If exploited, an arbitrary script may be executed on the web browser of the user accessing the website using t...

PT-2024-4788 · Juniper Networks · Junos Evolved

Name of the Vulnerable Software and Affected Versions: Junos OS Evolved versions prior to 21.4R3-S4-EVO Junos OS Evolved versions 22.1-EVO prior to 22.1R3-S3-EVO Junos OS Evolved versions 22.2-EVO prior to 22.2R3-S2-EVO Junos OS Evolved versions 22.3-EVO prior to 22.3R2-S1-EVO, 22.3R3-EVO...

PT-2024-3562 · Fortinet · Fortios

Name of the Vulnerable Software and Affected Versions: FortiOS versions 7.4.1 and below FortiOS versions 7.2.7 and below FortiOS versions 7.0.14 and below FortiOS versions 6.4.15 and below Description: A use of externally-controlled format string vulnerability in FortiOS command line interface ma...

PT-2024-2954 · Node.Js +3 · Undici +3

Name of the Vulnerable Software and Affected Versions: Undici versions prior to 5.28.4 Undici versions prior to 6.11.1 Description: The issue is related to the Undici HTTP/1.1 client for Node.js, which has a flaw in its authorization procedure. Specifically, Undici clears Authorization and...

PT-2024-19256 · Unknown · Openharmony

Name of the Vulnerable Software and Affected Versions: OpenHarmony versions prior to 3.2.4 Description: The issue allows a local attacker to cause apps to crash through getting permission. Recommendations: For OpenHarmony versions prior to 3.2.4, update to a version newer than 3.2.4 to resolve th...

Android Automotive OS Update Bulletin—April 2024Stay organized with collectionsSave and categorize content based on your preferences.

The Android Automotive OS AAOS Update Bulletin contains details of security vulnerabilities affecting the Android Automotive OS platform. The full AAOS update comprises the security patch level of 2024-03-05 or later from the April 2024 Android Security Bulletin in addition to all issues in this...

PT-2024-23352 · Unknown · Beaver Builder

Name of the Vulnerable Software and Affected Versions: Beaver Builder versions through 2.7.4.4 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Stored XSS in Beaver Builder. Recommendations: For...

PT-2024-3250 · Oracle +1 · Virtualbox +1

Name of the Vulnerable Software and Affected Versions: Oracle VM VirtualBox versions prior to 7.0.16 Description: The issue is related to an out-of-bounds write vulnerability in the Core component of Oracle VM VirtualBox. This vulnerability can be easily exploited by a low-privileged attacker wit...

PT-2024-23144 · Supsystic · Photo Gallery By Supsystic

Name of the Vulnerable Software and Affected Versions: Photo Gallery by Supsystic versions 1.15.16 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows stored cross-site scripting XSS. This means that an attacker can inject...

PT-2024-22606 · Ampache · Ampache

Name of the Vulnerable Software and Affected Versions: Ampache versions prior to 6.3.1 Description: A stored Cross Site Scripting XSS issue allows a remote attacker to execute code via a crafted payload to several parameters in the post request of "/preferences.php?action=admin update preferences...

PT-2024-11684 · WordPress · Squirrly Seo Plugin

Name of the Vulnerable Software and Affected Versions: Squirrly SEO Plugin versions through 12.1.20 Description: The issue is related to a Missing Authorization vulnerability in the Squirrly SEO Plugin. This vulnerability allows unauthorized access due to the lack of proper authorization checks...

PT-2024-22723 · Ninja Team · Ninjateam Database For Contact Form 7

Name of the Vulnerable Software and Affected Versions: NinjaTeam Database for Contact Form 7 versions 3.0.6 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for Stored XSS. This means that an attacker can inject malicious...

PT-2024-2308 · Adobe · Experience Manager

Name of the Vulnerable Software and Affected Versions: Adobe Experience Manager versions 6.5.19 and earlier Description: The issue is related to a reflected Cross-Site Scripting XSS vulnerability. It occurs due to inadequate protection of the web page structure, allowing a remote attacker to...

PT-2024-3055

Name of the Vulnerable Software and Affected Versions libheif versions prior to 1.17.7 Description The issue is related to a memory leak in the JpegEncoder::Encode function, which can be exploited by an attacker to cause a denial of service attack. This flaw allows a remote attacker to disrupt...

PT-2024-8940 · Abb · S+ Control Api +3

Name of the Vulnerable Software and Affected Versions: Symphony Plus S+ Operations versions 2.0;0 through 2.0 SP6 TC6 Symphony Plus S+ Operations versions 2.1;0 through 2.1 SP2 RU3 Symphony Plus S+ Operations versions 3.0;0 through 3.3 SP1 RU4 Symphony Plus S+ Engineering versions 2.1 through 2.3...