KLA70466 Multiple vulnerabilities in Apache HTTP Server

Multiple vulnerabilities were found in Apache HTTP Server. Malicious users can exploit these vulnerabilities to bypass security restrictions. Below is a complete list of vulnerabilities: 1. Security vulnerability in SSRF can be exploited to bypass security restrictions. 2. Security vulnerability ...

Oracle MySQL Server 8.x <= 8.0.37 Security Update (cpujul2024) - Linux

Oracle MySQL Server is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

PT-2024-26439 · Tenda · Tenda I29

Name of the Vulnerable Software and Affected Versions: Tenda i29V1.0 version 1.0.0.5 Description: The issue is related to a hardcoded password for the root user. This means that the password is embedded directly into the software, potentially allowing unauthorized access. Recommendations: For Ten...

PT-2024-4999 · Oracle +4 · Mysql Server +3

Name of the Vulnerable Software and Affected Versions: Oracle MySQL Server versions 8.0.37 and prior Oracle MySQL Server versions 8.4.0 and prior Description: The issue is related to the Server: Connection Handling component of Oracle MySQL Server, where an easily exploitable vulnerability allows...

PT-2024-5266 · Supermicro · Supermicro X11Dpg-Hgx2 +2

Name of the Vulnerable Software and Affected Versions: Supermicro X11DPG-HGX2 versions prior to BIOS firmware 4.4 Supermicro X11PDG-QT versions prior to BIOS firmware 4.4 Supermicro X11PDG-OT versions prior to BIOS firmware 4.4 Supermicro X11PDG-SN versions prior to BIOS firmware 4.4 Description:...

PT-2024-34405 · WordPress · Wp-Emember

Name of the Vulnerable Software and Affected Versions: wp-eMember WordPress plugin versions prior to 10.6.6 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back in the page...

PT-2024-36407 · WordPress · Wp Quicklatex

Name of the Vulnerable Software and Affected Versions: WP QuickLaTeX WordPress plugin versions prior to 3.8.7 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This can occur even when the unfiltered html capability is disallowed,...

PT-2024-34404 · WordPress · Wp-Emember

Name of the Vulnerable Software and Affected Versions: wp-eMember WordPress plugin versions prior to 10.6.6 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back in the page...

PT-2024-27659 · WordPress · Wp User Switch

Name of the Vulnerable Software and Affected Versions: WP User Switch versions 1.1.0 and earlier Description: The issue is related to Improper Privilege Management, which allows Privilege Escalation. Recommendations: For WP User Switch versions 1.1.0 and earlier, update to a version that contains...

Django 4.x < 4.2.14, 5.x < 5.0.7 Multiple Vulnerabilities - Windows

Django is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:djangoproject:django"; if descriptio...

PT-2024-15190 · WordPress · Advanced File Manager Shortcodes

Name of the Vulnerable Software and Affected Versions: Advanced File Manager Shortcodes plugin for WordPress versions up to, and including, 2.5.3 Description: The issue allows authenticated attackers with contributor access or above to upload arbitrary files on the affected site's server, which m...

PT-2024-27535

Name of the Vulnerable Software and Affected Versions Andy Moyle Church Admin versions n/a through 4.4.6 Description The issue allows an attacker to upload a web shell to a web server due to an unrestricted upload of file with dangerous type vulnerability. This enables potential remote code...

PT-2024-27530 · Beaver Builder · Beaver Addons Powerpack Lite

Name of the Vulnerable Software and Affected Versions: Beaver Addons PowerPack Lite for Beaver Builder versions 1.3.0.3 and earlier Description: The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as a Path Traversal vulnerability. This vulnerability...

PT-2024-37535 · WordPress · Testimonials

Name of the Vulnerable Software and Affected Versions: IQ Testimonials plugin for WordPress versions up to, and including, 2.2.7 Description: The issue is related to insufficient file type validation in the process image upload function, allowing unauthenticated attackers to upload arbitrary file...

PT-2024-26732 · Automattic · Woocommerce

Name of the Vulnerable Software and Affected Versions: WooCommerce versions through 8.9.2 Description: The issue is related to an Improper Neutralization of Special Elements in Output Used by a Downstream Component, also known as an 'Injection' vulnerability. This allows for Content Spoofing in...

PT-2024-13880 · Fortinet · Fortiadc

Name of the Vulnerable Software and Affected Versions: FortiADC versions 7.0 through 7.4.0 Description: An improper certificate validation issue may allow a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the communication channel between the device and public SDN...

QNAP QTS OS Command Injection Vulnerability (QSA-24-26)

QNAP QTS is prone to an OS command injection vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/o:qnap:qts";...

PT-2024-27581

Name of the Vulnerable Software and Affected Versions Woffice Core versions through 5.4.8 Description A Cross Site Scripting XSS vulnerability in WofficeIO Woffice Core allows Reflected XSS. Recommendations For versions through 5.4.8, update to a version later than 5.4.8 to resolve the issue. At...

Discourse 3.3.x < 3.3.0.beta3 Multiple Vulnerabilities

Discourse is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:discourse:discourse"; ifdescripti...

PT-2024-19355 · WordPress · Himer

Name of the Vulnerable Software and Affected Versions: Himer WordPress theme versions prior to 2.1.1 Description: The issue concerns a lack of CSRF checks in certain areas, potentially allowing attackers to manipulate users into voting on polls they do not have access to through a CSRF attack...