PT-2024-3833

Name of the Vulnerable Software and Affected Versions python-idna version 3.6 Description The issue arises from the idna.encode function's handling of crafted input strings, which can lead to quadratic complexity and consequently, a denial of service condition. This is triggered by a crafted inpu...

PT-2024-20044 · S/Notify · S/Notify

Name of the Vulnerable Software and Affected Versions: S/Notify versions prior to 4.0.0 for Confluence Description: A Cross Site Scripting XSS issue exists in the S/MIME certificate upload functionality of the User Profile pages, allowing attackers to manipulate user data via specially crafted...

System Management Module (SMM v1 and v2) and Fan Power Controller (FPC) Vulnerabilities - Lenovo Support US

No description provided...

PT-2024-20323 · Canimaan Software · Clamav

Name of the Vulnerable Software and Affected Versions: Canimaan Software LTD ClamXAV versions 3.1.2 through 3.6.1 Description: An issue in Canimaan Software LTD ClamXAV allows a local attacker to escalate privileges via the ClamXAV helper tool component. Recommendations: For versions 3.1.2 throug...

PT-2024-20321 · WordPress · Userswp

Name of the Vulnerable Software and Affected Versions: UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress versions up to, and including, 1.2.6 Description: The issue arises from insufficient input sanitization and output escaping on...

PT-2024-21772 · Zoom · Zoom Desktop Client For Linux

Name of the Vulnerable Software and Affected Versions: Zoom Desktop Client for Linux versions prior to 5.17.10 Description: The issue allows an authenticated user to conduct a denial of service via network access. This is due to cross-site scripting in the Zoom Desktop Client for Linux...

PT-2024-21773 · Zoom · Zoom Desktop Client For Macos

Name of the Vulnerable Software and Affected Versions: Zoom Desktop Client for macOS versions prior to 5.17.10 Description: The issue is related to improper privilege management in the installer, which may allow a privileged user to conduct an escalation of privilege via local access...

PT-2024-19889 · WordPress · Gum Elementor Addon

Name of the Vulnerable Software and Affected Versions: Gum Elementor Addon plugin for WordPress versions up to, and including, 1.3.2 Description: The issue is related to Stored Cross-Site Scripting via the Post Meta widget due to insufficient input sanitization and output escaping. This allows...

PT-2024-18487 · Kadence Blocks · The Gutenberg Blocks By Kadence Blocks

Name of the Vulnerable Software and Affected Versions: The Gutenberg Blocks by Kadence Blocks – Page Builder Features plugin for WordPress versions prior to 3.2.26 Description: The issue is related to Stored Cross-Site Scripting via the Testimonial Widget's anchor style parameter due to...

PT-2024-15147 · WordPress · The Pods – Custom Content Types/Fields

Name of the Vulnerable Software and Affected Versions: The Pods – Custom Content Types and Fields plugin for WordPress versions prior to 3.0.11, excluding versions 2.7.31.2, 2.8.23.2, and 2.9.19.2. Description: The issue is related to Missing Authorization, which allows authenticated attackers wi...

PT-2024-18360 · WordPress · Wp Customer Reviews

Name of the Vulnerable Software and Affected Versions: WP Customer Reviews versions prior to 3.7.1 Description: The issue concerns the WP Customer Reviews WordPress plugin, where a parameter is not validated, allowing contributor and above users to redirect a page to a malicious URL. This poses a...

PT-2024-3290 · WordPress · Herd Effects

Name of the Vulnerable Software and Affected Versions: Herd Effects WordPress plugin versions prior to 5.2.7 Description: The issue is related to a lack of CSRF checks in some bulk actions of the Herd Effects WordPress plugin, which could allow attackers to make logged-in admins perform unwanted...

PT-2024-18452 · WordPress · Wpb Show Core

Name of the Vulnerable Software and Affected Versions: WPB Show Core WordPress plugin versions prior to 2.7 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back in the page...

PT-2024-23934 · Unknown · Rapidload Power-Up For Autoptimize

Name of the Vulnerable Software and Affected Versions: RapidLoad Power-Up for Autoptimize versions 2.2.11 and earlier Description: The issue is a Server-Side Request Forgery SSRF vulnerability. This means an attacker can potentially trick the server into making unauthorized requests, leading to...

PT-2024-23926

Name of the Vulnerable Software and Affected Versions Church Admin versions n/a through 4.1.5 Description The issue is related to an Unrestricted Upload of File with Dangerous Type vulnerability in Andy Moyle Church Admin. This allows for the upload of files with potentially dangerous types, whic...

PT-2024-23938 · Metagauss · Metagauss Profilegrid

Name of the Vulnerable Software and Affected Versions: Metagauss ProfileGrid versions through 5.7.6 Description: The issue is related to an Authorization Bypass Through User-Controlled Key vulnerability. This allows for potential unauthorized access. Recommendations: For versions through 5.7.6,...

PT-2024-10791 · Unknown · Zoneminder

Name of the Vulnerable Software and Affected Versions: ZoneMinder versions prior to 1.34.21 Description: The issue allows remote attackers to execute arbitrary code, escalate privileges, and obtain sensitive information via the PHP SELF component in the classic/views/download.php file. This is a...

PT-2024-22921

Name of the Vulnerable Software and Affected Versions Dolibarr ERP CRM versions up to 19.0.0 Description The issue is related to a lack of sanitization during the installation process, allowing an attacker with adjacent access to the network to execute arbitrary code via a specifically crafted...

PT-2024-23220 · Mbed Tls · Mbed Tls

Name of the Vulnerable Software and Affected Versions: Mbed TLS versions 3.3.0 through 3.5.2 Description: A malicious client can cause information disclosure or a denial of service due to a stack buffer over-read in a TLS 1.3 server via a TLS 3.1 ClientHello. This occurs because of a buffer...

PT-2024-4250

Name of the Vulnerable Software and Affected Versions Pillow versions prior to 10.3.0 Description A buffer overflow exists in the imagingcms.c file of the Pillow library due to the use of strcpy instead of strncpy. This issue can allow an attacker to impact the confidentiality, integrity, and...