Medium: amazon-ecr-credential-helper

Issue Overview: The various Is methods IsPrivate, IsLoopback, etc did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms. CVE-2024-24790 Affected Packages: amazon-ecr-credential-helper Issue Correction: Run dn...

PT-2024-39691 · WordPress · Slimstat Analytics

Name of the Vulnerable Software and Affected Versions: SlimStat Analytics plugin for WordPress versions up to, and including, 5.2.6 Description: The issue is related to Stored Cross-Site Scripting via the resource parameter due to insufficient input sanitization and output escaping when logging...

PT-2024-39388 · WordPress · Wordpress File Upload

Name of the Vulnerable Software and Affected Versions: WordPress File Upload plugin versions up to, and including, 4.24.11 Description: The WordPress File Upload plugin is vulnerable to Path Traversal via the wfu file downloader.php file. This allows unauthenticated attackers to read or delete...

PT-2024-38379 · WordPress · Forms For Mailchimp By Optin Cat

Name of the Vulnerable Software and Affected Versions: The Forms for Mailchimp by Optin Cat – Grow Your MailChimp List plugin for WordPress versions up to, and including, 2.5.6 Description: The issue is related to Stored Cross-Site Scripting via the form color parameters due to insufficient input...

PT-2024-32959 · Tainacan · Tainacan

Name of the Vulnerable Software and Affected Versions: Tainacan versions 0.21.8 and earlier Description: The issue is related to an SQL Injection vulnerability due to the improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks. Recommendations: Fo...

PT-2024-34: Server Side Request Forgery (SSRF) in Passwork

The vulnerability was identified in Passwork version 6.4.0. The discovered vulnerability can be exploited by an attacker to send requests to both external nodes and servers with limited access, which leads to disclosure of sentisive data, denial of service, etc. Also, exploitation of the...

PT-2025-2097 · Drupal · Drupal

Name of the Vulnerable Software and Affected Versions: Drupal Block permissions versions 1.0.0 through 1.2.0 Description: The issue is related to an incorrect authorization mechanism in the Block permissions module of the Drupal CMS system. This can allow a remote attacker to impact the...

PT-2024-32: Stored Cross-Site Scripting (Stored XSS) in Passwork

The vulnerability was identified in Passwork version 6.4.0. The application does not process the data received from the user, which is necessary for safety use during web page formation. Discovered vulnerability allows an attacker to execute arbitrary JavaScript code in victim's browser...

PT-2024-38619 · Progress · Telerik Reporting

Name of the Vulnerable Software and Affected Versions: In Progress Telerik Reporting versions prior to 2024 Q3 18.2.24.924 Description: A command injection attack is possible through improper neutralization of hyperlink elements. This issue arises due to the improper handling of hyperlink element...

PT-2024-31: Reflected Cross-Site Scripting (Reflected XSS) in Passwork

The vulnerability was identified in Passwork version 6.4.0. The application does not process the data received from the user, which is necessary for safety use during web page formation. An attacker can inject a malicious script into the request parameters and conduct social engineering attack on...

PT-2024-29: Path Traversal in Passwork

The vulnerability was identified in Passwork version 6.4.0. The discovered vulnerability can be exploited by an attacker to gain access to local files and directories on the server, which are not avaliable by the logic of the application. Vulnerability status: Confirmed by vendor Date of...

Vulnerabilities fixed in Microsoft Office

Microsoft has fixed vulnerabilities in Office components. A malicious person could exploit the vulnerabilities to execute arbitrary code with the victim's privileges, potentially gaining access to sensitive data in the victim's context. Successful exploitation requires the malicious party to tric...

PT-2025-11523 · Dell · Os10

Name of the Vulnerable Software and Affected Versions: Dell SmartFabric OS10 Software versions 10.5.4.x through 10.6.0.x Description: The issue is related to an Improper Neutralization of Special Elements used in a Command, also known as 'Command Injection'. This could allow a high privileged...

Intel® TDX Module Software Advisory

Summary: A potential security vulnerability in Intel® Trust Domain Extensions TDX Module firmware may allow information disclosure. Intel is releasing firmware updates to mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2024-27457 Description: Improper check for unusual or...

PT-2024-30899 · Elementor · Nicheaddons Restaurant & Cafe Addon For Elementor

Name of the Vulnerable Software and Affected Versions: NicheAddons Restaurant & Cafe Addon for Elementor versions 1.5.5 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS,...

PT-2024-32556 · WordPress · Wp-Downloadmanager

Name of the Vulnerable Software and Affected Versions: WP-DownloadManager versions 1.68.8 and earlier Description: The issue is related to an Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This problem allows Reflected XSS. Recommendations: Fo...

PT-2024-30893 · Unknown · Temegum Gum Elementor Addon

Name of the Vulnerable Software and Affected Versions: TemeGUM Gum Elementor Addon versions 1.3.6 and earlier Description: The issue affects TemeGUM Gum Elementor Addon, allowing Stored XSS due to improper neutralization of input during web page generation. This is a Cross-site Scripting...

PT-2024-32588 · Unknown · Paul Bearne Author Avatars List/Block

Name of the Vulnerable Software and Affected Versions: Paul Bearne Author Avatars List/Block versions 2.1.21 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS, which allows Stored XSS. This means an...

PT-2024-9624

Name of the Vulnerable Software and Affected Versions GStreamer versions prior to 1.24.10 Description A stack-buffer overflow has been detected in the gst opus dec parse header function within gstopusdec.c. The pos array is a stack-allocated buffer of size 64. If n channels exceeds 64, the for lo...

PT-2024-32669 · Unknown · Logicytics

Name of the Vulnerable Software and Affected Versions: Logicytics versions prior to 2.3.2 Description: Logicytics is designed to harvest and collect data for forensic analysis. It has a basic vulnerability affecting compromised devices from shell injections. Recommendations: For versions prior to...