PT-2024-10476

Name of the Vulnerable Software and Affected Versions GStreamer versions prior to 1.24.10 Description The issue is related to an out-of-bounds read in the gst wavparse cue chunk function within gstwavparse.c. This occurs due to a discrepancy between the size of the data buffer and the size value...

PT-2025-13869

Name of the Vulnerable Software and Affected Versions: macOS Ventura versions prior to 13.7.5 macOS Sonoma versions prior to 14.7.5 Description: A permissions issue was addressed with additional sandbox restrictions. An app may be able to access sensitive user data. Recommendations: Update macOS ...

PT-2024-10365 · Gstreamer +7 · Gstreamer +7

Name of the Vulnerable Software and Affected Versions: GStreamer versions prior to 1.24.10 Description: A null pointer dereference vulnerability has been discovered in the gst matroska demux parse blockgroup or simpleblock function within matroska-demux.c. This function does not properly check th...

PT-2024-10160 · Http4K · Http4K

Name of the Vulnerable Software and Affected Versions: http4k versions prior to 5.41.0.0 Description: The issue is related to an XXE XML External Entity Injection vulnerability when http4k handles malicious XML contents within requests. This could allow attackers to read local sensitive informati...

PT-2024-10368 · Gstreamer +7 · Gstreamer +7

Name of the Vulnerable Software and Affected Versions: GStreamer versions prior to 1.24.10 Description: The issue is related to a null pointer dereference vulnerability in the gst matroska demux add wvpk header function. This vulnerability can be exploited by a remote attacker to cause a denial o...

PT-2024-10222 · Document Foundation +5 · Libreoffice +5

Name of the Vulnerable Software and Affected Versions: LibreOffice versions 24.8 through 24.8.3 Description: The issue is related to an improper limitation of a pathname to a restricted directory, allowing absolute path traversal. An attacker can write to arbitrary locations, albeit suffixed with...

PT-2024-16481

Name of the Vulnerable Software and Affected Versions System Dashboard WordPress plugin versions prior to 2.8.15 Description The issue is related to the plugin not validating user input used in a path, which could allow high privilege users, such as admin, to perform path traversal attacks and re...

PT-2024-9948 · Adobe · Substance3D - Modeler

Name of the Vulnerable Software and Affected Versions: Substance3D - Modeler versions 1.14.1 and earlier Description: The issue is related to an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires...

GHSA-6VX4-V2JW-QWQH Trix editor subject to XSS vulnerabilities on copy & paste

The Trix editor, in versions prior to 2.1.9 and 1.3.3, is vulnerable to XSS + mutation XSS attacks when pasting malicious code. Impact An attacker could trick a user to copy and paste malicious code that would execute arbitrary JavaScript code within the context of the user's session, potentially...

Trix editor subject to XSS vulnerabilities on copy & paste

The Trix editor, in versions prior to 2.1.9 and 1.3.3, is vulnerable to XSS + mutation XSS attacks when pasting malicious code. Impact An attacker could trick a user to copy and paste malicious code that would execute arbitrary JavaScript code within the context of the user's session, potentially...

PT-2024-35929 · Analytify · Analytify

Name of the Vulnerable Software and Affected Versions: Analytify versions prior to 5.4.4 Description: The issue is related to the exposure of sensitive system information to an unauthorized control sphere. This could potentially allow unauthorized access to sensitive data. Recommendations: For...

PT-2024-13650 · Unknown · 360 Javascript Viewer

Name of the Vulnerable Software and Affected Versions: 360 Javascript Viewer versions 1.7.11 and earlier Description: The issue affects the 360 Javascript Viewer due to missing authorization, allowing exploitation of incorrectly configured access control security levels. Recommendations: For...

PT-2024-36110 · Unknown · Rraddons For Elementor

Name of the Vulnerable Software and Affected Versions: RRAddons for Elementor versions 1.1.0 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS, which allows Stored XSS. This means that an attacker c...

PT-2024-13989 · Unknown · Profilepress

Name of the Vulnerable Software and Affected Versions: ProfilePress versions n/a through 4.13.2 Description: The issue is related to a Missing Authorization vulnerability in ProfilePress Membership Team, allowing exploitation of incorrectly configured access control security levels...

PT-2024-34365 · Digi · Digi Connectport Lts

Name of the Vulnerable Software and Affected Versions: Digi ConnectPort LTS versions prior to 1.4.12 Description: A vulnerability in the file upload handling of a web application allows manipulation of file paths via POST requests to API endpoints such as /file/upload. This can lead to arbitrary...

PT-2024-13503 · Sonaar · Sonaar Music Mp3 Audio Player

Name of the Vulnerable Software and Affected Versions: Sonaar Music MP3 Audio Player for Music, Radio & Podcast by Sonaar versions n/a through 4.10 Description: The issue affects the Sonaar Music MP3 Audio Player for Music, Radio & Podcast by Sonaar due to a Missing Authorization vulnerability...

PT-2024-35753 · Wegia · Wegia

Name of the Vulnerable Software and Affected Versions: WeGIA versions 3.2.0 before 3998672 Description: The issue is related to a lack of permission verification when changing a password. This means that the software does not check if the user has the necessary permissions to change a password,...

PT-2024-39902 · WordPress · Online Booking & Scheduling Calendar For Wordpress

Name of the Vulnerable Software and Affected Versions: The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress versions up to, and including, 4.5.1 Description: The issue is related to a missing capability check on the vcita save user data callback function, allowing...

PT-2024-16308 · WordPress · 3Dprint Lite

Name of the Vulnerable Software and Affected Versions: 3DPrint Lite WordPress plugin versions prior to 2.1 Description: The issue is related to a lack of CSRF check when updating settings in the 3DPrint Lite WordPress plugin. This could allow attackers to make a logged-in admin change settings vi...

PT-2024-35939 · Elementor · The Plus Addons For Elementor Page Builder

Name of the Vulnerable Software and Affected Versions: The Plus Addons for Elementor Page Builder Lite versions through 5.6.14 Description: The issue is related to improper neutralization of input during web page generation, which allows for DOM-Based XSS. This means that an attacker could...