PT-2024-17034 · Snow · Snow Software Inventory Agent

Name of the Vulnerable Software and Affected Versions: Snow Software Inventory Agent on Unix versions through 7.3.1 Description: The issue is related to an Improper Verification of Cryptographic Signature vulnerability, which allows File Manipulation through Snow Update Packages. Recommendations:...

PT-2024-12897 · Softwarex · Softwarex

Name of the Vulnerable Software and Affected Versions: SoftwareX version 11.3 Description: The issue is related to authentication bypass when an OAuth2 Client uses client secret jwt as its authentication method. This can be exploited via specially crafted requests. Recommendations: For version...

Out-of-bounds

In da, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08477148; Issue ID: ALPS08477148...

Out-of-bounds

In keyInstall, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08471742; Issue ID: ALPS08308608...

Out-of-bounds

In alac decoder, there is a possible out of bounds write due to an incorrect error handling. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS08441150; Issue ID: ALPS08441150...

PT-2024-14189 · WordPress · Crm Perks Forms – Wordpress Form Builder

Name of the Vulnerable Software and Affected Versions: CRM Perks Forms – WordPress Form Builder versions 1.1.2 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that...

PT-2024-19232 · Unknown · Magazine3 Schema & Structured Data For Wp & Amp

Name of the Vulnerable Software and Affected Versions: Magazine3 Schema & Structured Data for WP & AMP versions 1.25 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for stored cross-site scripting XSS. This means that an...

PT-2024-13670 · Buffalo · Buffalo Ls210D

Name of the Vulnerable Software and Affected Versions: Buffalo LS210D version 1.78-0.03 Description: The issue allows a remote authenticated attacker to inject arbitrary commands onto the NAS as root due to command injection in the ping utility. Recommendations: For Buffalo LS210D version...

MAL-2024-499 Malicious code in wlwz-2312-3605 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9c8e20d7791f6d48303630a98a99136a6291477da487e84b0fa772d70d69f762 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2024-19394 · Nextcloud · Nextcloud Files Zip App

Name of the Vulnerable Software and Affected Versions: Nextcloud files Zip app versions prior to 1.2.1 Nextcloud files Zip app versions prior to 1.4.1 Nextcloud files Zip app versions prior to 1.5.0 Description: The Nextcloud files Zip app is a tool to create zip archives from one or multiple fil...

PT-2024-14541 · WordPress · Ovic Responsive Wpbakery Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Ovic Responsive WPBakery WordPress plugin versions prior to 1.2.9 Description: The issue allows attackers with a subscriber+ account to update blog options, such as users can register and default role, via some of its AJAX actions. It also...

PT-2024-15004 · WordPress · Email Subscription Popup

Name of the Vulnerable Software and Affected Versions: Email Subscription Popup WordPress plugin versions prior to 1.2.20 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back ...

CVE-2023-46742 CubeFS leaks users key in logs

CubeFS is an open-source cloud-native file storage system. CubeFS prior to version 3.3.1 was found to leak users secret keys and access keys in the logs in multiple components. When CubeCS creates new users, it leaks the users secret key. This could allow a lower-privileged user with access to th...

CVE-2023-32876

In keyInstall, there is a possible information disclosure due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08308612; Issue ID: ALPS08308612...

PT-2024-19026 · Flycms · Flycms

Name of the Vulnerable Software and Affected Versions: FlyCms through abbaa5a Description: The issue allows XSS via the permission management feature. There is no information provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was...

ASB-A-292001469

In DevmemIntUnmapPMR of devicememserver.c, there is a possible arbitrary code execution due to a use after free. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2023-31840 · WordPress · Uncode

Name of the Vulnerable Software and Affected Versions: Uncode - Creative & WooCommerce WordPress Theme versions 2.8.6 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This...

PT-2023-31378 · WordPress · Soledad

Name of the Vulnerable Software and Affected Versions: Soledad – Multipurpose, Newspaper, Blog & WooCommerce WordPress Theme versions through 8.4.1 Description: The issue is related to Deserialization of Untrusted Data, which affects the Soledad theme for WordPress. This allows an attacker to...

CVE-2023-0011 Command Execution through Serial Interface of u-blox TOBY-L2

A flaw in the input validation in TOBY-L2 allows a user to execute arbitrary operating system commands using specifically crafted AT commands. This vulnerability requires physical access to the serial interface of the module or the ability to modify the system or software which uses its serial...

PT-2023-29876 · Themify · Themify Ultra

Name of the Vulnerable Software and Affected Versions: Themify Ultra versions through 7.3.5 Description: The issue is related to an Unrestricted Upload of File with Dangerous Type, which affects Themify Ultra. No information is provided about the estimated number of potentially affected devices...