PT-2025-30210

Name of the Vulnerable Software and Affected Versions mbedtls versions prior to 3.6.4 Description The software contains a NULL pointer dereference issue in the mbedtls asn1 store named data function. This occurs when conflicting data is triggered with val.p being NULL but val.len being greater th...

PT-2024-41037

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 133.0.6943.98 Description The issue is related to an out of bounds memory access in V8 in Google Chrome, allowing a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. The severit...

CVE-2024-56799

CVE-2024-56799 concerns TrueWinter Simofa. A design flaw in the RouteLoader class before version 0.2.7 could cause certain API routes to be publicly accessible without authentication. This vulnerability affects Simofa prior to 0.2.7 and has been patched in 0.2.7. Impact details describe unauthori...

PT-2024-36822

Name of the Vulnerable Software and Affected Versions LinkAce versions prior to 1.15.6 Description A reflected cross-site scripting XSS issue exists in the "URL" field of the "Edit Link" module, where user input is not properly sanitized or encoded before being reflected in the HTML response. Thi...

PT-2024-17290 · WordPress · Dn Shipping By Weight

Name of the Vulnerable Software and Affected Versions: DN Shipping by Weight for WooCommerce WordPress plugin version 1.2 and earlier Description: The issue concerns the lack of CSRF verification when updating the plugin's settings. This could allow attackers to make a logged-in administrator...

PT-2024-36863 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.10.0-rc5 Description: A soft lockup issue has been identified in the Linux kernel when compiling kernel source with an up-and-running KASAN-enabled kernel on a 256-core machine. The issue occurs due to excessi...

CVE-2024-56510

@marp-team/marp-core is the core for Marp, which is the ecosystem to write your presentation with plain Markdown. Marp Core from v3.0.2 to v3.9.0 and v4.0.0, are vulnerable to cross-site scripting XSS due to improper neutralization of HTML sanitization. Marp Core v3.9.1 and v4.0.1 have been patch...

PT-2024-16838 · WordPress · Wpforms

Name of the Vulnerable Software and Affected Versions: WPForms WordPress plugin versions prior to 1.9.2.3 Description: The issue allows high privilege users, such as admin, to perform Stored Cross-Site Scripting attacks even when the unfiltered html capability is disallowed, for example in...

CVE-2024-52046

The ObjectSerializationDecoder in Apache MINA uses Java’s native deserialization protocol to process incoming serialized data but lacks the necessary security checks and defenses. This vulnerability allows attackers to exploit the deserialization process by sending specially crafted malicious...

CVE-2024-12744 SQL Injection in the Amazon Redshift JDBC Driver affecting v2.1.0.31

A SQL injection in the Amazon Redshift JDBC Driver in v2.1.0.31 allows a user to gain escalated privileges via the getSchemas, getTables, or getColumns Metadata APIs. Users should upgrade to the driver version 2.1.0.32 or revert to driver version 2.1.0.30...

SUSE SLES12 : Recommended update for vim (SUSE-SU-2024:4409-1)

The remote SUSE Linux SLES12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:4409-1 advisory. - CVE-2024-47814: Fixed use-after-free when closing buffers in Vim bsc1231373 - CVE-2024-43374: Fixed use-after-free in alistadd bsc1229238 Oth...

PT-2024-36785 · Redcap · Redcap

Name of the Vulnerable Software and Affected Versions: REDCap versions prior to 15.0.0 Description: A stored cross-site scripting XSS vulnerability in the Project name of REDCap allows authenticated users to inject malicious scripts into the name field of a Project. When a user clicks on the...

SUSE SLES15 / openSUSE 15 Security Update : haproxy (SUSE-SU-2024:4390-1)

The remote SUSE Linux SLES15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2024:4390-1 advisory. - CVE-2024-53008: Fixed HTTP/3 request smuggling via malformed HTTP headers forwarded to a HTTP/1.1 non- compliant back-end server...

CVE-2024-56358

grist-core is a spreadsheet hosting server. A user visiting a malicious document and previewing an attachment could have their account compromised, because JavaScript in an SVG file would be evaluated in the context of their current page. This issue has been patched in version 1.3.2. Users are...

PT-2024-16969 · WordPress · Spotlight

Name of the Vulnerable Software and Affected Versions: Spotlightr plugin for WordPress versions up to, and including, 0.1.9 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'spotlightr-v' shortcode due to insufficient input sanitization and output escaping on...

PT-2024-9991

Name of the Vulnerable Software and Affected Versions Jinja versions prior to 3.1.5 Description Jinja is an extensible templating engine. An oversight in how the Jinja sandboxed environment detects calls to str.format allows an attacker that controls the content of a template to execute arbitrary...

CVE-2024-56145

Craft is a flexible, user-friendly CMS for creating custom digital experiences on the web and beyond. Users of affected versions are affected by this vulnerability if their php.ini configuration has registerargcargv enabled. For these users an unspecified remote code execution vector is present...

CVE-2024-56145

Craft CMS is affected by CVE-2024-56145 due to a code execution vector triggered when php.ini register_argc_argv is enabled. Reports indicate an RCE vulnerability exists in affected versions, with remediation via upgrading to Craft CMS 3.9.14, 4.13.2, or 5.5.2. If upgrading is not possible, the r...

CVE-2024-49363 Uncontrolled Recursion and Asymmetric Resource Consumption (Amplification) in media/file proxy in Misskey

Misskey is an open source, federated social media platform. In affected versions FileServerService media proxy in github.com/misskey-dev/misskey 2024.10.1 or earlier did not detect proxy loops, which allows remote actors to execute a self-propagating reflected/amplified distributed...

Cleo VLTrader < 5.8.0.24 Unauthenticated Arbitrary Command Execution (CVE-2024-55956)

The version of Cleo VLTrader running on the remote host is prior to 5.8.0.24. It is, therefore, affected by an unauthenticated arbitrary command execution vulnerability. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number...