PT-2024-23088 · Kerlink +1 · Kerlink Firewall +2

Name of the Vulnerable Software and Affected Versions: ChirpStack chirpstack-mqtt-forwarder versions 4.2.0 and earlier ChirpStack chirpstack-gateway-bridge versions 4.0.10 and earlier Description: The Kerlink firewall in ChirpStack wrongly accepts certain TCP packets when a connection is not in t...

PT-2024-22186 · WordPress · Wp Responsive Tabs Horizontal Vertical/Accordion Tabs

Name of the Vulnerable Software and Affected Versions: WP Responsive Tabs horizontal vertical and accordion Tabs versions 1.1.17 and earlier Description: The issue is related to improper neutralization of input during web page generation, which can lead to stored cross-site scripting XSS. This...

PT-2024-11758 · Unknown · Ajax Thumbnail Rebuild

Name of the Vulnerable Software and Affected Versions: AJAX Thumbnail Rebuild versions 1.13 and earlier Description: The issue is related to a Missing Authorization vulnerability. This vulnerability affects the AJAX Thumbnail Rebuild software. Recommendations: For versions 1.13 and earlier, updat...

Important: nodejs

Issue Overview: A flaw was found in Node.js. On Linux, Node.js ignores certain environment variables if they have been set by an unprivileged user while the process is running with elevated privileges, with the exception of CAPNETBINDSERVICE. Due to a bug in the implementation of this exception,...

Important: nodejs

Issue Overview: A flaw was found in Node.js. On Linux, Node.js ignores certain environment variables if they have been set by an unprivileged user while the process is running with elevated privileges, with the exception of CAPNETBINDSERVICE. Due to a bug in the implementation of this exception,...

PT-2024-12520 · Ibm · Ibm Security Verify Governance

Name of the Vulnerable Software and Affected Versions: IBM Security Verify Governance version 10.0.2 Description: The issue is caused by the failure to properly enable HTTP Strict Transport Security, allowing a remote attacker to obtain sensitive information using man-in-the-middle techniques. Th...

PT-2024-5022 · Qlik · Qlikview

Name of the Vulnerable Software and Affected Versions: Qlik Qlikview versions prior to May 2022 SR3 12.70.20300 and prior to May 2023 SR2 12.80.20200 Description: A race condition in the installer executable may allow an existing lower privileged user to cause code to be executed in the context o...

PT-2024-22195 · Unknown · Visual Composer Website Builder

Name of the Vulnerable Software and Affected Versions: Visual Composer Website Builder versions through 45.6.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Stored XSS. This enables potential attacker...

PT-2024-22753 · Unknown · Themefic Tourfic

Name of the Vulnerable Software and Affected Versions: Themefic Tourfic versions through 2.11.8 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as 'Cross-site Scripting', which allows Stored XSS. This means that an attacker can inject...

Netatalk < 3.1.18 RCE Vulnerability

Netatalk is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:netatalk:netatalk...

PT-2024-22709 · Unknown · Five Star Restaurant Menu

Name of the Vulnerable Software and Affected Versions: Five Star Restaurant Menu versions through 2.4.14 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Stored XSS, which can be exploited by...

PT-2024-22752 · Unknown · Contact Form 7 – Paypal & Stripe Add-On

Name of the Vulnerable Software and Affected Versions: Contact Form 7 – PayPal & Stripe Add-on versions n/a through 2.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Reflected XSS...

PT-2024-22722

Name of the Vulnerable Software and Affected Versions HasThemes Extensions For CF7 versions 3.0.6 and earlier Description The issue is related to improper neutralization of input during web page generation, which allows for stored cross-site scripting XSS. This means that an attacker can inject...

PT-2025-18295 · Xwiki · Xwiki

Name of the Vulnerable Software and Affected Versions: XWiki versions 15.9-rc-1 through 15.10.8 XWiki versions 16.0.0-rc-1 through 16.2.0 Description: XWiki is a generic wiki platform. The required rights analysis does not consider TextAreas with default content type, allowing a user to put...

PT-2024-3277 · Google +4 · Google Chrome +5

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 123.0.6312.58 Description: The issue is related to an object lifecycle problem in the V8 JavaScript and WebAssembly engine, allowing a remote attacker to potentially exploit object corruption via a crafted HTML...

PT-2024-2640 · Google +3 · Google Chrome +3

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 123.0.6312.58 Description: The issue is related to inappropriate implementation in iOS, allowing a remote attacker to leak cross-origin data via a crafted HTML page. This is due to insufficient access control,...

PT-2024-2234 · Adobe · Experience Manager

Name of the Vulnerable Software and Affected Versions: Adobe Experience Manager versions 6.5.19 and earlier Description: The issue exists due to inadequate protection of the web page structure, allowing for potential exploitation. This could enable a remote attacker to conduct cross-site scriptin...

Medium: c-ares

Issue Overview: c-ares is a C library for asynchronous DNS requests. aresreadline is used to parse local configuration files such as /etc/resolv.conf, /etc/nsswitch.conf, the HOSTALIASES file, and if using a c-ares version prior to 1.27.0, the /etc/hosts file. If any of these configuration files...

Low: libpq

Issue Overview: In PostgreSQL, a modified, unauthenticated server can send an unterminated string during the establishment of Kerberos transport encryption. In certain conditions a server can cause a libpq client to over-read and report an error message containing uninitialized bytes...

PT-2024-14115 · Elementor · Split Test For Elementor

Name of the Vulnerable Software and Affected Versions: Split Test For Elementor versions 1.6.9 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the software, allowing unauthorized actions to be performed on behalf of a user without their knowledge. Recommendations: For...