PT-2024-26962 · WordPress · Responsive Contact Form Builder & Lead Generation Plugin

Name of the Vulnerable Software and Affected Versions: The Responsive Contact Form Builder & Lead Generation Plugin WordPress plugin versions 1.8.9 and earlier Description: The issue concerns the lack of sanitization and escaping of some settings in the plugin, which could allow high-privilege...

PT-2024-24804 · Unknown · Streamweasels Twitch Integration

Name of the Vulnerable Software and Affected Versions: StreamWeasels Twitch Integration versions 1.7.8 and earlier Description: The issue is related to the exposure of sensitive information to an unauthorized actor. This is a problem where sensitive data is made available to individuals who shoul...

PT-2024-24799 · Mycred · Mycred

Name of the Vulnerable Software and Affected Versions: myCred versions n/a through 2.6.3 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can inject malicious...

PT-2024-24602 · Librenms · Librenms

Name of the Vulnerable Software and Affected Versions: LibreNMS versions prior to 24.4.0 Description: The issue is related to improper sanitization on the Service template name, which can lead to stored Cross-site Scripting. This can be exploited by modifying the template name with crafted...

PT-2024-24689 · Melapress · Melapress Wp 2Fa

Name of the Vulnerable Software and Affected Versions: Melapress WP 2FA versions n/a through 2.6.2 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This means that an attacker can inje...

PT-2024-13797 · WordPress · Wp-Formassembly

Name of the Vulnerable Software and Affected Versions: WP-FormAssembly versions n/a through 2.0.10 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Stored XSS attacks. Recommendations: For...

MAL-2024-1255 Malicious code in deprecation-silencer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c51728830d7aed5b2134c0a91306e13560b271e8508376b3364616e35473898e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2024-18277 · WordPress · Nps Computy Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: NPS computy WordPress plugin versions 2.7.5 and earlier Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for example, i...

PT-2024-22472 · WordPress · The Simple Buttons Creator

Name of the Vulnerable Software and Affected Versions: The Simple Buttons Creator WordPress plugin versions 1.04 and earlier Description: The issue affects the add button function of the plugin, which lacks authorization and CSRF protection, allowing unauthenticated users to call it directly or v...

PT-2024-14945 · WordPress · Wordpress Ping Optimizer

Name of the Vulnerable Software and Affected Versions: WordPress Ping Optimizer plugin versions through 2.35.1.3.0 Description: The issue concerns the lack of CSRF checks in certain areas, potentially allowing attackers to trick logged-in users into performing unwanted actions, such as clearing...

PT-2024-23882 · WordPress · Wp Poll Maker

Name of the Vulnerable Software and Affected Versions: WP Poll Maker versions prior to 3.1 Description: The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as a 'Path Traversal' vulnerability. This allows for potential unauthorized access to files...

PT-2024-2720

Name of the Vulnerable Software and Affected Versions Rust versions prior to 1.77.2 Description A critical security flaw in the Rust standard library could be exploited to target Windows users and stage command injection attacks. The vulnerability allows attackers to execute arbitrary shell...

PT-2024-3006 · Google +4 · Google Chrome +4

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 123.0.6312.122 Description: The issue allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This can be achieved through the use of a specially designed web page, potentially...

CVE-2024-31442

Redon Hub is a Roblox Product Delivery Bot, also known as a Hub. In all hubs before version 1.0.2, all commands are capable of being ran by all users, including admin commands. This allows users to receive products for free and delete/create/update products/tags/etc. The only non-affected command...

CVE-2023-52345

In modem driver, there is a possible system crash due to improper input validation. This could lead to local information disclosure with System execution privileges needed...

PT-2024-23560 · Unknown · Ros2 Iron Irwini

Name of the Vulnerable Software and Affected Versions: ROS2 Iron Irwini versions 2 Description: An issue has been discovered where the system transmits messages in plaintext, exposing sensitive information and making it vulnerable to man-in-the-middle MitM attacks. This allows attackers to...

CVE-2024-29750

In kmexpdidinner of kmv.c, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2024-29757

there is a possible permission bypass due to Debug certs being allowlisted. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2024-29755

CVE-2024-29755 affects the tmu_get_pi function in tmu.c, causing an out-of-bounds read due to improper input validation. This can lead to local information disclosure without extra privileges or user interaction. The issue is addressed by Pixel updates; patch level 2024-04-05 or later is indicate...

PT-2024-22795 · Gotortc · Gotortc

Name of the Vulnerable Software and Affected Versions: gotortc versions 1.8.5 and prior Description: The issue is related to DOM-based cross-site scripting. The links page links.html appends the src GET parameter 0 in all of its links for 1-click previews. The context in which src is being append...