Medium: python3.11

Issue Overview: An issue was found in the CPython zipfile module affecting versions 3.12.2, 3.11.8, 3.10.13, 3.9.18, and 3.8.18 and prior. The zipfile module is vulnerable to "quoted-overlap" zip-bombs which exploit the zip format to create a zip-bomb with a high compression ratio. The fixed...

PT-2024-24599 · Unknown · Excalidraw

Name of the Vulnerable Software and Affected Versions: Excalidraw versions 0.16.x through 0.17.5 Excalidraw version 0.16.3 and earlier Description: A stored XSS vulnerability in Excalidraw's web embeddable component allows arbitrary JavaScript to be run in the context of the domain where the edit...

PT-2024-24668 · Unknown · What'S New Generator

Name of the Vulnerable Software and Affected Versions: What's New Generator versions n/a through 2.0.2 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Stored XSS attacks. Recommendations: For...

PT-2024-18837 · WordPress · Social Media Share Buttons & Social Sharing Icons

Name of the Vulnerable Software and Affected Versions: Social Media Share Buttons & Social Sharing Icons WordPress plugin versions prior to 2.8.9 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html...

PT-2024-3222 · Brocade · Brocade Sannav

Name of the Vulnerable Software and Affected Versions: Brocade SANnav versions prior to 2.3.1 Brocade SANnav version 2.3.0a Description: The issue is related to the class FileTransfer in Brocade SANnav, which uses the ssh-rsa signature scheme with a SHA-1 hash. This could allow a remote,...

PT-2024-24428 · Unknown · Epc Ez Form Calculator

Name of the Vulnerable Software and Affected Versions: EZ Form Calculator versions n/a through 2.14.0.3 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables potential attackers to...

PT-2024-21876 · WordPress · Advanced Search

Name of the Vulnerable Software and Affected Versions: Advanced Search WordPress plugin versions 1.1.6 and earlier Description: The issue concerns the lack of CSRF checks in some places within the Advanced Search WordPress plugin, which could allow attackers to make logged-in users perform unwant...

PT-2024-22472 · WordPress · The Simple Buttons Creator

Name of the Vulnerable Software and Affected Versions: The Simple Buttons Creator WordPress plugin versions 1.04 and earlier Description: The issue affects the add button function of the plugin, which lacks authorization and CSRF protection, allowing unauthenticated users to call it directly or v...

PT-2024-18277 · WordPress · Nps Computy Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: NPS computy WordPress plugin versions 2.7.5 and earlier Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for example, i...

PT-2024-15526 · WordPress · Woocommerce Customers Manager

Name of the Vulnerable Software and Affected Versions: WooCommerce Customers Manager WordPress plugin versions prior to 29.7 Description: The issue is related to an SQL injection that occurs because a parameter is not properly sanitised and escaped before being used in a SQL statement. This can b...

SUSE-SU-2024:1259-1 Security update for xen

This update for xen fixes the following issues: - CVE-2023-46842: Fixed denial of service due to Xen bug check triggered by HVM hypercalls XSA-454 in xen x86 bsc1221984 - CVE-2024-31142: Fixed incorrect logic for BTC/SRSO mitigations XSA-455 in xen x86 bsc1222302 - CVE-2024-2201: Fixed memory...

PT-2024-23876 · WordPress · Webtoffee Wordpress Comments Import & Export

Name of the Vulnerable Software and Affected Versions: WebToffee WordPress Comments Import & Export versions 2.3.5 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended action...

PT-2024-23521 · Unknown · Ametys Cms

Name of the Vulnerable Software and Affected Versions: Ametys CMS versions prior to 4.5.0 Description: The issue allows attackers to obtain sensitive information via exposed resources to the error scope. Recommendations: For Ametys CMS versions prior to 4.5.0, update to a version later than 4.5.0...

Google Chrome Security Update (stable-channel-update-for-desktop_10-2024-04) - Mac OS X

Google Chrome is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:google:chrome"; ifdescription...

PT-2024-14915 · WordPress · Inline Related Posts

Name of the Vulnerable Software and Affected Versions: Inline Related Posts WordPress plugin versions prior to 3.6.0 Description: The issue is related to missing authorization in an AJAX action, which allows any authenticated user, such as a subscriber, to retrieve the content of password-protect...

PT-2024-15886 · WordPress · Post Blocks +5

Name of the Vulnerable Software and Affected Versions: The Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel WordPress plugin versions prior to 2.2.76 Description: The issue concerns improper authorization in the WordPress plugin, allowing unauthenticated users to...

PT-2024-23889 · Unknown · Fg Drupal To Wordpress

Name of the Vulnerable Software and Affected Versions: FG Drupal to WordPress versions 3.70.3 and earlier Description: The issue is related to the insertion of sensitive information into log files. This could potentially expose sensitive data. Recommendations: For FG Drupal to WordPress versions...

PT-2024-4796 · Juniper Networks · Junos

Name of the Vulnerable Software and Affected Versions: Junos OS versions prior to 20.4R3-S7 Junos OS versions 21.1 prior to 21.1R3 Junos OS versions 21.2 prior to 21.2R2-S1, 21.2R3 Junos OS versions 21.3 prior to 21.3R1-S2, 21.3R2 Description: A Missing Authentication for Critical Function issue ...

PT-2024-18641 · Unknown · Mudler/Localai

Name of the Vulnerable Software and Affected Versions: mudler/localai versions prior to v2.10.0 Description: A command injection issue exists in the TranscriptEndpoint of mudler/localai, specifically within the audioToWav function used for converting audio files to WAV format for transcription. T...

PT-2024-23891 · WordPress · Wpkube Subscribe To Comments Reloaded

Name of the Vulnerable Software and Affected Versions: WPKube Subscribe To Comments Reloaded versions from n/a through 220725 Description: The issue is related to the insertion of sensitive information into log files. This can potentially expose sensitive data. Recommendations: For versions from...