PT-2024-19438 · Dell · Dell Powerprotect Dm5500

Name of the Vulnerable Software and Affected Versions: Dell PowerProtect DM5500 versions 5.15.0.0 and prior Description: The issue is related to an insecure deserialization vulnerability. A remote attacker with high privileges could potentially exploit this, leading to arbitrary code execution on...

PT-2024-12950 · Unknown · Multi-Column Tag Map

Name of the Vulnerable Software and Affected Versions: Multi-column Tag Map versions n/a through 17.0.26 Description: The issue is related to a Missing Authorization vulnerability in the Multi-column Tag Map. Recommendations: For versions n/a through 17.0.26, update to a version later than 17.0.2...

PT-2024-3632 · Dell · Powerscale Onefs

Name of the Vulnerable Software and Affected Versions: Dell PowerScale OneFS versions 8.2.x through 9.7.0.2 Description: The issue is related to the use of defective cryptographic algorithms in the PowerScale OneFS operating system. This could allow a remote attacker to gain unauthorized access t...

PT-2024-25957 · Mateso · Mateso Passwordsafe

Name of the Vulnerable Software and Affected Versions: Mateso PasswordSafe versions 8.13.9.26689 and earlier Description: The issue is related to weak cryptography. There is no information provided about the estimated number of potentially affected devices worldwide or real-world incidents where...

PT-2024-25837 · Unknown · Leadconnector

Name of the Vulnerable Software and Affected Versions: LeadConnector versions n/a through 1.7 Description: The issue is related to a Missing Authorization vulnerability in LeadConnector. Recommendations: For LeadConnector versions n/a through 1.7, update to a version that includes the fix for the...

PT-2024-25916

Name of the Vulnerable Software and Affected Versions Alinto SOGo versions through 5.10.0 Description The issue allows for XSS during attachment preview. Recommendations For versions through 5.10.0, update to a version later than 5.10.0 to resolve the issue. At the moment, there is no information...

Important: nodejs20

Issue Overview: NOTE: https://nodejs.org/en/blog/vulnerability/april-2024-security-releases/ CVE-2024-27982 An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside. It is possible to leave some data i...

PT-2024-25552 · Rometheme · Romethemekit For Elementor

Name of the Vulnerable Software and Affected Versions: RomethemeKit For Elementor versions 1.4.1 and earlier Description: The issue is related to a Missing Authorization vulnerability in Rometheme RomethemeKit For Elementor. Recommendations: For RomethemeKit For Elementor versions 1.4.1 and...

Important: unbound

Issue Overview: A vulnerability was found in Unbound due to incorrect default permissions, allowing any process outside the unbound group to modify the unbound runtime configuration. If a process can connect over localhost to port 8953, it can alter the configuration of unbound.service. This flaw...

PT-2024-25678 · Unknown · Pterodactyl

Name of the Vulnerable Software and Affected Versions: Pterodactyl versions prior to 1.11.6 Description: Importing a malicious egg or gaining access to a wings instance could lead to cross-site scripting XSS on the panel, potentially allowing an attacker to gain an administrator account. The...

PT-2024-25546 · Unknown · Xserver Migrator

Name of the Vulnerable Software and Affected Versions: Xserver Migrator versions 1.6.1 and earlier Description: A Cross-Site Request Forgery CSRF issue leads to Arbitrary File Upload in Xserver Migrator. This allows an attacker to potentially upload arbitrary files. Recommendations: For versions...

PT-2024-19547 · Kadence Blocks · The Gutenberg Blocks By Kadence Blocks

Name of the Vulnerable Software and Affected Versions: The Gutenberg Blocks by Kadence Blocks – Page Builder Features plugin for WordPress versions up to, and including, 3.2.34 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output...

PT-2024-28237 · WordPress · Premium Addons For Elementor

Name of the Vulnerable Software and Affected Versions: Premium Addons for Elementor plugin for WordPress versions up to, and including, 4.10.28 Description: The issue is related to Stored Cross-Site Scripting via the subcontainer value parameter due to insufficient input sanitization and output...

PT-2024-25582 · Unknown · Archives Calendar Widget

Name of the Vulnerable Software and Affected Versions: Archives Calendar Widget versions 1.0.15 and earlier Description: The issue is related to Administrator Cross Site Scripting XSS in the Archives Calendar Widget. Recommendations: For Archives Calendar Widget versions 1.0.15 and earlier, updat...

PT-2024-25224 · WordPress · Colibri Page Builder

Name of the Vulnerable Software and Affected Versions: Colibri Page Builder plugin for WordPress versions up to, and including, 1.0.262 Description: The issue is related to Stored Cross-Site Scripting via the image alt data parameter due to insufficient input sanitization and output escaping. Thi...

PT-2024-18759 · WordPress · Ht Mega – Absolute Addons For Elementor

Name of the Vulnerable Software and Affected Versions: HT Mega – Absolute Addons For Elementor plugin for WordPress versions up to, and including, 2.4.6 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping on user-supplied...

Foxit PhantomPDF Multiple Vulnerabilities (June-1 2024)

Foxit PhantomPDF is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:foxitsoftware:phantompdf";...

PT-2024-18007 · WordPress · Phlox

Name of the Vulnerable Software and Affected Versions: Shortcodes and extra features for Phlox theme plugin for WordPress versions up to, and including, 2.15.5 Description: The issue is related to Stored Cross-Site Scripting via the title tag parameter due to insufficient input sanitization and...

PT-2024-23183 · WordPress · La-Studio Element Kit

Name of the Vulnerable Software and Affected Versions: LA-Studio Element Kit for Elementor plugin for WordPress versions up to, and including, 1.3.7.5 Description: The issue is related to Stored Cross-Site Scripting via the plugin's LaStudioKit Post Author widget due to insufficient input...

Important: nghttp2

Issue Overview: nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. The nghttp2 library prior to version 1.61.0 keeps reading the unbounded number of HTTP/2 CONTINUATION frames even after a stream is reset to keep HPACK context in sync. This causes excessive CPU usage ...