PT-2024-16245 · WordPress · Download Monitor

Name of the Vulnerable Software and Affected Versions: Download Monitor plugin for WordPress versions up to, and including, 5.0.13 Description: The issue is related to a missing capability check on the ajax search users function, allowing authenticated attackers with Subscriber-level access and...

PT-2024-16124 · WordPress · Wp Team – Wordpress Team Member Plugin

Name of the Vulnerable Software and Affected Versions: WP Team – WordPress Team Member Plugin versions up to, and including, 1.1.4 Description: The issue is related to Stored Cross-Site Scripting via the plugin's htteamember shortcode due to insufficient input sanitization and output escaping on...

PT-2024-34195 · Wp Overnight · Woocommerce Pdf Invoices & Packing Slips

Name of the Vulnerable Software and Affected Versions: WooCommerce PDF Invoices & Packing Slips versions 3.8.6 and earlier Description: The issue is related to a Missing Authorization vulnerability in WP Overnight WooCommerce PDF Invoices & Packing Slips, which allows exploiting incorrectly...

PT-2024-33271

Name of the Vulnerable Software and Affected Versions Kyverno versions prior to 1.13.0 Description A kyverno ClusterPolicy can be overridden by the creation of a PolicyException in a random namespace. By design, PolicyExceptions are consumed from any namespace, which may allow users with privileg...

PT-2024-34196 · Cloudways · Cloudways Breeze

Name of the Vulnerable Software and Affected Versions: Cloudways Breeze versions 2.1.14 and earlier Description: The issue is related to a Missing Authorization vulnerability in Cloudways Breeze, which allows exploitation due to incorrectly configured access control security levels...

PT-2024-34180 · Unknown · Namaste! Lms

Name of the Vulnerable Software and Affected Versions: Namaste! LMS versions through 2.6.2 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Reflected XSS attacks. Recommendations: For versions...

PT-2024-16096 · WordPress · Newsletters

Name of the Vulnerable Software and Affected Versions: Newsletters plugin for WordPress versions up to, and including, 4.9.9.4 Description: The issue is related to Stored Cross-Site Scripting via the plugin's newsletters video shortcode due to insufficient input sanitization and output escaping o...

PT-2024-34184 · Unknown · Namaste! Lms

Name of the Vulnerable Software and Affected Versions: Namaste! LMS versions through 2.6.4 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS attacks. Recommendations: For versions...

PT-2024-7627 · Google +5 · Google Chrome +5

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 130.0.6723.92 Microsoft Edge versions prior to the fixed version affected versions not specified Description: The issue is related to a use-after-free vulnerability in the implementation of WebRTC technology in...

Internet Bug Bounty: CVE-2024-49761: ReDoS vulnerability in REXML

CVE-2024-49761 was a ReDoS vulnerability in the REXML gem. The vulnerability was caused by the parsing of XML input with many digits between "&" and "x...;" in a hex numeric character reference. This issue was resolved by updating the REXML gem to version 3.3.9 or later...

PT-2024-31116 · Apple · Macos Sequoia +1

Name of the Vulnerable Software and Affected Versions: macOS Sequoia versions prior to 15.1 Description: A privacy issue was addressed by improving private data redaction for log entries. This allows a user to potentially view sensitive user information. The issue was fixed in macOS Sequoia 15.1...

PT-2024-34236 · Unknown · Firelight Lightbox

Name of the Vulnerable Software and Affected Versions: Firelight Lightbox versions 2.3.3 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS attacks. Recommendations: For...

PT-2024-31099 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 13.7.1 macOS versions prior to 14.7.1 Description: The issue allows a malicious application to modify protected parts of the file system. This was addressed with improved checks. Recommendations: For macOS versions pri...

Fedora 40 : chromium (2024-f1117faa03)

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-f1117faa03 advisory. update to 130.0.6723.69 High CVE-2024-10229: Inappropriate implementation in Extensions High CVE-2024-10230: Type Confusion in V8 High CVE-2024-1023...

Fedora 40 : edk2 (2024-45df72afc6)

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-45df72afc6 advisory. Security fix for CVE-2023-6237 openssl: Excessive time spent checking invalid RSA public keys Tenable has extracted the preceding description block directly...

Huawei EulerOS: Security Advisory for emacs (EulerOS-SA-2024-2734)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS Virtualization 2.12.1 : python-pip (EulerOS-SA-2024-2760)

According to the versions of the python-pip packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : urllib3 is a user-friendly HTTP client library for Python. urllib3 previously wouldn't remove the HTTP request body when an HTT...

Fortinet Fortigate Hardcoded SSLVPN cookie encryption key (FG-IR-21-051)

The version of Fortigate installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the FG-IR-21-051 advisory. - A use of hard-coded cryptographic key vulnerability in the SSLVPN of FortiOS before 7.0.1 may allow an attacker to retrieve...

PT-2024-39733 · WordPress · Wpschoolpress

Name of the Vulnerable Software and Affected Versions: The School Management System – WPSchoolPress plugin for WordPress versions up to, and including, 2.2.10 Description: The issue is related to privilege escalation via account takeover. This occurs because the plugin does not properly validate ...

PT-2024-39702 · WordPress · Image Map Pro

Name of the Vulnerable Software and Affected Versions: Image Map Pro plugin for WordPress versions up to, and including, 6.0.20 Description: The issue is related to Stored Cross-Site Scripting via the save project function, allowing authenticated attackers with contributor-level and above...