PT-2024-35022 · Unknown · Saleswizard Crm Plugin

Name of the Vulnerable Software and Affected Versions: Official SalesWizard CRM Plugin versions 1.0.2 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows stored cross-site scripting XSS. This means an attacker can inject...

PT-2024-35257 · Unknown · Reconstruction

Name of the Vulnerable Software and Affected Versions: ReConstruction versions 1.4.7 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Reflected XSS. Recommendations: For versions...

PT-2024-35258 · Cactusthemes · Cactusthemes Gameplan

Name of the Vulnerable Software and Affected Versions: CactusThemes Gameplan versions 1.5.10 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Reflected XSS. Recommendations: For...

PT-2024-35471 · Flagsmith · Flagsmith

Name of the Vulnerable Software and Affected Versions: Flagsmith versions prior to 2.134.1 Description: The issue allows bypassing the ALLOW REGISTRATION WITHOUT INVITE setting. Recommendations: For versions prior to 2.134.1, update to version 2.134.1 or later to resolve the issue...

PT-2024-16608 · WordPress · Gallery Manager

Name of the Vulnerable Software and Affected Versions: Gallery Manager plugin for WordPress versions up to, and including, 1.6.58 Description: The Gallery Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of remove Query Arg without appropriate escaping o...

PT-2024-8896

Name of the Vulnerable Software and Affected Versions: PHP versions 8.1. before 8.1.31 PHP versions 8.2. before 8.2.26 PHP versions 8.3. before 8.3.14 Description: The issue is related to insufficient protection of internal data due to a buffer overflow in memory, which can be exploited by a...

PT-2024-9634 · Adobe · Experience Manager

Name of the Vulnerable Software and Affected Versions: Adobe Experience Manager versions 6.5.21 and earlier Description: The issue is related to a DOM-based Cross-Site Scripting XSS vulnerability. It could be exploited by an attacker to execute arbitrary code in the context of the victim's browse...

PT-2024-16629 · WordPress · Tutor Lms Elementor Addons

Name of the Vulnerable Software and Affected Versions: Tutor LMS Elementor Addons plugin for WordPress versions up to, and including, 2.1.5 Description: The issue is related to a missing capability check on the install etlms dependency plugin function, allowing authenticated attackers with...

PT-2024-35207 · WordPress · Hive Support – Wordpress Help Desk

Name of the Vulnerable Software and Affected Versions: Hive Support – WordPress Help Desk versions 1.1.1 and earlier Description: The issue allows for the unrestricted upload of files with dangerous types, potentially enabling an attacker to upload a web shell to a web server. This could grant an...

Fedora 41 : dnsdist (2024-73b41ae8e5)

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-73b41ae8e5 advisory. Update to latest upstream Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested f...

Fedora 41 : chromium (2024-3a6f9ab958)

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-3a6f9ab958 advisory. Update to 130.0.6723.58 High CVE-2024-9954: Use after free in AI Medium CVE-2024-9955: Use after free in Web Authentication Medium CVE-2024-9956:...

Fedora 41 : chromium (2024-a59306afa3)

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-a59306afa3 advisory. Update to 129.0.6668.100 CVE-2024-9602: Type Confusion in V8 CVE-2024-9603: Type Confusion in V Tenable has extracted the preceding description bloc...

Fedora 41 : webkit2gtk4.0 (2024-58de5ad94f)

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-58de5ad94f advisory. Update to 2.46.3 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested f...

Fedora 41 : rapidjson (2024-5e0da8577a)

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-5e0da8577a advisory. Automatic update for rapidjson-1.1.0-41.fc41. Changelog Wed Jul 10 2024 Tom Hughes - 1.1.0-41 - Add patch for CVE-2024-38517 aka RHBZ2296979 Tenable has...

WordPress Plugin "VK All in One Expansion Unit" vulnerable to cross-site scripting

Overview "Custom Alert Content" of WordPress Plugin "VK All in One Expansion Unit" provided by Vektor,Inc. contains a stored cross-site scripting vulnerability CWE-79. Umeda Yuugo of Tokyo Denki University reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under...

PT-2024-35375 · Jenkins · Jenkins Openid Connect Authentication Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins OpenId Connect Authentication Plugin versions 4.418.vccc7061f5b 6d and earlier Description: The issue arises because the plugin does not invalidate the previous session on login, allowing attackers to potentially use social engineerin...

PT-2024-16790 · WordPress · Wordpress User Extra Fields

Name of the Vulnerable Software and Affected Versions: WordPress User Extra Fields plugin versions up to, and including, 16.6 Description: The WordPress User Extra Fields plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete tmp...

TIBCO Security Advisory: November 12, 2024 - TIBCO Hawk & Operational Intelligence - CVE-2024-10217

TIBCO Hawk Stored-XSS Vulnerability Original release date: November 12, 2024 Last revised: --- CVE-2024-10217 Source: TIBCO Software Inc. Products Affected TIBCO Hawk versions 6.2.0, 6.2.1, 6.2.2, 6.2.3, 6.2.4, and 6.3.0 TIBCO Operational Intelligence Hawk versions 7.2.0, 7.2.1, and 7.2.2 Compone...

PT-2024-8155 · Microsoft · 365 Apps For Enterprise +2

Name of the Vulnerable Software and Affected Versions: Microsoft Office versions affected versions not specified Microsoft Excel versions affected versions not specified Microsoft 365 Apps for Enterprise versions affected versions not specified Description: The issue is related to a buffer overfl...

PT-2024-8014 · Adobe · After Effects

Name of the Vulnerable Software and Affected Versions: Adobe After Effects versions 23.6.9, 24.6.2 and earlier Description: The issue is related to an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass...