PT-2024-7557 · Unknown · Jitsi Meet

Name of the Vulnerable Software and Affected Versions: Jitsi Meet versions prior to 2.0.9779 Description: The issue is related to the insecure implementation of the image sharing functionality using giphy in Jitsi Meet. This allows clients to load GIFs from any arbitrary URL if a message from...

PT-2024-36335 · N Able · Ecosystem Agent

Name of the Vulnerable Software and Affected Versions: Ecosystem Agent versions 4.0 through 4.1.5.2597 Ecosystem Agent versions 5.0 through 5.1.4.2473 Description: The issue is related to the improper validation of SSL/TLS certificates. This could allow a malicious actor to perform a...

PT-2024-35138 · WordPress · Fuse Social Floating Sidebar

Name of the Vulnerable Software and Affected Versions: Fuse Social Floating Sidebar plugin for WordPress versions up to, and including, 5.4.10 Description: The issue is related to Stored Cross-Site Scripting via the file upload functionality due to insufficient validation of SVG files. This allow...

PT-2024-12021 · Diebold Nixdorf · Vynamic Security Suite

Name of the Vulnerable Software and Affected Versions: Diebold Nixdorf Vynamic Security Suite VSS versions prior to 3.3.0 SR12 Diebold Nixdorf Vynamic Security Suite VSS versions prior to 4.0.0 SR04 Diebold Nixdorf Vynamic Security Suite VSS versions prior to 4.1.0 SR02 Diebold Nixdorf Vynamic...

PT-2024-26042 · Samsung · Samsung Notes

Name of the Vulnerable Software and Affected Versions: Samsung Notes versions prior to 4.4.21.62 Description: The issue is related to an out-of-bounds read in applying connection points, which could allow local attackers to potentially read memory. Recommendations: For versions prior to 4.4.21.62...

UBUNTU-CVE-2024-7246

It's possible for a gRPC client communicating with a HTTP/2 proxy to poison the HPACK table between the proxy and the backend such that other clients see failed requests. It's also possible to use this vulnerability to leak other clients HTTP header keys, but not values. This occurs because the...

PT-2024-5753

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 127.0.6533.99 Description The issue is related to an inappropriate implementation in V8, which can lead to heap corruption. A remote attacker can potentially exploit this via a crafted HTML page, allowing them t...

PT-2024-8735 · Foxit · Foxit Pdf Reader +1

Name of the Vulnerable Software and Affected Versions: Foxit PDF Reader affected versions not specified Foxit PDF Editor affected versions not specified Description: This issue allows remote attackers to disclose sensitive information on affected installations. User interaction is required, where...

PT-2024-29886 · Unknown · Fog Server

Name of the Vulnerable Software and Affected Versions: FOG Server versions 1.5.10.41.4 and earlier Description: The issue concerns the exposure of sensitive information via logs stored on the web server. Specifically, FOG Server creates two logs, fog login accepted.log and fog login failed.log, o...

PT-2024-28568 · Unknown · Contest Gallery

Name of the Vulnerable Software and Affected Versions: Contest Gallery versions through 23.1.2 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS in Contest Gallery. Recommendations:...

PT-2024-28600 · Unknown · Kubio Ai Page Builder

Name of the Vulnerable Software and Affected Versions: Kubio AI Page Builder versions 2.2.4 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for potential malicious script injection in...

PT-2024-5760 · Vonets · Vonets Wifi Bridge Repeaters +1

Name of the Vulnerable Software and Affected Versions: Vonets industrial wifi bridge relays and wifi bridge repeaters versions 3.3.23.6.9 and prior Description: The issue is related to an improper check or handling of exceptional conditions, which enables an unauthenticated remote attacker to cau...

Mageia: Security Advisory (MGASA-2024-0276)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2024-6376

Name of the Vulnerable Software and Affected Versions REXML versions prior to 3.3.3 Description The issue is related to an uncontrolled resource consumption in the REXML XML toolkit for Ruby. When REXML parses an XML with many entity expansions using the SAX2 or pull parser API, it can lead to a...

EUVD-2024-2299

Mobile Security Framework MobSF is a security research platform for mobile applications in Android, iOS and Windows Mobile. An open redirect vulnerability exist in MobSF authentication view. Update to MobSF v4.0.5...

PT-2024-08: Reading arbitrary files when scanning a project linked to a git repository in PT Application Inspector (PT AI)

The vulnerability was identified in PT AI affecting versions 4.3.1 to 4.7.2. The vulnerability can be exploited by an attacker with network access to the PT AI control server to read source code files of other user's projects. The vulnerability can be exploited for privilege escalation...

PT-2024-37825 · WordPress · Formidable Forms

Name of the Vulnerable Software and Affected Versions: Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder plugin for WordPress versions up to, and including, 6.11.1 Description: The issue is related to Stored Cross-Site Scripting via the html...

Security Bulletin: IBM Security Directory Integrator vulnerable to sensitive information disclosure (CVE-2022-32751)

Summary The IBM Security Directory Integrator product could disclose sensitive server information which affects the IBM Security Directory Server. This was addressed in an update. Vulnerability Details CVEID:CVE-2022-32751 DESCRIPTION: IBM Security Verify Directory 10.0.0 could disclose sensitive...

PT-2024-28804 · Webkul · Webkul Qloapps

Name of the Vulnerable Software and Affected Versions: Webkul Qloapps version 1.6.0.0 Description: The issue allows attackers to execute arbitrary code via uploading a crafted file, due to an arbitrary file upload vulnerability. Recommendations: For Webkul Qloapps version 1.6.0.0, update to a...

openSUSE 15 Security Update : python-sentry-sdk (openSUSE-SU-2024:0214-1)

The remote openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2024:0214-1 advisory. - CVE-2024-40647: Do not leak environment variables to child processes. bsc1228128 Tenable has extracted the preceding description block directly from th...