PT-2024-7088

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 130.0.6723.58 Microsoft Edge affected versions not specified Description The issue is related to an inappropriate implementation in WebAuthentication, allowing a local attacker to perform privilege escalation vi...

PT-2024-39556 · E2Nest · E2Nest

Name of the Vulnerable Software and Affected Versions: E2Nest versions prior to commit 8a41948e553c89c56b14410c6ed395e9cfb9250a Description: A path traversal issue exists in the software. This issue allows for unauthorized access to files and directories. Recommendations: For versions prior to...

PT-2024-9620

Name of the Vulnerable Software and Affected Versions GStreamer versions prior to 1.24.10 Description The issue is related to a null dereference vulnerability in the function qtdemux parse sbgp in qtdemux.c. This vulnerability can be exploited by a remote attacker to cause a denial of service...

PT-2024-9614 · Gstreamer +7 · Gstreamer +7

Name of the Vulnerable Software and Affected Versions: GStreamer versions prior to 1.24.10 Description: A vulnerability has been discovered in the qtdemux parse container function within qtdemux.c, related to an out-of-bounds OOB read in memory. The issue arises from the parent function qtdemux...

PT-2024-6648

Name of the Vulnerable Software and Affected Versions NVIDIA Container Toolkit versions 1.16.1 and earlier Description The NVIDIA Container Toolkit contains a Time-of-check Time-of-Use TOCTOU vulnerability when used with default configuration, allowing a specifically crafted container image to ga...

PT-2024-19600 · Unknown · Openslides

Name of the Vulnerable Software and Affected Versions: OpenSlides version 4.0.15 Description: The issue is related to the use of a weak hashing algorithm for storing passwords. Recommendations: For OpenSlides version 4.0.15, update to a version that uses a secure password hashing algorithm to...

PT-2024-10158

Name of the Vulnerable Software and Affected Versions GStreamer versions prior to 1.24.10 Description A stack-buffer overflow has been detected in the vorbis handle identification packet function within gstvorbisdec.c. The position array is a stack-allocated buffer of size 64. If vd-vi.channels...

PT-2024-32372 · Unknown · Rocket.Chat

Name of the Vulnerable Software and Affected Versions: Rocket.Chat versions 6.12.0 and earlier Description: The issue allows stored XSS in the description and release notes of the marketplace and private apps. Recommendations: For Rocket.Chat versions 6.12.0 and earlier, update to a version that...

PT-2024-8655 · Zimbra · Zimbra Collaboration

Name of the Vulnerable Software and Affected Versions: Zimbra Collaboration ZCS versions through 10.1 Description: A reflected Cross-Site Scripting XSS issue exists in the Briefcase module due to improper sanitization of file content by the OnlyOffice formatter. This occurs when the victim opens ...

PT-2024-31477 · Zimbra · Zimbra Administration Panel +2

Name of the Vulnerable Software and Affected Versions: Zimbra Collaboration ZCS versions 9.0 through 10.0 Description: A vulnerability in the Webmail Modern UI of Zimbra Collaboration allows execution of stored Cross-Site Scripting XSS payloads. An attacker with administrative access to the Zimbr...

PT-2024-7666 · Mitel · Mitel Micollab

Name of the Vulnerable Software and Affected Versions: Mitel MiCollab versions through 9.8 SP1 FP2 9.8.1.201 Description: The issue is related to insufficient sanitization of user input in the AWV Audio, Web and Video Conferencing component, allowing an unauthenticated attacker to conduct a SQL...

CVE-2024-46984 XML External Entity Reference (XXE) vulnerability can lead to a Server Side Request Forgery attack in gematik app-referencevalidator

The reference validator is a tool to perform advanced validation of FHIR resources for TI applications and interoperability standards. The profile location routine in the referencevalidator commons package is vulnerable to XML External Entities attack due to insecure defaults of the used Woodstox...

PT-2024-9698 · Microsoft +5 · Edge +5

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 131.0.6778.204 Microsoft Edge affected versions not specified Description: A use after free issue in the Compositing component of Google Chrome and Microsoft Edge could allow a remote attacker to potentially...

PT-2024-35: Automatic explicit deep link assignment in Android Jetpack Navigation Library

The vulnerability was identified in Android Jetpack Navigation Library in versions 2.8.1. The discovered vulnerability allows an attacker, using automatically assigned explicit deep links, to open arbitrary screens in the application and pass them arbitrary parameters Vulnerability status:...

PT-2024-32159 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.6.52 Description: The issue is related to a double put of @cfile in smb2 rename path. When smb2 set path attr is called with a valid @cfile and returns -EINVAL, it is necessary to call cifs get writable path...

PT-2024-30916 · WordPress · Gutenberg Blocks – Unlimited Blocks For Gutenberg

Name of the Vulnerable Software and Affected Versions: Gutenberg Blocks – Unlimited blocks For Gutenberg versions 1.2.7 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS...

PT-2024-6334 · Winzip · Winzip

Name of the Vulnerable Software and Affected Versions: WinZip versions prior to 29.0 Description: The issue is related to a Mark-of-the-Web Bypass Vulnerability in WinZip, allowing remote attackers to bypass the Mark-of-the-Web protection mechanism. This can be exploited when a user opens a...

PT-2024-7486 · WordPress · Relevanssi

Name of the Vulnerable Software and Affected Versions: Relevanssi WordPress plugin versions prior to 4.23.1 Description: The issue allows for Stored XSS attacks by embedding malicious scripts, potentially leading to account takeover. This can be exploited by a remote attacker to perform cross-sit...

PT-2024-31009 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 14.7.1 macOS versions prior to 15 Description: This issue is related to improved validation of symlinks. An app may be able to access sensitive user data due to a TOCTOU vulnerability in macOS's diskarbitrationd,...

PT-2024-8195 · Artifex +8 · Artifex Ghostscript +8

Name of the Vulnerable Software and Affected Versions: Artifex Ghostscript versions prior to 10.04.0 Description: An issue in the psi/zfile.c component of Artifex Ghostscript is related to out-of-bounds data access in the filenameforall function, which can lead to arbitrary code execution. This...