CVE-2024-56733 Password Pusher Allows Session Token Interception Leading to Potential Hijacking

Password Pusher is an open source application to communicate sensitive information over the web. A vulnerability has been reported in versions 1.50.3 and prior where an attacker can copy the session cookie before a user logs out, potentially allowing session hijacking. Although the session token ...

CVE-2024-52589 Moderators can view Screened emails even when the “moderators view emails” option is disabled in Discourse

Discourse is an open source platform for community discussion. Moderators can see the Screened emails list in the admin dashboard, and through that can learn the email of a user. This problem is patched in the latest version of Discourse. Users unable to upgrade should remove moderator role from...

PT-2024-35446 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to the latest version Description: Discourse is an open source platform for community discussion. Users clicking on the lightbox thumbnails could be affected. The issue is resolved in the latest version of Discourse...

PT-2024-33675 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to the latest version Description: The issue affects sites using Discourse Connect with local logins enabled, potentially allowing attackers to bypass Discourse Connect and create accounts or log in. This problem has...

PT-2024-17228 · WordPress · Taeggie Feed

Name of the Vulnerable Software and Affected Versions: Taeggie Feed plugin for WordPress versions up to, and including, 0.1.9 Description: The issue is related to stored cross-site scripting via the plugin's 'taeggie-feed' shortcode due to insufficient input sanitization and output escaping on...

PT-2024-11718 · WordPress · Popup Maker

Name of the Vulnerable Software and Affected Versions: Popup Maker versions 1.17.1 and earlier Description: A broken access control vulnerability has been identified in the WordPress Popup Maker plugin, allowing exploitation of incorrectly configured access control security levels. This issue...

PT-2024-12722 · Unknown · Jupiter X Core

Name of the Vulnerable Software and Affected Versions: JupiterX Core versions 3.0.0 through 3.3.0 Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. This results in broken access control...

PT-2024-12455 · 10Web · Photo Gallery

Name of the Vulnerable Software and Affected Versions: Photo Gallery by 10Web versions 1.8.15 and earlier Description: A broken access control vulnerability has been identified in the WordPress Photo Gallery by 10Web plugin. This issue allows exploiting incorrectly configured access control...

PT-2024-12829 · Unknown +1 · Accordion Slider +1

Name of the Vulnerable Software and Affected Versions: Accordion and Accordion Slider versions 1.2.4 and earlier Description: The issue affects the Accordion and Accordion Slider plugin due to missing authorization, allowing exploitation of incorrectly configured access control security levels...

KLA78283 Multiple vulnerabilities in Apache Tomcat

Multiple vulnerabilities were found in Apache Tomcat. Malicious users can exploit these vulnerabilities to execute arbitrary code, bypass security restrictions, cause denial of service. Below is a complete list of vulnerabilities: 1. A remote code execution vulnerability can be exploited remotely...

PostgreSQL: Multiple Vulnerabilities

Background PostgreSQL is an open source object-relational database management system. Description Multiple vulnerabilities have been discovered in PostgreSQL. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details. Workaroun...

hull.js Code Injection Vulnerability

Versions of the library from 0.2.2 to 1.0.9 are vulnerable to the arbitrary code execution due to unsafe usage of new Function... in the module that handles points format. Applications passing the 3rd parameter to the hull function without sanitising may be impacted. The vulnerability has been...

PT-2024-34956 · Figoli Quinn & Associates · Figoli Quinn & Associates Mobile Kiosk

Name of the Vulnerable Software and Affected Versions: Figoli Quinn & Associates Mobile Kiosk versions n/a through 1.3.0 WordPress Mobile Kiosk Plugin version 1.3.0 Description: The issue is related to improper neutralization of input during web page generation, which allows stored cross-site...

Perl: Multiple Vulnerabilities

Background Perl is Larry Wall’s Practical Extraction and Report Language. Description Multiple vulnerabilities have been discovered in Perl. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details. Workaround There is no know...

X.Org X server, XWayland: Multiple Vulnerabilities

Background The X Window System is a graphical windowing system based on a client/server model. Description Multiple vulnerabilities have been discovered in X.Org X server and XWayland. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE...

PT-2024-16760 · Unknown · Code-Projects Job Recruitment

Name of the Vulnerable Software and Affected Versions: code-projects Job Recruitment versions prior to the latest release Description: A critical issue affects some unknown processing of the file /login.php. The manipulation of the argument email leads to SQL injection. The attack may be initiate...

KLA77117 OSI vulnerability in Mozilla Thunderbird

Information disclosure vulnerability was found in Mozilla Thunderbird. Malicious users can exploit this vulnerability to obtain sensitive information. Original advisories MFSA2024-62 Related products Mozilla-Thunderbird CVE list CVE-2024-11159 unknown Solution Update to the latest version Downloa...

Vaultwarden -- Multiple vulnerabilities

The Vaultwarden project reports: This release further fixed some CVE Reports reported by a third party security auditor and we recommend everybody to update to the latest version as soon as possible...

PT-2024-16580 · Zoho · Zoho Manageengine Sharepoint Manager Plus

Name of the Vulnerable Software and Affected Versions: ManageEngine SharePoint Manager Plus versions 4503 and prior Description: The issue is an authenticated XML External Entity XXE vulnerability in the Management option. This vulnerability impacts specific versions of the software, allowing...

CyberPanel upgrademysqlstatus authentication bypass and command injection

Added: 11/07/2024 Background CyberPanel is a web hosting control panel. Problem A pair of vulnerabilities in the upgrademysqlstatus web resource could allow a remote attacker to bypass authentication using a PUT request and execute arbitrary commands with a specially crafted statusfile parameter...