PT-2024-21229 · Metagauss · Registrationmagic

Name of the Vulnerable Software and Affected Versions: Metagauss RegistrationMagic versions 5.2.5.9 and earlier Description: The issue is related to a Missing Authorization vulnerability in Metagauss RegistrationMagic. Recommendations: For Metagauss RegistrationMagic versions 5.2.5.9 and earlier,...

PT-2024-22748 · Unknown · Aam Advanced Access Manager

Name of the Vulnerable Software and Affected Versions: AAM Advanced Access Manager versions through 6.9.20 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. Recommendations: For versions...

CVE-2022-47036

Siklu TG Terragraph devices before approximately 2.1.1 have a hardcoded root password that has been revealed via a brute force attack on an MD5 hash. It can be used for "debug login" by an admin. NOTE: the vulnerability is not fixed by the 2.1.1 firmware; instead, it is fixed in newer hardware,...

PT-2024-19077 · Unknown · Openharmony

Name of the Vulnerable Software and Affected Versions: OpenHarmony versions prior to 3.2.4 Description: The issue allows a local attacker to cause a sensitive information leak through insecure storage. A local attacker can exploit this to gain access to sensitive information. Recommendations: For...

PT-2024-14241 · Unknown · Easy Paypal & Stripe Buy Now Button

Name of the Vulnerable Software and Affected Versions: Easy PayPal & Stripe Buy Now Button versions 1.8.1 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the Easy PayPal & Stripe Buy Now Button. This issue allows for malicious requests to be made on behalf of the user...

PT-2024-14019 · Ibm · Ibm Powersc

Name of the Vulnerable Software and Affected Versions: IBM PowerSC versions 1.3 through 2.1 Description: The issue allows an authenticated user to impersonate another user on the system because sessions are not invalidated after logout. Recommendations: For IBM PowerSC versions 1.3 through 2.1,...

PT-2024-37896 · Grafana · Grafana

Name of the Vulnerable Software and Affected Versions: Grafana affected versions not specified Description: A medium severity security fix has been released for Grafana. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability...

PT-2024-15192 · WordPress · Wpforms Pro

Name of the Vulnerable Software and Affected Versions: WPForms Pro versions up to, and including, 1.8.5.3 Description: The WPForms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form submission parameters due to insufficient input sanitization and output escaping. This...

PT-2023-29011 · Undefined · Undefined

Name of the Vulnerable Software and Affected Versions: No vulnerable software or affected versions specified. Description: A previously reported issue was withdrawn by its CNA after further investigation showed it was not a security issue. Recommendations: At the moment, there is no information...

PT-2023-31367 · WordPress · Wp Photo Album Plus

Name of the Vulnerable Software and Affected Versions: WP Photo Album Plus versions through 8.5.02.005 Description: The issue is related to an Authorization Bypass Through User-Controlled Key. This allows for unauthorized access. Recommendations: For WP Photo Album Plus versions through 8.5.02.00...

PT-2023-31082 · Oceanwp · Ocean Extra

Name of the Vulnerable Software and Affected Versions: Ocean Extra versions through 2.2.2 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability in OceanWP Ocean Extra. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web...

PT-2023-31100 · Unknown · Fabio Marzocca List All Posts By Authors

Name of the Vulnerable Software and Affected Versions: Fabio Marzocca List all posts by Authors, nested Categories and Titles versions 2.7.10 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allo...

PT-2023-36300 · Suse · Container-Suseconnect

Name of the Vulnerable Software and Affected Versions: container-suseconnect affected versions not specified Description: The issue is related to a security release in the go 1.21 package. The container-suseconnect package has been rebuilt with this security release to address the issue. There is...

PT-2023-30972 · Unknown · Time Slots Booking Calendar

Name of the Vulnerable Software and Affected Versions: Time Slots Booking Calendar version 4.0 Description: The issue concerns Multiple Stored Cross-Site Scripting XSS problems. These issues can be exploited via several parameters, including name, plugin sms api key, plugin sms country code,...

PT-2023-7346 · Foxit · Foxit Pdf Reader

Name of the Vulnerable Software and Affected Versions: Foxit PDF Reader versions 12.1.2.15356 Description: The issue is related to a type confusion vulnerability in the way Foxit Reader handles field value properties. This can be triggered by a specially crafted Javascript code inside a malicious...

Exploit for Improper Access Control in Pnpm

pnpm vs npm exploit This repo showcases how a difference...

PT-2023-35514 · Google · Chromium

Name of the Vulnerable Software and Affected Versions: Chromium version 118.0.5993.88 Description: The issue concerns an unspecified security fix. There is no information provided about the estimated number of potentially affected devices worldwide or details about real-world incidents where this...

PT-2023-13365 · Ibm · Ibm Jazz Foundation

Name of the Vulnerable Software and Affected Versions: IBM Jazz Foundation IBM Engineering Lifecycle Management versions 6.0.6 through 7.0.2 Description: The issue could disclose sensitive version information to a user, which could be used in further attacks against the system. Recommendations: F...

PT-2023-27150 · Unknown +1 · Routinator +1

Name of the Vulnerable Software and Affected Versions: Routinator versions up to and including 0.12.1 Description: The issue is caused by insufficient input checking in the bcder library, which may lead to a crash when trying to parse certain malformed RPKI objects. Recommendations: For versions ...

PT-2023-26396 · Unknown · Email Sender

Name of the Vulnerable Software and Affected Versions: Elastic Email Sender plugin versions 1.2.6 and earlier Description: The issue is related to an Authenticated Stored Cross-Site Scripting XSS vulnerability. This means that an attacker with admin+ privileges can inject malicious scripts into t...