PT-2025-31022 · Pypi · Serde-Json-Wasm

Name of the Vulnerable Software and Affected Versions: serde-json-wasm versions prior to 1.0.1 Description: The serde-json-wasm crate is susceptible to a stack consumption issue when processing deeply nested JSON data. Recommendations: Update to version 1.0.1 or later...

PT-2024-13163 · Line · Line

Name of the Vulnerable Software and Affected Versions: Line version 13.6.1 Description: An issue in the COLORFUL laundry mini-app allows attackers to send crafted malicious notifications via leakage of the channel access token. This leakage enables attackers to exploit the system. Recommendations...

PT-2024-20000 · Lemmy · Lemmy

Name of the Vulnerable Software and Affected Versions: Lemmy versions 0.17.0 through 0.19.0 Description: The issue allows any authenticated user to obtain arbitrary private message contents by creating a private message report. This is possible because the API response to creating a private messa...

PT-2024-11632 · Woocommerce · Advanced Local Pickup For Woocommerce

Name of the Vulnerable Software and Affected Versions: Zorem Advanced Local Pickup for WooCommerce versions 1.5.2 and earlier Description: The issue is related to a Missing Authorization vulnerability. This means that certain actions or resources may be accessible without the necessary permission...

CVE-2023-22527

A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE on an affected instance. Customers using an affected version must take immediate action. Most recent supported versions of Confluence Data Center and Server...

PT-2024-1161

Name of the Vulnerable Software and Affected Versions Oracle Java SE versions 8u391, 8u391-perf, 11.0.21, 17.0.9, 21.0.1 Oracle GraalVM for JDK versions 17.0.9, 21.0.1 Oracle GraalVM Enterprise Edition versions 20.3.12, 21.3.8, 22.3.4 Description A difficult to exploit vulnerability in the Hotspo...

PT-2024-10891 · WordPress · Currency Switcher For Woocommerce

Name of the Vulnerable Software and Affected Versions: WooCommerce Currency Switcher FOX WordPress plugin versions prior to 1.3.7 Description: The issue concerns a Local File Inclusion LFI vulnerability. LFI is a type of attack where an attacker can trick the application into exposing or running...

PT-2024-1445 · Unknown · Rapid Scada

Name of the Vulnerable Software and Affected Versions: Rapid SCADA versions prior to 5.8.4 Description: The issue is related to errors in handling relative path to directory, allowing an attacker to read arbitrary files from the system by appending path traversal characters to the filename when...

PT-2024-1450 · Unknown · Rapid Scada

Name of the Vulnerable Software and Affected Versions: Rapid SCADA versions prior to 5.8.4 Description: The issue is related to incorrect permission assignment for a critical resource in the SCADA system. This may allow an attacker to escalate their privileges. An authorized user can write direct...

PT-2024-2753 · Isc +12 · Bind 9 +12

Name of the Vulnerable Software and Affected Versions: BIND 9 versions 9.0.0 through 9.16.45 BIND 9 versions 9.18.0 through 9.18.21 BIND 9 versions 9.19.0 through 9.19.19 BIND 9 versions 9.9.3-S1 through 9.11.37-S1 BIND 9 versions 9.16.8-S1 through 9.16.45-S1 BIND 9 versions 9.18.11-S1 through...

PT-2024-1136 · Juniper Networks · Junos Evolved +1

Name of the Vulnerable Software and Affected Versions: Juniper Networks Junos OS versions prior to 20.4R3-S9 Juniper Networks Junos OS versions 21.2 prior to 21.2R3-S7 Juniper Networks Junos OS versions 21.3 prior to 21.3R3-S5 Juniper Networks Junos OS versions 21.4 prior to 21.4R3-S5 Juniper...

Vulnerability fixed in Microsoft SQL Server

Microsoft has fixed a vulnerability in SQL Server. A malicious party can exploit the vulnerability to use a Man-in-the-Middle attack to intercept and decrypt, potentially gaining access to the sensitive data in that traffic. Abuse is not easily accomplished and requires the malicious party is in...

Stable Channel Update for ChromeOS / ChromeOS Flex

Hello All, The Stable channel is being updated to 120.0.6099.203 Platform version: 15662.64.0 for most ChromeOS devices and will be rolled out over the next few days. If you find new issues, please let us know one of the following ways: File a bug Visit our Chrome OS communities General: Chromebo...

PT-2024-14473 · Unknown · Html5 Mp3 Player With Playlist Free

Name of the Vulnerable Software and Affected Versions: HTML5 MP3 Player with Playlist Free versions 3.0.0 and earlier Description: The issue is related to the deserialization of untrusted data, which can lead to potential security risks. No information is provided about the estimated number of...

Medium: ncurses

Issue Overview: NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component ncwrapentry. CVE-2023-50495 Affected Packages: ncurses Issue Correction: Run dnf update ncurses --releasever 2023.3.20240108 or dnf update --advisory ALAS2023-2024-466 --releasever 2023.3.2024010...

PT-2024-11630 · Wp Engine · Wp Engine Advanced Custom Fields

Name of the Vulnerable Software and Affected Versions: WP Engine Advanced Custom Fields ACF versions 3.1.1 through 6.0.2 Description: The issue is related to the exposure of sensitive information to an unauthorized actor. This is a problem where sensitive data is made accessible to individuals wh...

Medium: gnutls

Issue Overview: A vulnerability was found that the response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct PKCS1 v1.5 padding. Only TLS ciphertext processing is affected. CVE-2023-5981 Affected Packages: gnutls Issue Correction:...

PT-2024-4517 · WordPress · Learnpress

Name of the Vulnerable Software and Affected Versions: LearnPress plugin for WordPress versions up to, and including, 4.2.5.7 Description: The issue is related to the LearnPress plugin for WordPress, which is vulnerable to command injection in all versions up to, and including, 4.2.5.7. This...

PT-2023-32863 · Miniflare · Miniflare

Name of the Vulnerable Software and Affected Versions: Miniflare versions prior to 3.20231030.2 Description: Sending specially crafted HTTP requests to Miniflare's server could result in arbitrary HTTP and WebSocket requests being sent from the server. If Miniflare was configured to listen on...

PT-2023-31807 · Wpfactory · Wpfactory Back Button Widget

Name of the Vulnerable Software and Affected Versions: WPFactory Back Button Widget versions 1.6.3 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as 'Cross-site Scripting', which allows Stored XSS. This means that an attack...