PT-2024-27232 · Splunk · Splunk Enterprise

Name of the Vulnerable Software and Affected Versions: Splunk Enterprise versions prior to 9.2.2 Splunk Enterprise versions prior to 9.1.5 Splunk Enterprise versions prior to 9.0.10 Description: The issue allows an authenticated user to execute a specially crafted query, which can then be used to...

PT-2024-28698 · Newpass · Newpass

Name of the Vulnerable Software and Affected Versions: NewPass versions prior to 1.2.0 Description: The issue allows unauthorized access to sensitive information because passwords are stored directly rather than as password hashes. Although data at rest is encrypted, it is decrypted within proces...

PT-2024-37106 · WordPress · Pagerank Tools

Name of the Vulnerable Software and Affected Versions: Pagerank tools WordPress plugin versions 1.1.5 and earlier Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back in the...

PT-2024-9034 · Ivanti · Ivanti Policy Secure +1

Name of the Vulnerable Software and Affected Versions: Ivanti Connect Secure versions prior to 22.7R2.1 and prior to 9.1R18.7 Ivanti Policy Secure versions prior to 22.7R1.1 Description: The issue is related to argument injection, allowing a remote authenticated attacker with admin privileges to...

PT-2024-26870 · Kalkitech · Kalkitech Ase Ase61850 Iedsmart

Name of the Vulnerable Software and Affected Versions: Kalkitech ASE ASE61850 IEDSmart versions 2.3.5 and earlier Description: The issue allows attackers to read and write arbitrary files via the IEC61850 File Transfer protocol. This is a result of a Directory Traversal vulnerability...

PT-2024-6028 · Dell · Powerscale Onefs

Name of the Vulnerable Software and Affected Versions: Dell PowerScale OneFS versions 8.2.2.x through 9.8.0.0 Description: The issue is related to an incorrect privilege assignment in the PowerScale OneFS operating system. This could allow a local high-privileged attacker to potentially exploit t...

Important: kernel-livepatch-4.14.343-259.562

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: exthdr: fix 4-byte stack OOB write If priv-len is a multiple of 4, then dstlen / 4 can write past the destination array which leads to stack corruption. This construct is necessary to clean th...

Important: libndp

Issue Overview: A vulnerability was found in libndp. A buffer overflow in NetworkManager that can be triggered by sending a malformed IPv6 router advertisement packet via malicious user locally. This happens as libndp was not validating correctly the route length information and hence leading to ...

PT-2024-25710 · Adobe · Experience Manager

Name of the Vulnerable Software and Affected Versions: Adobe Experience Manager versions 6.5.20 and earlier Description: The issue is a stored Cross-Site Scripting XSS vulnerability that could be exploited by a low-privileged attacker to inject malicious scripts into vulnerable form fields. When ...

CVE-2023-38506 Cross-site Scripting (XSS) when pasting HTML into the rich text editor in Joplin

Joplin is a free, open source note taking and to-do application. A Cross-site Scripting XSS vulnerability allows pasting untrusted data into the rich text editor to execute arbitrary code. HTML pasted into the rich text editor is not sanitized or not sanitized properly. As such, the onload...

Foxit Reader Multiple Vulnerabilities (June-4 2024)

Foxit Reader is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:foxitsoftware:reader";...

PT-2024-13643 · Crocoblock · Crocoblock Jetelements For Elementor

Name of the Vulnerable Software and Affected Versions: Crocoblock JetElements For Elementor versions 2.6.13 and earlier Description: The issue is related to a Missing Authorization vulnerability in Crocoblock JetElements For Elementor. Recommendations: For versions 2.6.13 and earlier, update to a...

PT-2024-13328 · Themify · Themify Ultra

Name of the Vulnerable Software and Affected Versions: Themify Ultra versions through 7.3.5 Description: The issue is related to a Missing Authorization vulnerability in Themify Ultra. This vulnerability allows unauthorized access, potentially leading to data breaches or other security incidents...

PT-2024-12580 · Brainstorm Force · Convert Pro

Name of the Vulnerable Software and Affected Versions: Convert Pro versions 1.7.5 and earlier Description: The issue is related to a Missing Authorization vulnerability in Brainstorm Force Convert Pro. Recommendations: For Convert Pro versions 1.7.5 and earlier, update to a version later than 1.7...

PT-2024-13329 · Themify · Themify Ultra

Name of the Vulnerable Software and Affected Versions: Themify Ultra versions through 7.3.5 Description: This issue is related to a Missing Authorization vulnerability in Themify Ultra. The estimated number of potentially affected devices worldwide is not available. There is no information about...

PT-2024-27022 · Ricoh · Ricoh Streamline Nx Pc Client

Name of the Vulnerable Software and Affected Versions: Ricoh Streamline NX PC Client versions 3.7.2 and earlier Description: The issue is related to the use of hard-coded credentials. If exploited, an attacker may obtain the LocalSystem Account of the PC where the product is installed, potentiall...

Python SSL Vulnerability (Jun 2024) - Windows

Python is prone to a vulnerability in the ssl module. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:python:python"; ifdescripti...

PT-2024-27082 · Unknown · Byondreal Accessor

Name of the Vulnerable Software and Affected Versions: byondreal accessor version 1.0.0 and earlier Description: A Prototype Pollution issue allows an attacker to execute arbitrary code. The issue is related to the @byondreal/accessor/index module. Recommendations: For byondreal accessor version...

PT-2024-26945 · Freefrom · Freefrom

Name of the Vulnerable Software and Affected Versions: FreeFrom - the nostr client versions prior to 1.3.5 Description: The issue is related to improper verification of cryptographic signatures. This means the affected app cannot detect event data with invalid signatures, potentially allowing...

KLA70453 Multiple vulnerability in Google Chrome

Multiple vulnerabilities were found in Google Chrome. Malicious users can exploit these vulnerabilities to execute arbitrary code, cause denial of service. Below is a complete list of vulnerabilities: 1. Use after free vulnerability in Audio can be exploited to cause denial of service or execute...