PT-2024-23451 · Unknown · Paid Memberships Pro – Mailchimp Add On

Name of the Vulnerable Software and Affected Versions: Paid Memberships Pro – Mailchimp Add On versions through 2.3.4 Description: The issue is related to the insertion of sensitive information into log files. This could potentially expose sensitive data. Recommendations: For versions through...

PT-2024-23422 · Bdthemes · Bdthemes Element Pack Elementor Addons

Name of the Vulnerable Software and Affected Versions: BdThemes Element Pack Elementor Addons versions through 5.5.3 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for potential exploitatio...

PT-2024-23018 · Metagauss · Metagauss Eventprime

Name of the Vulnerable Software and Affected Versions: Metagauss EventPrime versions 3.3.9 and earlier Description: The issue is a Cross Site Scripting XSS vulnerability. This type of vulnerability allows an attacker to inject malicious scripts into a website, potentially leading to unauthorized...

PT-2024-4019 · Ivanti · Ivanti Endpoint Manager

Name of the Vulnerable Software and Affected Versions: Ivanti Endpoint Manager versions prior to 2022 SU5 Description: The issue is related to a SQL Injection vulnerability in the GetVulnerabilitiesDataTable method of Ivanti Endpoint Manager, due to a lack of protection for the SQL query structur...

PT-2024-14880 · Unknown · Theme Editor

Name of the Vulnerable Software and Affected Versions: Theme Editor versions n/a through 2.7.1 Description: The issue is related to an Unrestricted Upload of File with Dangerous Type. This allows for the upload of files with potentially dangerous types, which could lead to security issues...

PT-2024-6716

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 131.0.2 Firefox ESR versions prior to 128.3.1 Firefox ESR versions prior to 115.16.1 Thunderbird versions prior to 131.0.1 Thunderbird versions prior to 128.3.1 Thunderbird versions prior to 115.16.0 Description A...

UBUNTU-CVE-2024-29034

CarrierWave is a solution for file uploads for Rails, Sinatra and other Ruby web frameworks. The vulnerability CVE-2023-49090 wasn't fully addressed. This vulnerability is caused by the fact that when uploading to object storage, including Amazon S3, it is possible to set a Content-Type value tha...

PT-2024-12658 · Inspirythemes · Realhome

Name of the Vulnerable Software and Affected Versions: Inspirythemes RealHomes versions through 4.0.2 Description: The issue is related to a Missing Authorization vulnerability in InspiryThemes RealHomes. Recommendations: For versions through 4.0.2, update to a version later than 4.0.2 to resolve...

Buffer Over-read

Overview Affected versions of this package are vulnerable to Buffer Over-read due to the improper handling of the ungetbyte and ungetc methods on a StringIO object, which can read past the end of a string. An attacker can obtain sensitive information from memory by invoking StringIO.gets after...

PT-2024-13477 · Ibm · Ibm Storage Protect Plus Server

Name of the Vulnerable Software and Affected Versions: IBM Storage Protect Plus Server versions 10.1.0 through 10.1.16 Description: The issue allows an authenticated user with read-only permissions to add or delete entries from an existing HyperVisor configuration, resulting in unauthorized acces...

PT-2024-22689

Name of the Vulnerable Software and Affected Versions Saleor Storefront versions prior to commit 579241e75a5eb332ccf26e0bcdd54befa33f4783 Description The issue affects Saleor Storefront, software for building e-commerce experiences. When any user authenticates in the storefront, anonymous users a...

PT-2024-27211

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.37 Description The issue is related to the wifi component of the Linux kernel, specifically the iwlwifi driver. It involves guarding against invalid station IDs in the iwl mvm mld rm sta id function to preven...

PT-2024-22679

Name of the Vulnerable Software and Affected Versions Owncast versions 0.1.2 and prior Description Owncast is an open source, self-hosted, decentralized, single user live video streaming and chat server. A lenient CORS policy allows attackers to make a cross origin request, reading privileged...

PT-2024-22194 · Unknown · Survey Maker

Name of the Vulnerable Software and Affected Versions: Survey Maker versions through 4.0.5 Description: The issue is related to improper neutralization of input during web page generation, which allows stored cross-site scripting XSS. This means that an attacker can inject malicious scripts into...

Incorrect Default Permissions

Overview rotp is a package that works for both HOTP and TOTP, and includes QR Code provisioning Affected versions of this package are vulnerable to Incorrect Default Permissions due to overly permissive default permissions. An attacker can modify the .rb files to inject malicious code or alter th...

PT-2024-19925 · Elementor · Elementor Pro

Name of the Vulnerable Software and Affected Versions: Elementor Pro versions 3.19.2 and earlier Description: The issue is related to the exposure of sensitive information to an unauthorized actor. This is a problem where sensitive data is made available to individuals who should not have access ...

SUSE CVE-2024-27305

aiosmtpd is a reimplementation of the Python stdlib smtpd.py based on asyncio. aiosmtpd is vulnerable to inbound SMTP smuggling. SMTP smuggling is a novel vulnerability based on not so novel interpretation differences of the SMTP protocol. By exploiting SMTP smuggling, an attacker may send...

PT-2024-21805

Name of the Vulnerable Software and Affected Versions Support App versions prior to 2.5.1 Rev 2 Description The issue is related to the postinstall installer script, which can be abused to execute arbitrary code as root due to the use of the shebang !/bin/zsh. When the installer is executed, it...

PT-2024-22183 · Livemesh · Elementor Addons

Name of the Vulnerable Software and Affected Versions: Elementor Addons by Livemesh versions 8.3.5 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker...

CVE-2024-28251 Cross-site websocket hijacking in Querybook

Querybook is a Big Data Querying UI, combining collocated table metadata and a simple notebook interface. Querybook's datadocs functionality works by using a Websocket Server. The client talks to this WSS whenever updating/deleting/reading any cells as well as for watching the live status of quer...