GHSA-XGFM-FJX6-62MJ readthedocs-sphinx-search vulnerable to cross-site scripting when including search results from malicious projects

Impact This vulnerability could have allowed an attacker to include arbitrary HTML content in search results by having a user search a malicious project. This was due to our search client not correctly escaping all user content from search results. You can find more information in the advisory...

PT-2024-1188 · Oracle · Oracle Zfs Storage Appliance Kit

Name of the Vulnerable Software and Affected Versions: Oracle ZFS Storage Appliance Kit version 8.8 Description: The issue is related to insufficient input validation in the Core component of the Oracle ZFS Storage Appliance Kit. This allows a high-privileged attacker with logon to the...

PT-2024-1228

Name of the Vulnerable Software and Affected Versions Oracle Java SE versions 8u391, 8u391-perf, 11.0.21, 17.0.9, 21.0.1 Oracle GraalVM for JDK versions 17.0.9, 21.0.1 Oracle GraalVM Enterprise Edition versions 20.3.12, 21.3.8, 22.3.4 Description The issue exists due to insufficient input...

PT-2024-1339 · Oracle +8 · Mysql Server +7

Name of the Vulnerable Software and Affected Versions: MySQL Server versions 8.0.35 and prior MySQL Server versions 8.2.0 and prior Description: The issue is related to insufficient input validation in the Server: Optimizer component of Oracle MySQL Server. It allows a high-privileged attacker wi...

CVE-2023-46749 Apache Shiro before 1.13.0 or 2.0.0-alpha-4, may be susceptible to a path traversal attack that results in an authentication bypass when used together with path rewriting

Apache Shiro before 1.13.0 or 2.0.0-alpha-4, may be susceptible to a path traversal attack that results in an authentication bypass when used together with path rewriting Mitigation: Update to Apache Shiro 1.13.0+ or 2.0.0-alpha-4+, or ensure blockSemicolon is enabled this is the default...

PT-2024-19223 · Mailmunch · Constant Contact Forms By Mailmunch

Name of the Vulnerable Software and Affected Versions: Constant Contact Forms by MailMunch versions 2.0.11 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an...

PT-2024-15072 · WordPress · Envira Photo Gallery

Name of the Vulnerable Software and Affected Versions: Envira Photo Gallery plugin for WordPress versions up to, and including, 1.8.7.1 Description: The issue allows authenticated attackers with contributor access and above to modify galleries on other users' posts due to an improper capability...

PT-2024-1635 · Siemens · Solid Edge

Name of the Vulnerable Software and Affected Versions: Solid Edge SE2023 versions prior to V223.0 Update 10 Description: A vulnerability has been identified in the affected applications, which contain an out of bounds read past the end of an allocated structure while parsing specially crafted PAR...

PT-2024-1040 · Siemens · Solid Edge

Name of the Vulnerable Software and Affected Versions: Solid Edge SE2023 versions prior to V223.0 Update 10 Description: A vulnerability has been identified in the affected application, which contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted PAR...

PT-2024-1025 · Adobe · Substance3D - Stager

Name of the Vulnerable Software and Affected Versions: Adobe Substance 3D Stager versions 2.1.3 and earlier Description: The issue is related to insufficient input validation, which may allow an attacker to execute arbitrary code. It is an out-of-bounds read vulnerability that could lead to...

PT-2024-1328 · Intel +1 · Intel(R) Hid Event Filter Driver +1

Name of the Vulnerable Software and Affected Versions: Intel HID Event Filter drivers for Windows 10 versions prior to 2.2.2.1 Description: The issue is related to insecure inherited permissions in some Intel HID Event Filter drivers for Windows 10, which may allow an authenticated user to...

Medium: python-urllib3

Issue Overview: urllib3 is a user-friendly HTTP client library for Python. urllib3 previously wouldn't remove the HTTP request body when an HTTP redirect response using status 301, 302, or 303 after the request had its method changed from one that could accept a request body like POST to GET as i...

QNAP QTS Video Station Multiple Vulnerabilities (QSA-23-52)

QNAP Video Station is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:qnap:videostation"; if...

PT-2024-1149 · Microsoft · Windows +1

Name of the Vulnerable Software and Affected Versions: Remote Desktop Client versions prior to 1.2.5105 Description: The issue is related to errors in synchronization when using a shared resource in the Remote Desktop Protocol RDP of the Windows operating system. This can allow a remote attacker ...

HPESBGN04586 rev.3 - HPE OneView, Multiple Vulnerabilities

Potential Security Impact: Local: Denial of Service DoS, Escalation of Privilege, Server-Side Request Forgery SSRF; Remote: Code Execution SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE OneView - All versions prior to 8.70 and all 6.6 LTS versions prior to 6.60.07 CVSS Scores...

Medium: bouncycastle

Issue Overview: Bouncy Castle for Java before 1.73 contains a potential Denial of Service DoS issue within the Bouncy Castle org.bouncycastle.openssl.PEMParser class. This class parses OpenSSL PEM encoded streams containing X.509 certificates, PKCS8 encoded keys, and PKCS7 objects. Parsing a file...

PT-2024-14888 · WordPress · Essential Real Estate

Name of the Vulnerable Software and Affected Versions: The Essential Real Estate WordPress plugin versions prior to 4.4.0 Description: The issue arises from the plugin not applying proper capability checks on its AJAX actions. This allows attackers with a subscriber account to conduct Stored XSS...

PT-2024-14164 · Unknown · Jordy Meow Database Cleaner

Name of the Vulnerable Software and Affected Versions: Jordy Meow Database Cleaner: Clean, Optimize & Repair versions 0.9.8 and earlier Description: The issue is related to the exposure of sensitive information to an unauthorized actor. This is a problem where sensitive data is made accessible to...

PT-2024-10781 · Irfanview · Irfanview B3D Plugins

Name of the Vulnerable Software and Affected Versions: IrfanView B3D PlugIns versions prior to 4.56 Description: The issue is related to a heap-based out-of-bounds write in the B3d.dll module. This occurs at the B3d.dll!+27ef location, indicating a specific point of vulnerability in the code. The...

PT-2024-14438 · Wow Company · Wow-Company Floating Button

Name of the Vulnerable Software and Affected Versions: Wow-Company Floating Button versions n/a through 6.0 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web...