PT-2024-15225 · WordPress · Eventon

Name of the Vulnerable Software and Affected Versions: EventON WordPress plugin versions prior to 4.4.1 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back in the page. This...

PT-2024-14923 · WordPress · Woostify Sites Library

Name of the Vulnerable Software and Affected Versions: Woostify Sites Library WordPress plugin versions prior to 1.4.8 Description: The issue concerns a lack of authorization in an AJAX action, allowing any authenticated users to update arbitrary blog options and set them to 'activated'. This cou...

PT-2024-7923

Name of the Vulnerable Software and Affected Versions braces versions prior to 3.0.3 Description The issue is related to uncontrolled resource consumption. If a malicious user sends "imbalanced braces" as input, the parsing will enter a loop, causing the program to allocate heap memory without...

PT-2025-31024 · Snow · Snow

Name of the Vulnerable Software and Affected Versions: snow crate versions prior to 0.9.5 Description: The snow crate, when using stateful TransportState, allows incrementing a nonce, potentially leading to denial of message delivery. Recommendations: Update to snow crate version 0.9.5 or later...

PT-2024-19862 · Fusionpbx · Fusionpbx

Name of the Vulnerable Software and Affected Versions: FusionPBX versions prior to 5.1.0 Description: The issue allows a remote authenticated attacker with administrative privileges to execute an arbitrary script on the web browser of the user logging in to the product. This is achieved through a...

PT-2024-19409 · Vyper · Vyper

Name of the Vulnerable Software and Affected Versions: Vyper versions 0.3.0 through 0.3.9 Description: The concat built-in can write over the bounds of the memory buffer that was allocated for it and thus overwrite existing valid data. The root cause is that the build IR for concat doesn't proper...

PT-2024-3204

Name of the Vulnerable Software and Affected Versions Oracle Java SE versions 8u401, 8u401-perf, 11.0.22, 17.0.10, 21.0.2, 22 Oracle GraalVM for JDK versions 17.0.10, 21.0.2, 22 Oracle GraalVM Enterprise Edition versions 20.3.13, 21.3.9 Description The issue is related to a buffer overflow in...

PT-2024-11651 · WordPress · Wp Job Portal

Name of the Vulnerable Software and Affected Versions: WP Job Portal – A Complete Job Board versions n/a through 2.0.1 Description: The issue is related to a Missing Authorization vulnerability in WP Job Portal. This vulnerability affects the WP Job Portal – A Complete Job Board plugin...

PT-2024-14933 · Hypr · Hypr Workforce Access

Name of the Vulnerable Software and Affected Versions: HYPR Workforce Access versions prior to 8.7 Description: The issue is related to an Improper Link Resolution Before File Access, also known as 'Link Following', which allows User-Controlled Filename. This affects HYPR Workforce Access on MacO...

PT-2024-11612 · WordPress · Embedsocial Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Seed Social WordPress plugin versions prior to 2.0.4 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for example, in a...

PT-2024-14843 · WordPress · The Royal Elementor Addons/Templates

Name of the Vulnerable Software and Affected Versions: The Royal Elementor Addons and Templates WordPress plugin versions prior to 1.3.81 Description: The issue allows unauthenticated users to access arbitrary draft, private, and password-protected posts/pages content. This is due to the plugin n...

PT-2024-11920 · WordPress · Givewp

Name of the Vulnerable Software and Affected Versions: GiveWP WordPress plugin versions prior to 2.24.1 Description: The issue concerns the improper escaping of user input before it reaches SQL queries, potentially allowing unauthenticated attackers to perform SQL Injection attacks...

PT-2024-14861 · WordPress · Eventon

Name of the Vulnerable Software and Affected Versions: EventON WordPress plugin versions prior to 2.2 Description: The issue allows high privilege users, such as admin, to perform Stored HTML Injection attacks even when the unfiltered html capability is disallowed, due to the plugin not sanitizin...

PT-2024-11511 · WordPress · Wp-Invoice

Name of the Vulnerable Software and Affected Versions: WP-Invoice WordPress plugin versions 4.3.1 and earlier Description: The issue is related to the lack of CSRF check when updating settings and insufficient sanitization and escaping in some settings, allowing an attacker to make a logged-in...

Stable Channel Update for ChromeOS / ChromeOS Flex

Hello All, The Stable channel is being updated to 120.0.6099.235 Platform version: 15662.76.0 for ChromeOS devices and will be rolled out over the next few days. If you find new issues, please let us know one of the following ways: File a bug Visit our Chrome OS communities General: Chromebook He...

PT-2024-1269 · Hitachi · Hitachi Device Manager

Name of the Vulnerable Software and Affected Versions: Hitachi Device Manager versions prior to 8.8.5-04 Description: The issue is related to insufficient protection of password input fields in the Device Manager Agent component of the Hitachi Device Manager system. This could allow a remote...

PT-2024-13540 · Alinto +2 · Alinto Sogo +2

Name of the Vulnerable Software and Affected Versions: Alinto SOGo versions 5.8.0 through 5.9.0 Description: The issue is related to HTML Injection. There is no information provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was...

PT-2024-14894 · WordPress · Wp Crowdfunding

Name of the Vulnerable Software and Affected Versions: WP Crowdfunding WordPress plugin versions prior to 2.1.10 Description: The issue concerns the WP Crowdfunding WordPress plugin, which does not properly sanitise and escape some of its settings. This could allow high-privilege users, such as...

PT-2024-19277 · Edx · Open Edx Platform

Name of the Vulnerable Software and Affected Versions: Open edX Platform versions prior to the version containing commit 019888f Description: The issue affects the Open edX Platform, a service-oriented platform for authoring and delivering online learning. A user with a JWT and limited scopes cou...

PT-2024-14981 · WordPress · The User Profile Builder – Beautiful User Registration Forms

Name of the Vulnerable Software and Affected Versions: The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress versions up to, and including, 3.10.7 Description: The issue is related to unauthorized access of data due to a missing...