Medium: cni-plugins

Issue Overview: A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of da...

Medium: python-pymongo

Issue Overview: Versions of the package pymongo before 4.6.3 are vulnerable to Out-of-bounds Read in the bson module. Using the crafted payload the attacker could force the parser to deserialize unmanaged memory. The parser tries to interpret bytes next to buffer and throws an exception with...

Medium: ecs-init

Issue Overview: A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of da...

Important: python3.11

Issue Overview: An issue was found in the CPython tempfile.TemporaryDirectory class affecting versions 3.12.2, 3.11.8, 3.10.13, 3.9.18, and 3.8.18 and prior. The tempfile.TemporaryDirectory class would dereference symlinks during cleanup of permissions-related errors. This means users which can r...

KLA67254 DoS vulnerability in Google Chrome

Out of bounds write vulnerability was found in Google Chrome. Malicious users can exploit this vulnerability to cause denial of service. Original advisories Stable Channel Update for Desktop Exploitation Public exploits exist for this vulnerability. Related products Google-Chrome CVE list...

PT-2024-26214 · Unknown · Webinarpress

Name of the Vulnerable Software and Affected Versions: WebinarPress versions 1.33.17 and earlier Description: A Cross-Site Request Forgery CSRF issue has been identified. This type of issue allows an attacker to trick a user into performing unintended actions on a web application that the user is...

PT-2024-26222 · Unknown · Social Warfare

Name of the Vulnerable Software and Affected Versions: Social Warfare versions through 4.4.5.1 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This means an attacker can trick a user into performing unintended actions on a web application that the user is authenticated...

PT-2024-26210 · Unyson · Unyson

Name of the Vulnerable Software and Affected Versions: Unyson versions through 2.7.29 Description: A Cross-Site Request Forgery CSRF issue affects the software. This type of issue allows an attacker to trick a user into performing unintended actions on a web application that the user is...

PT-2024-24807 · Unknown · Wp Club Manager

Name of the Vulnerable Software and Affected Versions: WP Club Manager versions 2.2.11 and earlier Description: A Missing Authorization issue has been identified. Recommendations: For WP Club Manager versions 2.2.11 and earlier, update to a version later than 2.2.11 to resolve the issue...

PT-2024-24805 · WordPress · Schedulepress

Name of the Vulnerable Software and Affected Versions: SchedulePress versions 5.0.8 and earlier Description: A Missing Authorization issue has been identified. This issue affects the SchedulePress plugin, potentially allowing unauthorized access due to the lack of proper authorization checks...

PT-2024-12950 · Unknown · Multi-Column Tag Map

Name of the Vulnerable Software and Affected Versions: Multi-column Tag Map versions n/a through 17.0.26 Description: The issue is related to a Missing Authorization vulnerability in the Multi-column Tag Map. Recommendations: For versions n/a through 17.0.26, update to a version later than 17.0.2...

PT-2024-19438 · Dell · Dell Powerprotect Dm5500

Name of the Vulnerable Software and Affected Versions: Dell PowerProtect DM5500 versions 5.15.0.0 and prior Description: The issue is related to an insecure deserialization vulnerability. A remote attacker with high privileges could potentially exploit this, leading to arbitrary code execution on...

PT-2024-25983 · Themeqx · Themeqx Letterpress

Name of the Vulnerable Software and Affected Versions: Themeqx LetterPress versions 1.2.1 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can inje...

PT-2024-22565 · Wind River · Vxworks

Name of the Vulnerable Software and Affected Versions: Wind River VxWorks versions 7 through 23.09 Description: A crafted network packet may cause a buffer overrun. Recommendations: For versions 7 through 23.09, update to a version that contains a fix for this issue...

PT-2024-25342 · Eprolo · Eprolo Dropshipping

Name of the Vulnerable Software and Affected Versions: EPROLO Dropshipping versions through 1.7.1 Description: A Missing Authorization issue has been identified. This issue affects EPROLO Dropshipping, allowing potential unauthorized access. Recommendations: Update to a version later than 1.7.1 t...

PT-2024-18048 · Pressfore · Pressfore Rolo Slider

Name of the Vulnerable Software and Affected Versions: PressFore Rolo Slider versions 1.0.9 and earlier Description: A Missing Authorization vulnerability has been identified in PressFore Rolo Slider. This issue allows unauthorized access. The estimated number of potentially affected devices is n...

PT-2024-3632 · Dell · Powerscale Onefs

Name of the Vulnerable Software and Affected Versions: Dell PowerScale OneFS versions 8.2.x through 9.7.0.2 Description: The issue is related to the use of defective cryptographic algorithms in the PowerScale OneFS operating system. This could allow a remote attacker to gain unauthorized access t...

PT-2024-25957 · Mateso · Mateso Passwordsafe

Name of the Vulnerable Software and Affected Versions: Mateso PasswordSafe versions 8.13.9.26689 and earlier Description: The issue is related to weak cryptography. There is no information provided about the estimated number of potentially affected devices worldwide or real-world incidents where...

PT-2024-25837 · Unknown · Leadconnector

Name of the Vulnerable Software and Affected Versions: LeadConnector versions n/a through 1.7 Description: The issue is related to a Missing Authorization vulnerability in LeadConnector. Recommendations: For LeadConnector versions n/a through 1.7, update to a version that includes the fix for the...

PT-2024-25916

Name of the Vulnerable Software and Affected Versions Alinto SOGo versions through 5.10.0 Description The issue allows for XSS during attachment preview. Recommendations For versions through 5.10.0, update to a version later than 5.10.0 to resolve the issue. At the moment, there is no information...