PT-2024-26615 · Sendinblue · Brevo Newsletter

Name of the Vulnerable Software and Affected Versions: Brevo Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue versions n/a through 3.1.77 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS,...

Important: php

Issue Overview: The vulnerability allows a remote attacker to bypass implemented security restrictions. The vulnerability exists due to the way PHP handles HTTP variable names. A remote attacker can set a standard insecure cookie in the victim's browser which is treated as a Host- or Secure- cook...

CVE-2024-35226 PHP Code Injection by malicious attribute in extends-tag in Smarty

Smarty is a template engine for PHP, facilitating the separation of presentation HTML/CSS from application logic. In affected versions template authors could inject php code by choosing a malicious file name for an extends-tag. Sites that cannot fully trust template authors should update asap. Al...

PT-2024-12614 · Ibm · Ibm Aspera Faspex

Name of the Vulnerable Software and Affected Versions: IBM Aspera Faspex versions 5.0.0 through 5.0.6 Description: The issue allows users to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure within a trusted sessio...

Fedora: Security Advisory for rust-resctl-demo (FEDORA-2024-ce2936b568)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory for rust-uu_uniq (FEDORA-2024-ce2936b568)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2024-26421 · Unknown · Wp Booking

Name of the Vulnerable Software and Affected Versions: WP Booking versions prior to 2.4.5 Description: A cross-site scripting issue exists, allowing an arbitrary script to be executed on the user's web browser if exploited. Recommendations: For versions prior to 2.4.5, update to version 2.4.5 or...

Fedora: Security Advisory for rust-shellcheck-sarif (FEDORA-2024-ce2936b568)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2024-30609 · WordPress · The Spectra – Wordpress Gutenberg Blocks

Name of the Vulnerable Software and Affected Versions: The Spectra – WordPress Gutenberg Blocks plugin versions up to, and including, 2.13.0 Description: The issue is related to Stored Cross-Site Scripting via the block id parameter due to insufficient input sanitization and output escaping. This...

PT-2024-9386

Name of the Vulnerable Software and Affected Versions Mitel MiCollab versions through 9.8.0.33 Description A flaw exists in the NuPoint Messenger NPM component of Mitel MiCollab due to inadequate sanitization of user-supplied data. This allows a remote, unauthenticated attacker to perform a SQL...

VMware Workstation Multiple Vulnerabilities (VMSA_2024_0010) - Windows

VMware Workstation is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:vmware:workstation";...

PT-2024-18319 · WordPress · Embedpress

Name of the Vulnerable Software and Affected Versions: EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor plugin for WordPress versions up to, and including, 3.9.12 Description: The issue is related to insufficient...

PT-2024-33299 · WordPress · Wpb Elementor Addons

Name of the Vulnerable Software and Affected Versions: WPB Elementor Addons plugin for WordPress versions up to, and including, 1.0.9 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows authenticated attackers wi...

PT-2024-27109 · WordPress · The Opal Estate Pro

Name of the Vulnerable Software and Affected Versions: The Opal Estate Pro – Property Management and Submission plugin for WordPress versions up to, and including, 1.7.6 Description: The issue is related to Stored Cross-Site Scripting via the agent latitude and longitude parameters due to...

KB Security Advisory EPM May 2024

Last Modified Date Apr 21, 2025 4:11:34 PM...

PT-2024-40417 · Shopware · Shopware

Name of the Vulnerable Software and Affected Versions: Shopware versions prior to 5.2.14 Description: The issue allows for the execution of unauthorized foreign code under certain circumstances, posing a critical security risk that could impact the entire system. Recommendations: For versions pri...

PT-2024-6480 · Google · Google Chrome

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 128.0.6537.0 Description: The issue is related to insufficient data validation in the Updater component of Google Chrome, allowing a remote attacker to perform privilege escalation via a malicious file...

PT-2024-11263 · Linux +1 · Linux Kernel +1

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 4.19.95 Description: A vulnerability in the Linux kernel has been resolved, which was triggered by a call to munlock pagevec to clear page LRU without lock page. This resulted in a kernel panic due to a BUG ON...

JVN#29471697: Android App "TP-Link Tether" and "TP-Link Tapo" vulnerable to improper server certificate verification

Android App "TP-Link Tether" and "TP-Link Tapo" provided by TP-LINK GLOBAL INC. are vulnerable to improper server certificate verification CWE-295. Impact A man-in-the-middle attack may allow an attacker to eavesdrop on an encrypted communication. Solution Update the application Update the...

PT-2024-22010 · WordPress · Contact Form Plugin By Fluent Forms

Name of the Vulnerable Software and Affected Versions: The Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder plugin for WordPress versions up to, and including, 5.1.13 Description: The issue is related to Stored Cross-Site Scripting via form settings due to...