CVE-2024-56053 WordPress WPLMS plugin < 1.9.9.5.3 - Instructor+ SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in VibeThemes WPLMS wplmsplugin allows SQL Injection.This issue affects WPLMS: from n/a through 1.9.9.5.3...

GHSA-V9MX-4PQQ-H232 Bun has an Application-level Prototype Pollution vulnerability in the runtime native API for Glo

Versions of the package bun before 1.1.30 are vulnerable to Prototype Pollution due to improper input sanitization. An attacker can exploit this vulnerability through Bun's APIs that accept objects...

PT-2024-36268 · Boldthemes · Bold Page Builder

Name of the Vulnerable Software and Affected Versions: Bold Page Builder versions prior to 5.1.5 Description: The issue is related to an improper limitation of a pathname to a restricted directory, also known as 'Path Traversal'. This allows for Path Traversal in BoldThemes Bold Page Builder...

PT-2024-17310 · WordPress · Glomex Oembed Plugin

Name of the Vulnerable Software and Affected Versions: glomex oEmbed plugin for WordPress versions prior to 0.9.1 Description: The glomex oEmbed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's glomex integration shortcode due to insufficient input sanitization a...

Menlo Security On-Premise 安全漏洞

Menlo Security On-Premise is a secure enterprise browser-native program from Menlo Security. A security vulnerability exists in Menlo Security On-Premise versions prior to 2.88 that stems from the possibility that Web policies may not always be applied correctly to intentionally misformatted clie...

PT-2024-17296 · WordPress · Koalendar – Events & Appointments Booking Calendar

Name of the Vulnerable Software and Affected Versions: Koalendar – Events & Appointments Booking Calendar plugin for WordPress versions prior to 1.0.3 Description: The issue is related to Stored Cross-Site Scripting via the height parameter due to insufficient input sanitization and output...

CVE-2024-9641 LuckyWP Table of Contents < 2.1.7 - Admin+ Stored XSS

The LuckyWP Table of Contents WordPress plugin before 2.1.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

SiYuan 路径遍历漏洞

SiYuan is a privacy-first personal knowledge management system from SiYuan open source. A path traversal vulnerability exists in SiYuan versions prior to 3.1.16, which stems from vulnerability to arbitrary file read attacks via path traversal...

PT-2025-35160 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 15.2 Description: The issue involves improved memory handling. Parsing a maliciously crafted file may lead to unexpected application termination. Recommendations: Update to macOS version 15.2 to resolve the issue...

GStreamer 缓冲区错误漏洞

GStreamer is a GStreamer open source set of frameworks for processing streaming media. A buffer error vulnerability exists in versions of GStreamer prior to 1.24.10 that stems from reading the namelength value directly from an input file without properly checking it, resulting in an integer...

WordPress plugin LA-Studio Element Kit for Elementor 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CVE-2024-55560

CVE-2024-55560 affects MailCleaner versions before 28d913e, where the default SSH host keys (ssh_host_dsa_key, ssh_host_rsa_key, ssh_host_ed25519_key) persist after installation. The underlying issue is the continued presence of these default keys, which can enable unauthorized access to the devi...

Dell Wyse Management Suite < 4.4.1 Multiple Vulnerabilities (DSA-2024-440)

The version of Dell Wyse Management Suite installed on the remote host is prior to 4.4.1. It is, therefore, affected by multiple vulnerabilities as referenced in the DSA-2024-440 advisory. - Authentication Bypass by Capture-replay vulnerability. A high privileged attacker with remote access could...

Joomla! 安全漏洞

Joomla! is a free, open source content management system from Joomla! open source. A security vulnerability exists in Joomla! versions prior to 4.4.8. An attacker exploiting this vulnerability could execute a cross-site scripting attack...

PT-2024-27461 · Matrix · Synapse

Name of the Vulnerable Software and Affected Versions: Synapse versions prior to 1.106 Description: Synapse, an open-source Matrix homeserver, allows unauthenticated remote participants to trigger a download and caching of remote media from a remote homeserver to the local media repository. This...

Progress Software WhatsUp Gold 安全漏洞

Progress Software WhatsUp Gold is a network monitoring software from Progress Software, Inc. It is used to monitor the entire network infrastructure as well as applications, configurations and network traffic. A security vulnerability exists in Progress Software WhatsUp Gold versions prior to...

ZOHO ManageEngine Analytics Plus 安全漏洞

ZOHO ManageEngine Analytics Plus is a self-service IT analytics solution from ZOHO. Get a better view of your IT data with rich visualizations and dashboards. A security vulnerability exists in ZOHO ManageEngine Analytics Plus prior to version 6100 that stems from vulnerability to an authenticate...

CVE-2024-53976

Under certain circumstances, navigating to a webpage would result in the address missing from the location URL bar, making it unclear what the URL was for the loaded webpage. This vulnerability affects Firefox for iOS 133...

PT-2024-35971 · Imager +1 · Imager +1

Name of the Vulnerable Software and Affected Versions: Imager package versions prior to 1.025 Description: The issue is a heap-based buffer overflow that can lead to denial of service or possibly other unspecified impacts when the trim method is called on a crafted input image. Recommendations: F...

Firmanet ERP SQL注入漏洞

Firmanet ERP is an e-commerce system from Firmanet, Inc. A SQL injection vulnerability exists in Firmanet ERP version 22.11.2024 and earlier, which stems from vulnerability to SQL injection attacks...