PT-2024-17480

Name of the Vulnerable Software and Affected Versions The Easy Social Feed WordPress plugin versions prior to 6.5.6 Description The issue is related to the plugin not validating and escaping some of its shortcode attributes before outputting them back in the page. This could allow users with a ro...

PT-2024-28086

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.37 Description The issue is related to the Linux kernel, specifically in the fs/ntfs3 module, where the folio pointer can be NULL if the bmap function is called. This can potentially lead to issues within the...

PT-2024-3745 · Oracle · Oracle E-Business Suite

Name of the Vulnerable Software and Affected Versions: Oracle E-Business Suite versions 12.2.3 through 12.2.13 Description: The issue is related to insufficient input validation in the LOV component of Oracle Complex Maintenance, Repair, and Overhaul. This easily exploitable vulnerability allows ...

PT-2024-15877 · WordPress · Coreactivity

Name of the Vulnerable Software and Affected Versions: coreActivity: Activity Logging plugin for WordPress versions prior to 2.1 Description: The issue allows users to spoof IP addresses by providing an arbitrary value via headers such as X-FORWARDED, which are used to log IP addresses of request...

PT-2024-21203 · Skymoon · Skymoonlabs Moveto

Name of the Vulnerable Software and Affected Versions: Skymoon Labs MoveTo versions n/a through 6.2 Description: The issue is related to a Missing Authorization vulnerability. This vulnerability affects Skymoon Labs MoveTo, allowing unauthorized access. Recommendations: For versions n/a through...

PT-2024-4881

Name of the Vulnerable Software and Affected Versions: Oracle Java SE versions 8u401, 8u401-perf, 11.0.22 Oracle GraalVM Enterprise Edition versions 20.3.13, 21.3.9 Description: The issue is related to insufficient input validation in the Concurrency component of Oracle Java SE and Oracle GraalVM...

PT-2024-24428 · Unknown · Epc Ez Form Calculator

Name of the Vulnerable Software and Affected Versions: EZ Form Calculator versions n/a through 2.14.0.3 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables potential attackers to...

PT-2024-24433 · Kaizencoders · Kaizencoders Short Url

Name of the Vulnerable Software and Affected Versions: KaizenCoders Short URL versions n/a through 1.6.8 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables potential attackers t...

PT-2024-26298 · Jfrog · Jfrog Artifactory

Name of the Vulnerable Software and Affected Versions: JFrog Artifactory Self-Hosted versions prior to 7.77.3 Description: The issue allows a low-privileged authenticated user to disclose sensitive information by reading the proxy configuration. This does not affect JFrog cloud deployments...

PT-2024-24421 · Unknown · Markus Seyer Find Duplicates

Name of the Vulnerable Software and Affected Versions: Markus Seyer Find Duplicates versions 1.4.6 and earlier Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for potential exploitation by...

PT-2024-24422

Name of the Vulnerable Software and Affected Versions Realtyna Organic IDX plugin versions through 4.14.4 Description The issue is related to an Improper Neutralization of Special Elements used in an SQL Command, also known as 'SQL Injection'. This allows for potential exploitation by injecting...

PT-2024-17414 · WordPress · Meta Box

Name of the Vulnerable Software and Affected Versions: Meta Box WordPress plugin versions prior to 5.9.4 Description: The issue allows users with at least the contributor role to access arbitrary custom fields assigned to other user's posts. Recommendations: For versions prior to 5.9.4, update to...

PT-2024-18278 · WordPress · Nps Computy Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: NPS computy WordPress plugin versions 2.7.5 and earlier Description: The issue concerns the lack of CSRF checks in certain areas of the plugin, which could allow attackers to make logged-in users perform unwanted actions via CSRF attacks...

PT-2024-24611 · Tcpdf +1 · Tcpdf +1

Name of the Vulnerable Software and Affected Versions: TCPDF versions prior to 6.7.4 Description: The issue is related to how TCPDF handles calls that use HTML syntax. This mishandling can potentially lead to security issues. Recommendations: For versions prior to 6.7.4, update to version 6.7.4 o...

PT-2024-15226 · WordPress · Everest Backup

Name of the Vulnerable Software and Affected Versions: The Everest Backup WordPress plugin versions prior to 2.2.5 Description: The issue allows high privilege users, such as admins, to upload arbitrary files on the server, even when they should not be allowed to, for example in a multisite setup...

PT-2024-3030 · Php +1 · Php +1

Name of the Vulnerable Software and Affected Versions: PHP versions 8.3.0 through 8.3.4 Description: The issue is related to the function mb encode mimeheader in PHP, which can run endlessly for certain inputs containing long strings of non-space characters followed by a space. This could lead to...

PT-2024-2756

Name of the Vulnerable Software and Affected Versions mysql2 versions prior to 3.9.4 Description The issue is related to the readCodeFor function in the mysql2 package, which is vulnerable to Remote Code Execution RCE due to improper validation of the supportBigNumbers and bigNumberStrings values...

PT-2024-24034 · Unknown · Popup Like Box

Name of the Vulnerable Software and Affected Versions: Popup Like box versions 3.7.2 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for stored cross-site scripting XSS. This means that an attacker can inject malicious...

PT-2024-18922 · Mysql2 · Mysql2

Name of the Vulnerable Software and Affected Versions: mysql2 versions prior to 3.9.3 Description: The issue is related to Improper Input Validation through the keyFromFields function, resulting in cache poisoning. An attacker can inject a colon : character within a value of the attacker-crafted...

PT-2024-20044 · S/Notify · S/Notify

Name of the Vulnerable Software and Affected Versions: S/Notify versions prior to 4.0.0 for Confluence Description: A Cross Site Scripting XSS issue exists in the S/MIME certificate upload functionality of the User Profile pages, allowing attackers to manipulate user data via specially crafted...