PT-2024-18098 · WordPress · The Academy Lms

Name of the Vulnerable Software and Affected Versions: The Academy LMS – eLearning and online course solution for WordPress plugin versions up to, and including, 1.9.19 Description: The issue is related to privilege escalation due to the plugin allowing arbitrary user meta updates through the sav...

PT-2024-9560 · Synology · Synology Router Manager

Name of the Vulnerable Software and Affected Versions: Synology Router Manager versions prior to 1.3.1-9346-9 Description: The issue is related to an improper limitation of a pathname to a restricted directory, also known as a 'Path Traversal' vulnerability, in the OTP reset functionality. This...

PT-2024-21789 · Unknown · A-Blog Cms

Name of the Vulnerable Software and Affected Versions: a-blog cms versions 3.1.x through 3.1.9 and earlier a-blog cms versions 3.0.x through 3.0.30 and earlier a-blog cms versions 2.11.x through 2.11.59 and earlier a-blog cms versions 2.10.x through 2.10.51 and earlier a-blog cms version 2.9 and...

Vulnerability fixed in Microsoft SQL Server

Microsoft has fixed and vulnerability in SQL Server. The vulnerability is located in the Django backend and allows a malicious party to be able to use the client application of the victim to execute an SQL injection and thus execute arbitrary code execute arbitrary code with the victim's privileg...

PT-2024-2211 · Adobe · Lightroom Desktop

Name of the Vulnerable Software and Affected Versions: Lightroom Desktop versions 7.1.2 and earlier Description: The issue is related to an Untrusted Search Path vulnerability. This could result in arbitrary code execution in the context of the current user. If the application uses a search path ...

PT-2024-2413 · Adobe · Experience Manager

Name of the Vulnerable Software and Affected Versions: Adobe Experience Manager versions 6.5.19 and earlier Description: The issue exists due to inadequate protection of the web page structure, allowing a remote attacker to execute arbitrary JavaScript code using a specially crafted URL. This is ...

PT-2024-18099 · WordPress · The Prime Slider – Addons For Elementor

Name of the Vulnerable Software and Affected Versions: The Prime Slider – Addons For Elementor plugin for WordPress versions up to, and including, 3.13.1 Description: The issue is related to Stored Cross-Site Scripting via the title tags attribute of the Fiestar widget due to insufficient input...

PT-2024-2096 · Jenkins · Jenkins Html Publisher Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins HTML Publisher Plugin versions 1.32 and earlier Description: The issue is related to the incorrect restriction of the directory path name with limited access. Exploitation may allow a remote attacker to read arbitrary files using a...

PT-2024-13264 · Unknown · Ailux Imx6 Bundle

Name of the Vulnerable Software and Affected Versions: AiLux imx6 bundle versions prior to imx6 1.0.7-2 Description: A CWE-613 “Insufficient Session Expiration” issue in the web application exists due to the session cookie sessionid lasting two weeks, which facilitates session hijacking attacks...

Important: libgit2

Issue Overview: libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Using well-crafted inputs to gitrevparsesingle can cause the function to enter an infinite loop, potentially...

PT-2024-21156 · Unknown · So Flexibilite +1

Name of the Vulnerable Software and Affected Versions: PrestaShop versions prior to 4.1.26 Description: An issue in the Common-Services "So Flexibilite" soflexibilite module allows remote attackers to escalate privileges and obtain sensitive information via a debug file. Recommendations: For...

PT-2024-15014 · Unknown · Wp Jobsearch

Name of the Vulnerable Software and Affected Versions: WP JobSearch versions prior to 2.3.4 Description: The issue allows attackers to log in as any user with only the knowledge of that user's email address. Recommendations: For versions prior to 2.3.4, update to version 2.3.4 or later to resolve...

PT-2024-21634

Name of the Vulnerable Software and Affected Versions ESPHome versions 2023.12.9 through 2024.2.0 Description A security misconfiguration in the edit configuration file API in the dashboard component of ESPHome allows authenticated remote attackers to read and write arbitrary files under the...

PT-2024-21386 · Unknown · Web-Platform-Tests

Name of the Vulnerable Software and Affected Versions: web-platform-tests/wpt versions before commit 938e843 Description: A DOM based cross-site scripting XSS issue in the component /dom/ranges/Range-test-iframe.html allows attackers to execute arbitrary Javascript via sending a crafted URL...

PT-2024-3159

Name of the Vulnerable Software and Affected Versions ValvePress Automatic versions prior to 3.92.1 Description The issue is related to an SQL Injection vulnerability that allows attackers to execute arbitrary SQL commands. This can lead to site takeovers and malicious activities. The vulnerabili...

PT-2024-20632 · Unknown · Admin Menu Editor

Name of the Vulnerable Software and Affected Versions: Admin Menu Editor versions 1.12 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the Admin Menu Editor. This allows an attacker to perform unintended actions on the victim's behalf. Recommendations: For versions 1.12 a...

PT-2024-18051 · WordPress · Page Scroll To Id

Name of the Vulnerable Software and Affected Versions: Page scroll to id plugin for WordPress versions up to, and including, 1.7.8 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping on user-supplied attributes in the plugin'...

PT-2024-17728 · WordPress · Essential Addons For Elementor

Name of the Vulnerable Software and Affected Versions: The Essential Addons for Elementor plugin for WordPress versions up to, and including, 5.9.8 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping, specifically via the...

Important: kernel

Issue Overview: A use-after-free vulnerability in the Linux kernel's netfilter: nftables component can be exploited to achieve local privilege escalation. The nftsetelemcatchalldeactivate function checks whether the catch-all set element is active in the current generation instead of the next...

PT-2024-19022 · Osticky2 +2 · Osticky2 +2

Name of the Vulnerable Software and Affected Versions: osTicky2 versions prior to 2.2.8 Description: An Open Redirect issue was discovered, allowing attackers to manipulate the return parameter in the URL to redirect to a malicious base64 encoded URL. This affects osTicky, a Joomla 3.x extension...