PT-2024-11579 · Ibm · Ibm Security Directory Integrator +1

Name of the Vulnerable Software and Affected Versions: IBM Security Directory Integrator version 7.2.0 IBM Security Verify Directory Integrator version 10.0.0 Description: The issue is related to insufficient session expiration, which could allow an unauthorized user to obtain sensitive...

PT-2024-24589 · WordPress · Litespeed Cache

Name of the Vulnerable Software and Affected Versions: LiteSpeed Cache plugin for WordPress versions up to, and including, 6.2.0.1 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation. This allows unauthenticated attackers to update the toke...

PT-2024-27061 · Unknown · External-Secrets

Name of the Vulnerable Software and Affected Versions: external-secrets version 0.9.16 Description: The issue allows attackers to access sensitive data and escalate privileges by obtaining the service account's token due to insecure permissions. Recommendations: For external-secrets version 0.9.1...

PT-2024-7493 · Mitel · Mivoice Business Solution Virtual Instance +1

Name of the Vulnerable Software and Affected Versions: Mitel MiCollab versions through 9.8 SP1 9.8.1.5 MiVoice Business Solution Virtual Instance MiVB SVI versions through 1.0.0.27 Description: A vulnerability in the Web Interface component could allow an authenticated attacker to conduct a comma...

GHSA-CRJG-W57M-RQQF DNSJava vulnerable to KeyTrap - Denial-of-Service Algorithmic Complexity Attacks

Impact Users using the ValidatingResolver for DNSSEC validation can run into CPU exhaustion with specially crafted DNSSEC-signed zones. Patches Users should upgrade to dnsjava v3.6.0 Workarounds Although not recommended, only using a non-validating resolver, will remove the vulnerability...

PT-2024-27430 · Ideapush · Ideapush

Name of the Vulnerable Software and Affected Versions: IdeaPush versions n/a through 8.60 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS attacks. Recommendations: For versions n/a...

Important: composer

Issue Overview: Composer is a dependency manager for PHP. On the 2.x branch prior to versions 2.2.24 and 2.7.7, the composer install command running inside a git/hg repository which has specially crafted branch names can lead to command injection. This requires cloning untrusted repositories...

Important: ecs-service-connect-agent

Issue Overview: dd-trace-cpp is the Datadog distributed tracing for C++. When the library fails to extract trace context due to malformed unicode, it logs the list of audited headers and their values using the nlohmann JSON library. However, due to the way the JSON library is invoked, it throws a...

PT-2024-27544 · Widgetkit · Widgetkit

Name of the Vulnerable Software and Affected Versions: WidgetKit versions n/a through 2.5.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS attacks. Recommendations: For versions n...

PT-2024-27559 · Bplugins · Bplugins Html5 Audio Player

Name of the Vulnerable Software and Affected Versions: bPlugins Html5 Audio Player versions 2.2.23 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS attacks...

Medium: nano

Issue Overview: nano: running chmod and chown on the filename allows malicious user to replace the emergency file with a malicious symlink to a root-owned file CVE-2024-5742 Affected Packages: nano Issue Correction: Run dnf update nano --releasever 2023.5.20240722 to update your system. New...

PT-2024-37819

Name of the Vulnerable Software and Affected Versions HashiCorp Nomad and Nomad Enterprise versions 1.6.12 through 1.7.9 HashiCorp Nomad and Nomad Enterprise version 1.8.1 Description The issue concerns archive unpacking during migration, where path escaping of the allocation directory is possibl...

PT-2024-27607 · Unknown · Beaver Builder

Name of the Vulnerable Software and Affected Versions: Beaver Builder versions 2.8.2.2 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS attacks. Recommendations: For...

PT-2024-27614 · Woocommerce · Makecommerce

Name of the Vulnerable Software and Affected Versions: MakeCommerce for WooCommerce versions 3.5.1 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Reflected XSS. Recommendations:...

PT-2024-28218 · Jegstudio · Jegstudio Gutenverse

Name of the Vulnerable Software and Affected Versions: Jegstudio Gutenverse versions 1.9.2 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS attacks. Recommendations: For...

PT-2024-27642 · Unknown · Nick Halsey Floating Social Media Links

Name of the Vulnerable Software and Affected Versions: Nick Halsey Floating Social Media Links versions 1.5.2 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS...

PT-2024-27855 · Codexhelp · Codexhelp Master Popups

Name of the Vulnerable Software and Affected Versions: CodexHelp Master Popups versions 1.0.3 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS attacks. Recommendations:...

PT-2024-28117 · Unknown · Skt Addons For Elementor

Name of the Vulnerable Software and Affected Versions: SKT Addons for Elementor versions 3.0 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS attacks. Recommendations: F...

PT-2024-37764 · WordPress · Woocommerce - Social Login

Name of the Vulnerable Software and Affected Versions: WooCommerce - Social Login plugin for WordPress versions up to, and including, 2.7.3 Description: The issue is related to authentication bypass due to insufficient controls in the woo slg login email function. This allows unauthenticated...

PT-2024-27823 · WordPress · Coneblog – Wordpress Blog Widgets

Name of the Vulnerable Software and Affected Versions: ConeBlog – WordPress Blog Widgets versions 1.4.8 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS attacks...