PT-2024-23891

Name of the Vulnerable Software and Affected Versions WPKube Subscribe To Comments Reloaded versions from n/a through 220725 Description The issue is related to the insertion of sensitive information into log files. This can potentially expose sensitive data. Recommendations For versions from n/a...

PT-2024-10791 · Unknown · Zoneminder

Name of the Vulnerable Software and Affected Versions: ZoneMinder versions prior to 1.34.21 Description: The issue allows remote attackers to execute arbitrary code, escalate privileges, and obtain sensitive information via the PHP SELF component in the classic/views/download.php file. This is a...

PT-2024-15524 · Openssl +1 · Openssl +1

Name of the Vulnerable Software and Affected Versions: Rapid7 Minerva Armor versions prior to 4.5.5 Description: The issue is a privilege escalation vulnerability that allows an authenticated attacker to elevate privileges and execute arbitrary code with SYSTEM privilege. This is caused by the...

GHSA-C33X-XQRF-C478 QUIC's Connection ID Mechanism vulnerable to Memory Exhaustion Attack

An attacker can cause its peer to run out of memory by sending a large number of NEWCONNECTIONID frames that retire old connection IDs. The receiver is supposed to respond to each retirement frame with a RETIRECONNECTIONID frame. The attacker can prevent the receiver from sending out the vast...

PT-2024-23: Server-Side Request Forgery (SSRF) in Mobile Security Framework (MobSF)

The vulnerability was identified in Mobile Security Framework MobSF, versions =3.9.7. The discovered SSRF vulnerability in Firebase Database Check can be exploited by an attacker to make server connect to internal-only services. It is possible to make internal requests in case a malicious app is...

PT-2024-22603 · Mbed Tls · Mbed Tls

Name of the Vulnerable Software and Affected Versions: Mbed TLS versions 3.5.x through 3.5.x before 3.6.0 Mbed TLS versions prior to 3.6.0 Description: An issue was discovered in Mbed TLS when negotiating the TLS version on the server side, it can fall back to the TLS 1.2 implementation of the...

PT-2024-17724 · WordPress · My Calendar

Name of the Vulnerable Software and Affected Versions: My Calendar WordPress plugin versions prior to 3.4.24 Description: The issue allows users with a role as low as Subscriber to perform Cross-Site Scripting attacks, depending on the permissions set by the admin. This is due to the plugin not...

PT-2024-3798 · Mozilla · Firefox

Name of the Vulnerable Software and Affected Versions: Firefox for iOS versions prior to 124 Description: The issue is related to the browser's handling of insecure elements added to a page after a delay, which could lead to a mixed content security status not being properly indicated. This could...

Stable Channel Update for Desktop

The Stable channel has been updated to 123.0.6312.105/.106/.107 for Windows and Mac and 123.0.6312.105 to Linux which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log. Security Fixes and Rewards Note: Access to bug details and links may be kep...

PT-2024-18112 · WordPress · Hubbub Lite

Name of the Vulnerable Software and Affected Versions: The Hubbub Lite WordPress plugin versions prior to 1.33.1 Description: The issue arises from the plugin not ensuring that users have access to password-protected posts before displaying their content in a meta tag. This could potentially expo...

PT-2024-22347 · Casaos · Casaos

Name of the Vulnerable Software and Affected Versions: CasaOS versions prior to 0.4.7 Description: The Casa OS Login page has a username enumeration issue. An attacker can enumerate usernames by observing the application's response. If the username is incorrect, the application returns "User does...

PT-2024-23491 · Scientech It Solution · Appointment Calendar

Name of the Vulnerable Software and Affected Versions: Scientech It Solution Appointment Calendar versions through 2.9.6 Description: The issue affects the Appointment Calendar, allowing for Reflected XSS due to improper neutralization of input during web page generation. Recommendations: For...

PT-2024-23488 · Unknown · Add Shortcodes Actions/Filters

Name of the Vulnerable Software and Affected Versions: Add Shortcodes Actions And Filters versions prior to 2.10 Description: The issue is related to improper neutralization of input during web page generation, which can lead to Cross-site Scripting XSS. Specifically, it allows Reflected XSS...

PT-2024-23454 · Unknown · Easy Social Feed

Name of the Vulnerable Software and Affected Versions: Easy Social Feed versions n/a through 6.5.6 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability in Easy Social Feed. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a w...

PT-2024-20337 · WordPress · The Ultimate Video Player

Name of the Vulnerable Software and Affected Versions: The Ultimate Video Player For WordPress versions prior to 2.2.3 Description: The issue is related to a lack of proper capability check when updating settings via a REST route, allowing users with Contributor and above roles to update them...

PT-2024-17933 · Grafana · Grafana

Name of the Vulnerable Software and Affected Versions: Countdown Timer for Elementor WordPress plugin versions prior to 1.3.7 Description: The issue concerns the Countdown Timer for Elementor WordPress plugin, where versions prior to 1.3.7 do not properly sanitise and escape some parameters when...

PT-2024-12798 · Themefusion · Fusion Builder

Name of the Vulnerable Software and Affected Versions: Fusion Builder versions prior to 3.11.2 Description: A Cross-Site Request Forgery CSRF issue affects the ThemeFusion Fusion Builder. This issue allows an attacker to perform unintended actions on a user's account. Recommendations: For version...

PT-2024-2450

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 9.2.1 Splunk Enterprise versions prior to 9.1.4 Splunk Enterprise versions prior to 9.0.9 Description The issue is related to the exposure of authentication tokens in Splunk Enterprise. This exposure can occ...

PT-2024-11724 · WordPress · Wordpress Countdown Widget

Name of the Vulnerable Software and Affected Versions: WordPress Countdown Widget versions 3.1.9.1 and earlier Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability that also allows Cross-Site Scripting XSS. This means an attacker could potentially trick a user into...

PT-2024-20395 · WordPress · Inline Related Posts

Name of the Vulnerable Software and Affected Versions: Inline Related Posts WordPress plugin versions prior to 3.5.0 Description: The issue concerns the Inline Related Posts WordPress plugin, which does not properly sanitise and escape some of its settings. This could allow high-privilege users,...