CVE-2024-51741

Redis is an open source, in-memory database that persists on disk. An authenticated with sufficient privileges may create a malformed ACL selector which, when accessed, triggers a server panic and subsequent denial of service. The problem is fixed in Redis 7.2.7 and 7.4.2...

PT-2025-4481 · Optimizely · Optimizely Configured Commerce

Name of the Vulnerable Software and Affected Versions: Optimizely Configured Commerce versions prior to 5.2.2408 Description: An issue was discovered in Optimizely Configured Commerce where the Commerce B2B application does not require email confirmation for newly created accounts. This allows th...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS due to improper input sanitization of the generateRowparameter in the \Writer\Html class. Remediation There is no fixed version for phpoffice/phpexcel. References - GitHub Commit Credit: Aleksey Solovev...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the currency parameter of the Currency.php script. An attacker can execute arbitrary JavaScript code in the user's browser by crafting malicious input that is improperly sanitized. PoC html...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS through the constructor of the Downloader class. An attacker can execute arbitrary JavaScript code in the user's browser by manipulating GET parameters name and type. Workaround This vulnerability can be mitigat...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS due to improper input sanitization passed through the quantity parameter. PoC html history.pushState'', '', '/'; document.forms0.submit; Remediation There is no fixed version for phpoffice/phpexcel. References -...

CVE-2024-56321

CVE-2024-56321 (GoCD) affects GoCD 18.9.0–24.4.0. The issue allows admins to abuse the backup configuration “post-backup script” to run arbitrary scripts on the hosting server/container as the GoCD user. In practice, impact is limited since an admin typically has host permissions, but in restrict...

CVE-2024-56321 GoCD can allow malicious GoCD admins to abuse backup configuration to gain additional host access

GoCD is a continuous deliver server. GoCD versions 18.9.0 through 24.4.0 inclusive can allow GoCD admins to abuse the backup configuration "post-backup script" feature to potentially execute arbitrary scripts on the hosting server or container as GoCD's user, rather than pre-configured scripts. I...

CVE-2024-56321 GoCD can allow malicious GoCD admins to abuse backup configuration to gain additional host access

GoCD is a continuous deliver server. GoCD versions 18.9.0 through 24.4.0 inclusive can allow GoCD admins to abuse the backup configuration "post-backup script" feature to potentially execute arbitrary scripts on the hosting server or container as GoCD's user, rather than pre-configured scripts. I...

PT-2025-2476 · Unknown · Blossom Shop

Name of the Vulnerable Software and Affected Versions: Blossom Shop versions 1.1.7 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. This can be achieved by tricking the user into...

PT-2025-2471 · Blossom Themes · Blossom Themes Vandana Lite

Name of the Vulnerable Software and Affected Versions: Blossom Themes Vandana Lite versions 1.1.9 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the software, allowing unauthorized actions to be performed on behalf of a user. Recommendations: For versions 1.1.9 and...

PT-2025-2477

Name of the Vulnerable Software and Affected Versions: Rara Theme Preschool and Kindergarten versions 1.2.1 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. This can be achieved by...

PT-2025-2506

Name of the Vulnerable Software and Affected Versions: Rara Business versions 1.2.5 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the software, allowing unauthorized actions to be performed on behalf of a user. This can lead to security breaches where an attacker tricks...

PT-2025-3170 · Wordpress Monsters · Preloader

Name of the Vulnerable Software and Affected Versions: Preloader by WordPress Monsters versions 1.2.3 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables potential...

PT-2026-3846

Name of the Vulnerable Software and Affected Versions Lodash versions 4.0.0 through 4.17.22 Description Lodash versions 4.0.0 through 4.17.22 are susceptible to prototype pollution within the .unset and .omit functions. An attacker can leverage crafted paths to trigger the deletion of methods fro...

PT-2024-32897 · Unknown · Smadar Sps

Name of the Vulnerable Software and Affected Versions: Smadar SPS affected versions not specified Description: The issue is related to the use of a broken or risky cryptographic algorithm, as identified by CWE-327. This could potentially lead to security risks due to the weakness in the...

CVE-2024-12986

A vulnerability, which was classified as critical, has been found in DrayTek Vigor2960 and Vigor300B 1.5.1.3/1.5.1.4. This issue affects some unknown processing of the file /cgi-bin/mainfunction.cgi/apmcfgupptim of the component Web Management Interface. The manipulation of the argument session...

AZL-55742 CVE-2024-56551 affecting package kernel for versions less than 6.6.64.2-1

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix usage slab after free +0.000021 BUG: KASAN: slab-use-after-free in drmschedentityflush+0x6cb/0x7a0 gpusched +0.000027 Read of size 8 at addr ffff8881b8605f88 by task amdpciunplug/2147 +0.000023 CPU: 6 PID: 2147...

CVE-2024-56362

Navidrome is an open source web-based music collection server and streamer. Navidrome stores the JWT secret in plaintext in the navidrome.db database file under the property table. This practice introduces a security risk because anyone with access to the database file can retrieve the secret. Th...

CVE-2024-56364

SimpleXLSX is software for parsing and retrieving data from Excel XLSx files. Starting in 1.0.12 and ending in 1.1.13, when calling the extended toHTMLEx method, it is possible to execute arbitrary JavaScript code. This vulnerability is fixed in 1.1.13...