PT-2024-36829 · Tcpdf +2 · Tcpdf +2

Name of the Vulnerable Software and Affected Versions: tc-lib-pdf-font versions prior to 2.6.4 TCPDF versions prior to 6.8.0 Description: The issue is related to the mishandling of fonts, specifically the misparsing of FontBBox for Type 1 and TrueType fonts. This problem affects the management of...

PT-2024-65: Unauthorized Reflected XSS in PhpSpreadsheet (Accounting.php)

The vulnerability was identified in PhpSpreadsheet, versions = 3.0.0, = 2.0.0, = 2.2.0, = 3.0.0, = 2.0.0, = 2.2.0, = 2.3.4 to 2.3.5 or higher Additional information: Security advisory Researcher: Aleksey Solovev Positive Technologies...

PT-2024-68: Cross-Site Scripting (XSS) in the HTML page header in PhpSpreadsheet

The vulnerability was identified in PhpSpreadsheet, versions = 3.0.0, = 2.0.0, = 2.2.0, = 3.0.0, = 2.0.0, = 2.2.0, = 2.3.4 to 2.3.5 or higher Additional information: Researcher: Aleksey Solovev Positive Technologies...

PT-2024-69: Cross-Site Scripting (XSS) in custom properties in PhpSpreadsheet

The vulnerability was identified in PhpSpreadsheet, versions = 3.0.0, = 2.0.0, = 2.2.0, = 3.0.0, = 2.0.0, = 2.2.0, = 2.3.4 to 2.3.5 or higher Additional information: Security advisory Researcher: Aleksey Solovev Positive Technologies...

PT-2025-19714

Name of the Vulnerable Software and Affected Versions Output Messenger versions prior to 2.0.63 Description Output Messenger is affected by a directory traversal issue caused by improper file path handling. Remote attackers can use ../ sequences in parameters to access sensitive files outside the...

PT-2024-10252 · Oracle +6 · Mysql Server +5

Name of the Vulnerable Software and Affected Versions: MySQL Server versions 8.0.39 and prior MySQL Server versions 8.4.2 and prior MySQL Server versions 9.0.1 and prior Description: The issue is related to insufficient input validation in the Server: Optimizer component of Oracle MySQL Server...

PT-2024-10245

Name of the Vulnerable Software and Affected Versions MySQL Server versions 8.0.40 and prior MySQL Server versions 8.4.3 and prior MySQL Server versions 9.1.0 and prior Description The vulnerability in the MySQL Server product of Oracle MySQL, specifically in the InnoDB component, is related to...

PT-2024-10247 · Oracle +6 · Mysql Server +5

Name of the Vulnerable Software and Affected Versions: MySQL Server versions 8.0.39 and prior MySQL Server versions 8.4.2 and prior MySQL Server versions 9.0.1 and prior Description: The issue allows a high-privileged attacker with network access via multiple protocols to compromise MySQL Server...

PT-2024-10261 · Oracle +8 · Mysql Server +7

Name of the Vulnerable Software and Affected Versions: MySQL Server versions 8.0.40 and prior MySQL Server versions 8.4.3 and prior MySQL Server versions 9.1.0 and prior Description: The issue is related to an unbounded resource allocation in the MySQL Server product, specifically in the Server:...

PT-2025-25327 · Oracle +2 · Oracle +2

Name of the Vulnerable Software and Affected Versions: XWiki versions prior to 15.10.16 XWiki versions prior to 16.4.7 XWiki versions prior to 16.10.2 Description: The issue allows execution of any SQL query in Oracle using functions like DBMS XMLGEN or DBMS XMLQUERY. This is due to the XWiki que...

PT-2024-17289 · WordPress · Tithe.Ly Giving Button

Name of the Vulnerable Software and Affected Versions: Tithe.ly Giving Button WordPress plugin versions 1.1 and earlier Description: The issue concerns a Stored Cross-Site Scripting vulnerability. It arises because the plugin does not validate and escape some of its shortcode attributes before...

PT-2024-16651 · WordPress · Image Widget

Name of the Vulnerable Software and Affected Versions: Image Widget WordPress plugin versions prior to 4.4.11 Description: The issue concerns the Image Widget WordPress plugin, where certain settings of its Image Widget are not properly sanitized and escaped. This could allow high-privilege users...

PT-2025-3053 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 13.7.2 macOS versions prior to 14.7.2 macOS versions prior to 15.2 Description: The issue is related to a lack of protection for sensitive data, which may allow an application to access protected user data. This proble...

PT-2024-36026 · Parasolid · Parasolid

Name of the Vulnerable Software and Affected Versions: Parasolid versions prior to V36.1.225 Parasolid versions prior to V37.0.173 Parasolid versions prior to V37.1.1 Description: A vulnerability has been identified in the affected application, which contains an out of bounds write past the end o...

PT-2024-10221 · Document Foundation +5 · Libreoffice +5

Name of the Vulnerable Software and Affected Versions: LibreOffice versions 24.8 through 24.8.3 Description: The issue is related to the exposure of environmental variables and arbitrary INI file values to an unauthorized actor. URLs could be constructed to expand these variables, potentially...

PT-2024-36981

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.12.0-rc6-00077-g2e1b3cc9d7f7 Description A problem in the Linux kernel has been fixed, specifically with the vGPIO driver, which would crash during bootup. The crash was caused by an unauthorized modification o...

PT-2024-36072 · Unknown · Winter Cms

Name of the Vulnerable Software and Affected Versions: Winter CMS versions prior to 1.2.7 Winter CMS versions prior to 1.1.11 Winter CMS versions prior to 1.0.476 Description: The issue allows users with access to the CMS templates sections that modify Twig files to bypass the sandbox placed on...

PT-2024-35142 · Tenda · Tenda Ac6V2

Name of the Vulnerable Software and Affected Versions: Tenda AC6V2 versions through 15.03.06.50 Description: The issue is a stack-based buffer overflow vulnerability in the fromAdvSetLanip module, specifically with the lanMask argument, allowing buffer overflows. This problem affects Tenda AC6V2...

PT-2024-33531 · Gaminghub · Gaminghub

Name of the Vulnerable Software and Affected Versions: GamingHub versions prior to 6.1.04.6 in Korea GamingHub versions prior to 7.1.03.7 in Global Description: The issue is related to the improper handling of responses in GamingHub, allowing remote attackers to launch arbitrary activity...

PT-2024-33532 · Google · Android 12 +2

Name of the Vulnerable Software and Affected Versions: Quick Share Agent versions prior to 3.5.14.47 in Android 12 Quick Share Agent versions prior to 3.5.19.41 in Android 13 Quick Share Agent versions prior to 3.5.19.42 in Android 14 Description: The issue allows adjacent attackers to write file...