PT-2024-20664 · Unitedthemes · Unitedthemes Brooklyn

Name of the Vulnerable Software and Affected Versions: UnitedThemes Brooklyn | Creative Multi-Purpose Responsive WordPress Theme versions 4.9.7.6 and earlier Description: The issue is related to the deserialization of untrusted data. This can potentially lead to security risks. There is no...

Privilege escalation

Certain WithSecure products allow Local Privilege Escalation. This affects WithSecure Client Security 15 and later, WithSecure Server Security 15 and later, WithSecure Email and Server Security 15 and later, and WithSecure Elements Endpoint Protection 17 and later...

PT-2024-20627 · Blocksy · Blocksy

Name of the Vulnerable Software and Affected Versions: Blocksy versions through 2.0.19 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can inject malicious...

PT-2024-1782

Name of the Vulnerable Software and Affected Versions: libexpat versions 2.5.0 and earlier Description: The issue is related to an uncontrolled resource consumption in the libexpat library, which is used for XML parsing. This can be exploited by a remote attacker to cause a denial of service. The...

PT-2024-14459 · Keap · Keap Official Opt-In Forms

Name of the Vulnerable Software and Affected Versions: Keap Official Opt-in Forms versions 1.0.11 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for stored cross-site scripting XSS. This means that an attacker can inject...

PT-2024-19034 · Wedevs · Wedevs Wp Erp

Name of the Vulnerable Software and Affected Versions: weDevs WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting versions 1.12.8 and earlier Description: The issue is related to an Improper Neutralization of Special Elements used in an SQL Command, also...

PT-2023-31705 · Zoho · Zoho Forms Form Plugin For Wordpress

Name of the Vulnerable Software and Affected Versions: Zoho Forms Form plugin for WordPress versions through 3.0.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows Stored XSS, which affects the Zoho...

PT-2023-31669 · Unknown · Basix Nex-Forms

Name of the Vulnerable Software and Affected Versions: Basix NEX-Forms – Ultimate Form Builder – Contact forms and much more versions through 8.5.5 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This...

SUSE: Security Advisory (SUSE-SU-2023:4727-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE-SU-2023:4727-1 Security update for catatonit, containerd, runc

This update of runc and containerd fixes the following issues: containerd: - Update to containerd v1.7.8. Upstream release notes: https://github.com/containerd/containerd/releases/tag/v1.7.8 CVE-2022-1996: Fixed CORS bypass in go-restful bsc1200528 catatonit: - Update to catatonit v0.2.0. Change...

Confluence XHR requests have the wrong content type

h3. Problem Watching or Stop watching a Confluence page and other operations see below list of identified endpoints will generate a request like the one below copied as curl from HAR capture for convenience: code:java curl 'https://confluence/rest/api/user/watch/content/9999999' \ -X 'DELETE' \ -...

PT-2023-20709 · Zippy · Zippy

Name of the Vulnerable Software and Affected Versions: Zippy versions 1.6.1 and earlier Description: The issue is related to the exposure of sensitive information to an unauthorized actor. This is a problem where sensitive data is made available to individuals who should not have access to it...

CVE-2023-5722

Using iterative requests an attacker was able to learn the size of an opaque response, as well as the contents of a server-supplied Vary header. This vulnerability affects Firefox 119...

PT-2023-30117 · Unknown · Saphira Connect

Name of the Vulnerable Software and Affected Versions: Saphira Connect versions prior to 9 Description: The issue affects Saphira Connect, allowing Remote Code Inclusion due to an Execution with Unnecessary Privileges vulnerability. Recommendations: For versions prior to 9, update to version 9 or...

PT-2023-19558 · Unknown · Reservation.Studio

Name of the Vulnerable Software and Affected Versions: Reservation.Studio Reservation.Studio widget plugin versions 1.0.11 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For...

ArgoCD 代码问题漏洞

ArgoCD is a software application. A declarative GitOps continuous delivery tool for Kubernetes. It continuously monitors running applications and compares the current live state with the desired target state e.g. configuration in the Git repository, automatically synchronizing and deploying...

WordPress Caldera Forms Plugin < 1.9.5 XSS Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:calderaforms:calderaforms"; ifdescription...

PT-2023-28670 · Froxlor · Froxlor

Name of the Vulnerable Software and Affected Versions: froxlor versions prior to 2.0.22 froxlor version 2.1.0 Description: The issue concerns Business Logic Errors in the GitHub repository froxlor/froxlor. Recommendations: For versions prior to 2.0.22, update to version 2.0.22 or later. For versi...

CVE-2023-34165

Unauthorized access vulnerability in the Save for later feature provided by AI Touch.Successful exploitation of this vulnerability may cause third-party apps to forge a URI for unauthorized access with zero permissions...

CVE-2023-34165

Unauthorized access vulnerability in the Save for later feature provided by AI Touch.Successful exploitation of this vulnerability may cause third-party apps to forge a URI for unauthorized access with zero permissions...