PT-2024-25720

Name of the Vulnerable Software and Affected Versions Bitcoin Core versions through 27.0 Bitcoin Knots versions prior to 25.1.knots20231115 Description The tapscript implementation does not include a policy size limit check. This is a separate issue from CVE-2023-50428. Some parties have expresse...

PT-2024-25184 · Shipup · Shipup

Name of the Vulnerable Software and Affected Versions: shipup versions prior to 3.3.0 Description: A SQL injection issue allows a remote attacker to escalate privileges via the getShopID function. This enables the attacker to potentially gain unauthorized access to sensitive data or systems...

PT-2024-18411 · WordPress · Smart Forms

Name of the Vulnerable Software and Affected Versions: The Smart Forms WordPress plugin versions prior to 2.6.96 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This is possible because some settings are not properly sanitised an...

PT-2024-25309 · Unknown · Crelly Slider

Name of the Vulnerable Software and Affected Versions: Crelly Slider versions 1.4.5 and earlier Description: The issue is related to an Authorization Bypass Through User-Controlled Key vulnerability. This allows for authorization bypass, potentially compromising system security. Recommendations:...

PT-2024-14712 · Kde · Libksieve

Name of the Vulnerable Software and Affected Versions: KDE libksieve versions prior to 23.03.80 Description: The issue arises from a mistake in kmanagesieve/session.cpp where a username variable is accidentally assigned a password value, resulting in cleartext passwords being placed in server log...

PT-2024-6394 · Artifex +6 · Artifex Ghostscript +6

Name of the Vulnerable Software and Affected Versions: Artifex Ghostscript versions prior to 10.03.1 Description: The issue is related to the incorrect input validation in the psi/zmisc1.c file of the Artifex Ghostscript software. This can allow a remote attacker to execute arbitrary code. The...

CVE-2024-27124

An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network. We have already fixed the vulnerability in the following versions: QTS 5.1.3.2578 build 20231110 and later...

PT-2024-25428 · Passbolt · Passbolt Api

Name of the Vulnerable Software and Affected Versions: Passbolt API versions prior to 4.6.2 Description: The issue allows HTML injection in a URL parameter, resulting in custom content being displayed when a user visits the crafted URL. Although the injected content is not executed as JavaScript...

PT-2024-24263 · WordPress · Shortcodes Ultimate

Name of the Vulnerable Software and Affected Versions: Shortcodes Ultimate WordPress plugin versions prior to 7.1.0 Description: The issue concerns the lack of validation and escaping of some shortcode attributes in the Shortcodes Ultimate WordPress plugin, which could allow users with the...

PT-2024-6814 · Google +4 · Google Chrome +4

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 129.0.6668.58 Microsoft Edge affected versions not specified Description: The issue is related to an inappropriate implementation in the Autofill feature, allowing a remote attacker to perform UI spoofing via a...

SUSE-SU-2024:1415-2 Security update for cockpit-wicked

This update for cockpit-wicked fixes the following issues: - CVE-2023-26364: Fixed denial of service due to improper input validation during CSS parsing bsc1217325 Other fixes: - Update to version 5git8.c06c55b...

SUSE-SU-2024:1415-1 Security update for cockpit-wicked

This update for cockpit-wicked fixes the following issues: - CVE-2023-26364: Fixed denial of service due to improper input validation during CSS parsing bsc1217325 Other fixes: - Update to version 5git8.c06c55b...

PT-2024-24860 · Unknown · Fg Joomla To Wordpress

Name of the Vulnerable Software and Affected Versions: FG Joomla to WordPress versions 4.20.2 and earlier Description: The issue is related to the insertion of sensitive information into log files. This could potentially expose sensitive data. Recommendations: For FG Joomla to WordPress versions...

PT-2024-4020 · Ivanti · Ivanti Avalanche

Name of the Vulnerable Software and Affected Versions: Ivanti Avalanche versions prior to 6.4.x Description: The issue is related to an unrestricted file upload vulnerability in the web component of Ivanti Avalanche. This vulnerability allows an authenticated, privileged user to execute arbitrary...

PT-2024-18279 · WordPress · Woocommerce Customers Manager

Name of the Vulnerable Software and Affected Versions: WooCommerce Customers Manager WordPress plugin versions prior to 29.8 Description: The issue concerns a lack of authorization and CSRF protection in an AJAX action, allowing any authenticated user to retrieve a list of customer email addresse...

CVE-2024-32460 FreeRDP Out-Of-Bounds Read in interleaved_decompress

FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based based clients using /bpp:32 legacy GDI drawing path with a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, use modern drawin...

java-17-openjdk security update

17.0.11.0.9-2.0.1 - Add Oracle vendor bug URL 1:17.0.11.0.9-2 - Update to jdk-17.0.11+9 GA - Add openjdk-17.0.11+9.tar.xz to .gitignore - Sync java-17-openjdk-portable.specfile from openjdk-portable-rhel-8 - Update buildver from 7 to 9 - Update portablerelease from 1 to 3 - Change isga from 0 to ...

PT-2024-24144 · Pytorch +1 · Pytorch +1

Name of the Vulnerable Software and Affected Versions: Pytorch versions prior to 2.2.0 Description: The issue is related to an Out-of-bounds Read via the component torch/csrc/jit/mobile/flatbuffer loader.cpp. Recommendations: For versions prior to 2.2.0, update to version 2.2.0 or later to resolv...

PT-2024-21797 · WordPress · Otter Blocks

Name of the Vulnerable Software and Affected Versions: Otter Blocks WordPress plugin versions prior to 2.6.6 Description: The issue arises from the Otter Blocks WordPress plugin not properly escaping its mainHeadings blocks' attribute before appending it to the final rendered block. This allows...

Enforce and Report on PCI DSS v4 Compliance with Rapid7

The PCI Security Standards Council PCI SSC is a global forum that connects stakeholders from the payments and payment processing industries to craft and facilitate adoption of data security standards and relevant resources that enable safe payments worldwide. According to the PCI SSC website, “PC...