PT-2024-4452 · Siemens · Siemens Solid Edge

Name of the Vulnerable Software and Affected Versions: Siemens Solid Edge versions prior to V224.0 Update 5 Description: The issue is related to an out of bounds read past the end of an allocated structure while parsing specially crafted PAR files. This could allow an attacker to execute code in...

PT-2024-3183 · Freerdp +9 · Freerdp +9

Name of the Vulnerable Software and Affected Versions: FreeRDP versions prior to 3.5.1 Description: The issue is related to an out-of-bounds read in the FreeRDP client, which is a free implementation of the Remote Desktop Protocol. This could allow a remote attacker to impact the confidentiality,...

PT-2024-24666 · Unknown · Adam Bowen Tax Rate Upload

Name of the Vulnerable Software and Affected Versions: Adam Bowen Tax Rate Upload versions n/a through 2.4.5 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables potential attacke...

PT-2024-24075 · Unknown · The Events Calendar

Name of the Vulnerable Software and Affected Versions: The Events Calendar versions n/a through 6.3.0 Description: A Cross-Site Request Forgery CSRF issue has been identified. This type of issue allows an attacker to trick a user into performing unintended actions on a web application that the us...

PT-2024-3926 · Unknown +2 · Mojolicious +2

Name of the Vulnerable Software and Affected Versions: Mojolicious module versions prior to 9.11 Description: The issue is related to a bug in the format detection component of the Mojolicious module for Perl, which is associated with errors in resource release. This can potentially be exploited ...

PT-2024-18207 · WordPress · Top Bar Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Top Bar WordPress plugin versions prior to 3.0.5 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for example, in...

PT-2024-3166 · Google +4 · Google Chrome +4

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 124.0.6367.78 Description: The issue is related to a type confusion in the ANGLE graphics layer engine, which could allow a remote attacker to exploit heap corruption via a crafted HTML page. This could...

PT-2024-18760 · Samsung · Samsung Pay

Name of the Vulnerable Software and Affected Versions: Samsung Pay versions prior to 5.4.99 Description: The issue concerns the use of implicit intent for sensitive communication in Samsung Pay, allowing local attackers to access Samsung Pay information. Recommendations: For versions prior to...

PT-2024-23462 · Elementor · Layouts For Elementor

Name of the Vulnerable Software and Affected Versions: Layouts for Elementor versions prior to 1.8 Description: The issue is related to an Unrestricted Upload of File with Dangerous Type, which affects the functionality of the software. No information is provided about the estimated number of...

PT-2024-23002 · WordPress · Krunal Prajapati Wp Post Disclaimer

Name of the Vulnerable Software and Affected Versions: Krunal Prajapati WP Post Disclaimer versions 1.0.3 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Stored XSS, where an attacker...

PT-2024-23135 · Unknown · Tutor Lms Elementor Addons

Name of the Vulnerable Software and Affected Versions: Tutor LMS Elementor Addons versions prior to 2.1.4 Description: The issue is related to improper neutralization of input during web page generation, which allows for stored cross-site scripting XSS. This means that an attacker can inject...

PT-2024-12796 · Avada · Avada

Name of the Vulnerable Software and Affected Versions: Avada versions n/a through 7.11.1 Description: The issue is related to an Unrestricted Upload of File with Dangerous Type vulnerability. This allows for the upload of files with potentially dangerous types, which could lead to security issues...

PT-2024-2588

Name of the Vulnerable Software and Affected Versions Netty versions prior to 4.1.108.Final Description The issue is related to the HttpPostRequestDecoder in Netty, which can be tricked to accumulate data without limits. This can be achieved by sending a chunked post consisting of many small fiel...

Sangoma Technologies CG/MG family driver cg6kwin2k.sys vulnerable to insufficient access control on its IOCTL

Overview CG/MG family driver cg6kwin2k.sys provided by Sangoma Technologies is vulnerable to insufficient access control on its IOCTL CWE-782. Takahiro Haruyama of Broadcom Carbon Black reported this vulnerability to JPCERT/CC. JPCERT/CC coordinated with the developer. Impact By sending a specifi...

PT-2024-22414 · Unknown · Advanced Plugins Reportsstatistics

Name of the Vulnerable Software and Affected Versions: Advanced Plugins reportsstatistics versions 1.3.20 and earlier Description: An issue in Advanced Plugins reportsstatistics allows a remote attacker to execute arbitrary code via the Sales Reports, Statistics, Custom Fields & Export module...

PT-2024-2642 · Google +3 · Google Chrome +3

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 123.0.6312.58 Description: The issue is related to incorrect security UI in Google Chrome, allowing a remote attacker to perform UI spoofing via a crafted HTML page. This can be achieved by exploiting the...

PT-2024-2272 · Unitronics · Unistream +1

Name of the Vulnerable Software and Affected Versions: Unitronics Unistream Unilogic versions prior to 1.35.227 Description: The issue is related to insufficient protection of service data in the UniLogic Studio software for UniStream series programmable logic controllers. Exploitation of this...

PT-2024-2930 · Ivanti · Ivanti Avalanche

Name of the Vulnerable Software and Affected Versions: Ivanti Avalanche versions prior to 6.4.3 Description: The issue is related to a heap overflow vulnerability in the WLAvalancheService component. This vulnerability can be exploited by a remote unauthenticated attacker to execute arbitrary...

PT-2024-22162 · Themeisle · Themeisle Visualizer

Name of the Vulnerable Software and Affected Versions: Themeisle Visualizer versions 3.10.5 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables potential attackers to...

SUSE-SU-2024:0882-1 Security update for hdf5

This update for hdf5 fixes the following issues: Updated to version 1.10.11 Changed the error handling for a not found path in the find plugin process. Fixed CVE-2018-11202, a malformed file could result in chunk index memory leaks. Fixed a file space allocation bug in the parallel library for...