PT-2024-35902 · Advance · Advanced

Name of the Vulnerable Software and Affected Versions: Advanced What should we write next about versions n/a through 1.0.3 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions o...

PT-2024-35305 · Data443 · Data443 Lgpd Framework

Name of the Vulnerable Software and Affected Versions: Data443 LGPD Framework versions n/a through 2.0.2 Description: The issue is related to improper neutralization of input during web page generation, which allows reflected Cross-site Scripting XSS. This enables attackers to inject malicious...

PT-2024-35419 · Zzcms · Zzcms

Name of the Vulnerable Software and Affected Versions: ZZCMS version 2023 Description: A SQL injection issue was discovered in the /q/show.php endpoint. This issue allows for potential SQL injection attacks. Recommendations: For ZZCMS version 2023, consider restricting access to the /q/show.php...

PT-2024-35837 · Unknown · Plumeria Web Design Blizzard Quotes

Name of the Vulnerable Software and Affected Versions: Plumeria Web Design Blizzard Quotes versions n/a through 1.3 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can perform unauthorized actions on the website. The estimat...

PT-2024-35999

Name of the Vulnerable Software and Affected Versions: rails-html-sanitizer version 1.6.0 Description: A possible XSS vulnerability exists with certain configurations of Rails::HTML::Sanitizer when used with Rails = 7.1.0. This vulnerability may allow an attacker to inject content if HTML5...

JVN#53958863: Multiple vulnerabilities in UNIVERGE IX/IX-R/IX-V series routers

UNIVERGE IX/IX-R/IX-V series routers provided by NEC Corporation contain multiple vulnerabilities listed below. Command injection CWE-77 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Base Score 7.2 CVE-2024-11013 Cross-site request forgery CWE-352 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N Base...

PT-2024-22947 · Radare2 · Radare2

Name of the Vulnerable Software and Affected Versions: radare2 version 5.8.8 Description: The issue allows an attacker to execute arbitrary code via the parse die function. This is a buffer overflow vulnerability that can be exploited to gain unauthorized access and execute malicious code...

PT-2024-17402 · WordPress · Project Manager

Name of the Vulnerable Software and Affected Versions: Project Manager WordPress Plugin affected versions not specified Description: The issue is an authenticated SQL injection vulnerability in the orderby parameter in the "/pm/v2/activites" API endpoint. This vulnerability affects the 'Project...

PT-2024-35847 · Unknown · Cool Plugins Cryptocurrency Widgets For Elementor

Name of the Vulnerable Software and Affected Versions: Cool Plugins Cryptocurrency Widgets For Elementor versions 1.6.4 and earlier Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion', which...

PT-2024-35886 · WordPress · Sparkle Wp Sparkle Elementor Kit

Name of the Vulnerable Software and Affected Versions: Sparkle WP Sparkle Elementor Kit versions through 2.0.9 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows DOM-Based XSS. This is a Cross-site...

PT-2024-17391 · Unknown · Code-Projects Farmacia

Name of the Vulnerable Software and Affected Versions: code-projects Farmacia version 1.0 Description: A vulnerability was found in the code, classified as problematic. It affects an unknown part of the file /vendas.php. The manipulation of the notaFiscal argument leads to cross-site scripting. T...

CVE-2024-53848

check-jsonschema is a CLI and set of pre-commit hooks for jsonschema validation. The default cache strategy uses the basename of a remote schema as the name of the file in the cache, e.g. https://example.org/schema.json will be stored as schema.json. This naming allows for conflicts. If an attack...

CVE-2024-53848

The CVE-2024-53848 issue affects the check-jsonschema tool (and related advisories) where the default caching uses the remote schema basename (e.g., https://example.org/schema.json) as the cache filename. This can allow a malicious schema URL to overwrite or be substituted in the cache leading to...

PT-2024-9897

Name of the Vulnerable Software and Affected Versions: FFmpeg version n7.0 Description: The issue is related to a Double Free error in the rkmpp retrieve frame function within the libavcodec/rkmppdec.c file of the FFmpeg multimedia library. This error can be exploited by a remote attacker to...

PT-2024-9170 · Jetbrains · Jetbrains Youtrack

Name of the Vulnerable Software and Affected Versions: JetBrains YouTrack versions prior to 2024.3.52635 Description: The issue is related to an uncontrolled modification of object prototype attributes in the data merge functions of JetBrains YouTrack. This can allow a remote attacker to implemen...

PT-2024-27095 · FFmpeg +1 · Ffmpeg +1

Name of the Vulnerable Software and Affected Versions: FFmpeg version n7.0 Description: The issue is related to a race condition in the VP9 decoder. This could lead to a data race if video encoding parameters were being exported, as the side data would be attached in the decoder thread while bein...

PT-2024-27100 · Zulip · Zulip

Name of the Vulnerable Software and Affected Versions: Zulip version 8.3 Description: The issue is related to Cross Site Scripting XSS via the construct copy div function in copy and paste.js. This allows for potential malicious script execution. Recommendations: For Zulip version 8.3, consider...

CVE-2024-52338 Apache Arrow R package: Arbitrary code execution when loading a malicious data file

Deserialization of untrusted data in IPC and Parquet readers in the Apache Arrow R package versions 4.0.0 through 16.1.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parquet data from untrusted sources for example, user-supplied input files. This...

PT-2024-16745 · Tumult · Tumult Hype Animations

Name of the Vulnerable Software and Affected Versions: Tumult Hype Animations plugin for WordPress versions up to, and including, 1.9.15 Description: The Tumult Hype Animations plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the hypeanimations...

PT-2024-17009 · WordPress · Faq Builder Ays Plugin

Name of the Vulnerable Software and Affected Versions: FAQ Builder AYS plugin for WordPress versions up to and including 1.7.1 Description: The FAQ Builder AYS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ays faq tab parameter due to insufficient input sanitization...