"ZOZOTOWN" App for Android fails to restrict custom URL schemes properly

Overview "ZOZOTOWN" App for Android provided by ZOZO, Inc. provides the function to access a URL requested via Custom URL Scheme. The App does not restrict access to the function properly CWE-939 which may be exploited to direct the App to access any sites. Impact A remote attacker may lead a use...

CVE-2024-38351 Password auth and OAuth2 unverified email linking

Pocketbase is an open source web backend written in go. In affected versions a malicious user may be able to compromise other user accounts. In order to be exploited users must have both OAuth2 and Password auth methods enabled. A possible attack scenario could be: 1. a malicious actor register...

PT-2024-4378 · Google +5 · Google Chrome +6

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 126.0.6478.114 Microsoft Edge affected versions not specified Description: The issue is related to an inappropriate implementation in V8, allowing a remote attacker to perform out of bounds memory access via a...

PT-2024-4245 · Google +5 · Google Chrome +5

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 126.0.6478.54 Description: The issue is related to an inappropriate implementation in DevTools, which can be exploited by an attacker to execute arbitrary code via a crafted Chrome Extension. This can happen if...

PT-2024-12297 · Sparkle Wp · Editorialmag

Name of the Vulnerable Software and Affected Versions: Editorialmag versions 1.1.9 and earlier Description: The issue is related to a Missing Authorization vulnerability in Sparkle WP Editorialmag. Recommendations: For versions 1.1.9 and earlier, update to a version later than 1.1.9 to resolve th...

PT-2024-25982 · Ghozylab · Popup Builder

Name of the Vulnerable Software and Affected Versions: GhozyLab, Inc. Popup Builder versions 1.1.29 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS attacks. There is a...

PT-2024-4554 · Unknown · Focus For Ios

Name of the Vulnerable Software and Affected Versions: Focus for iOS versions prior to 126 Description: The issue is related to the file scheme of URLs being hidden, potentially allowing spoofing of a website's address in the location bar. This could enable a remote attacker to conduct spoofing...

PT-2024-25518 · Linqi · Linqi

Name of the Vulnerable Software and Affected Versions: linqi versions prior to 1.4.0.1 Description: An issue was discovered in linqi, allowing local file inclusion via the /api/Cdn/GetFile API endpoint. Recommendations: For versions prior to 1.4.0.1, update to version 1.4.0.1 or later to resolve...

PT-2024-25522 · Linqi · Linqi

Name of the Vulnerable Software and Affected Versions: linqi versions prior to 1.4.0.1 Description: An issue was discovered in linqi where there is a hardcoded password salt. Recommendations: For versions prior to 1.4.0.1, update to version 1.4.0.1 or later to resolve the issue...

PT-2024-31261 · Kadence Wp · Gutenberg Blocks With Ai

Name of the Vulnerable Software and Affected Versions: Gutenberg Blocks with AI by Kadence WP plugin for WordPress versions up to, and including, 3.2.36 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes, specifically the link...

PT-2024-19441 · Silicon · Silicon Labs 500 Series +1

Name of the Vulnerable Software and Affected Versions: Silicon Labs 500 Series Z-Wave devices versions prior to v6.85.2 Description: A buffer overflow issue may allow Denial of Service and potential remote code execution. This issue affects Silicon Labs 500 Series SDK running on Silicon Labs 500...

PT-2024-23223

Name of the Vulnerable Software and Affected Versions Bouncy Castle Java TLS API and JSSE Provider versions prior to 1.78 Description An issue may cause timing-based leakage in RSA based handshakes due to exception processing. Recommendations For versions prior to 1.78, update to version 1.78 or...

PT-2024-21430 · WordPress · Barcode Scanner/Inventory Manager

Name of the Vulnerable Software and Affected Versions: The Barcode Scanner and Inventory manager. POS Point of Sale – scan barcodes & create orders with barcode reader. plugin for WordPress versions up to, and including, 1.5.4 Description: The issue is related to blind SQL Injection via the...

PT-2024-20932 · Jotform · Jotform Online Forms – Drag & Drop Form Builder

Name of the Vulnerable Software and Affected Versions: Jotform Online Forms – Drag & Drop Form Builder, Securely Embed Contact Forms plugin for WordPress versions up to, and including, 1.3.1 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization an...

PT-2024-13068 · Clarisa · Filemaker Server

Name of the Vulnerable Software and Affected Versions: FileMaker Server versions prior to 20.3.1 Description: The issue potentially exposed password information to front-end websites when signed in to the Admin Console with an administrator role. This was resolved by eliminating the send of Admin...

PT-2025-31019 · Unknown · Cosmwasm-Std

Name of the Vulnerable Software and Affected Versions: cosmwasm-std crate versions prior to 2.0.2 Description: The cosmwasm-std crate contains an integer overflow issue that can lead to incorrect contract calculations. Recommendations: Update to version 2.0.2 or later...

PT-2024-4452 · Siemens · Siemens Solid Edge

Name of the Vulnerable Software and Affected Versions: Siemens Solid Edge versions prior to V224.0 Update 5 Description: The issue is related to an out of bounds read past the end of an allocated structure while parsing specially crafted PAR files. This could allow an attacker to execute code in...

PT-2024-3183 · Freerdp +9 · Freerdp +9

Name of the Vulnerable Software and Affected Versions: FreeRDP versions prior to 3.5.1 Description: The issue is related to an out-of-bounds read in the FreeRDP client, which is a free implementation of the Remote Desktop Protocol. This could allow a remote attacker to impact the confidentiality,...

PT-2024-24666 · Unknown · Adam Bowen Tax Rate Upload

Name of the Vulnerable Software and Affected Versions: Adam Bowen Tax Rate Upload versions n/a through 2.4.5 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables potential attacke...

PT-2024-24075 · Unknown · The Events Calendar

Name of the Vulnerable Software and Affected Versions: The Events Calendar versions n/a through 6.3.0 Description: A Cross-Site Request Forgery CSRF issue has been identified. This type of issue allows an attacker to trick a user into performing unintended actions on a web application that the us...