Security Bulletin: IBM Aspera Faspex is vulnerable to exposing data improperly (CVE-2022-22497)

Summary IBM Aspera Faspex may be vulnerable to exposing data improperly CVE-2022-22497 due to an incorrectly computed security token. Vulnerability Details CVEID:CVE-2022-2497 DESCRIPTION: GitLab Community Edition and GitLab Enterprise Edition could allow a remote authenticated attacker to obtain...

PT-2024-39894 · WordPress · Miniorange Otp Verification With Firebase

Name of the Vulnerable Software and Affected Versions: Miniorange OTP Verification with Firebase plugin for WordPress versions up to, and including, 3.6.0 Description: The issue allows unauthenticated attackers to change user passwords and potentially take over administrator accounts due to the...

PT-2024-10574

Name of the Vulnerable Software and Affected Versions MainWP Dashboard – The Private WordPress Manager for Multiple Website Maintenance plugin for WordPress versions up to, and including, 3.1.2 Description The issue is related to Stored Cross-Site Scripting, which occurs due to insufficient input...

PT-2024-10850 · Motopress · The Timetable/Event Schedule By Motopress

Name of the Vulnerable Software and Affected Versions: The Timetable and Event Schedule by MotoPress plugin for WordPress versions up to, and including, 2.3.8 Description: The issue is related to a missing capability check on the wp ajax route url function called via a nopriv AJAX action. This...

PT-2024-39736 · WordPress · Kama Spamblock

Name of the Vulnerable Software and Affected Versions: Kama SpamBlock plugin for WordPress versions up to, and including, 1.8.2 Description: The issue is related to Reflected Cross-Site Scripting via $ POST values due to insufficient input sanitization and output escaping. This allows...

PT-2024-11040 · Woobewoo · Woobewoo Product Filter

Name of the Vulnerable Software and Affected Versions: Product Filter by WooBeWoo plugin for WordPress versions up to, and including 1.4.9 Description: The issue is related to authorization bypass due to missing authorization checks on various functions, allowing unauthenticated attackers to...

PT-2024-39691 · WordPress · Slimstat Analytics

Name of the Vulnerable Software and Affected Versions: SlimStat Analytics plugin for WordPress versions up to, and including, 5.2.6 Description: The issue is related to Stored Cross-Site Scripting via the resource parameter due to insufficient input sanitization and output escaping when logging...

Medium: amazon-ecr-credential-helper

Issue Overview: The various Is methods IsPrivate, IsLoopback, etc did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms. CVE-2024-24790 Affected Packages: amazon-ecr-credential-helper Issue Correction: Run dn...

PT-2024-38379 · WordPress · Forms For Mailchimp By Optin Cat

Name of the Vulnerable Software and Affected Versions: The Forms for Mailchimp by Optin Cat – Grow Your MailChimp List plugin for WordPress versions up to, and including, 2.5.6 Description: The issue is related to Stored Cross-Site Scripting via the form color parameters due to insufficient input...

PT-2024-39388 · WordPress · Wordpress File Upload

Name of the Vulnerable Software and Affected Versions: WordPress File Upload plugin versions up to, and including, 4.24.11 Description: The WordPress File Upload plugin is vulnerable to Path Traversal via the wfu file downloader.php file. This allows unauthenticated attackers to read or delete...

PT-2024-32959 · Tainacan · Tainacan

Name of the Vulnerable Software and Affected Versions: Tainacan versions 0.21.8 and earlier Description: The issue is related to an SQL Injection vulnerability due to the improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks. Recommendations: Fo...

PT-2024-31: Reflected Cross-Site Scripting (Reflected XSS) in Passwork

The vulnerability was identified in Passwork version 6.4.0. The application does not process the data received from the user, which is necessary for safety use during web page formation. An attacker can inject a malicious script into the request parameters and conduct social engineering attack on...

PT-2025-2097 · Drupal · Drupal

Name of the Vulnerable Software and Affected Versions: Drupal Block permissions versions 1.0.0 through 1.2.0 Description: The issue is related to an incorrect authorization mechanism in the Block permissions module of the Drupal CMS system. This can allow a remote attacker to impact the...

PT-2024-38619 · Progress · Telerik Reporting

Name of the Vulnerable Software and Affected Versions: In Progress Telerik Reporting versions prior to 2024 Q3 18.2.24.924 Description: A command injection attack is possible through improper neutralization of hyperlink elements. This issue arises due to the improper handling of hyperlink element...

PT-2024-32: Stored Cross-Site Scripting (Stored XSS) in Passwork

The vulnerability was identified in Passwork version 6.4.0. The application does not process the data received from the user, which is necessary for safety use during web page formation. Discovered vulnerability allows an attacker to execute arbitrary JavaScript code in victim's browser...

PT-2024-29: Path Traversal in Passwork

The vulnerability was identified in Passwork version 6.4.0. The discovered vulnerability can be exploited by an attacker to gain access to local files and directories on the server, which are not avaliable by the logic of the application. Vulnerability status: Confirmed by vendor Date of...

PT-2024-34: Server Side Request Forgery (SSRF) in Passwork

The vulnerability was identified in Passwork version 6.4.0. The discovered vulnerability can be exploited by an attacker to send requests to both external nodes and servers with limited access, which leads to disclosure of sentisive data, denial of service, etc. Also, exploitation of the...

Vulnerabilities fixed in Microsoft Office

Microsoft has fixed vulnerabilities in Office components. A malicious person could exploit the vulnerabilities to execute arbitrary code with the victim's privileges, potentially gaining access to sensitive data in the victim's context. Successful exploitation requires the malicious party to tric...

Intel® TDX Module Software Advisory

Summary: A potential security vulnerability in Intel® Trust Domain Extensions TDX Module firmware may allow information disclosure. Intel is releasing firmware updates to mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2024-27457 Description: Improper check for unusual or...

PT-2025-11523 · Dell · Os10

Name of the Vulnerable Software and Affected Versions: Dell SmartFabric OS10 Software versions 10.5.4.x through 10.6.0.x Description: The issue is related to an Improper Neutralization of Special Elements used in a Command, also known as 'Command Injection'. This could allow a high privileged...