Debian dsa-5840 : chromium - security update

The remote Debian 12 host has packages installed that are affected by a vulnerability as referenced in the dsa-5840 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-5840-1 [email protected] https://www.debian.org/security/ Andres...

PT-2025-1677 · WordPress · Post Grid Master

Name of the Vulnerable Software and Affected Versions: The Post Grid Master plugin for WordPress versions up to, and including, 3.4.12 Description: The issue allows unauthenticated attackers to include and execute arbitrary files on the server, enabling the execution of any PHP code in those file...

PT-2025-1041 · Drupal · File Entity

Name of the Vulnerable Software and Affected Versions: File Entity versions 7.X- through 7.X-2.38 Description: The issue is related to improper neutralization of input during web page generation, allowing Cross-Site Scripting XSS attacks. This can enable a remote attacker to bypass security...

PT-2025-4459 · Tobias Spiess · Ts Comfort Db

Name of the Vulnerable Software and Affected Versions: Tobias Spiess TS Comfort DB versions prior to 2.0.8 Description: The issue is related to improper neutralization of input during web page generation, which allows reflected Cross-site Scripting XSS. This enables attackers to inject malicious...

PT-2025-2062 · Unknown · Kurniaramadhan E-Commerce-Php

Name of the Vulnerable Software and Affected Versions: kurniaramadhan E-Commerce-PHP version 1.0 Description: A critical issue affects an unknown functionality of the file /blog-details.php. The manipulation of the blog id argument leads to SQL injection. The attack can be launched remotely. The...

Security Bulletin: Vulnerability in Elasticsearch (CVE-2023-49921) affects IBM Watson CP4D Data Stores

Summary A potential vulnerability CVE-2023-49921 has been identified related to Elasticsearch that may affect IBM Watson CP4D Data Stores. This vulnerability have been addressed. Refer to details for additional information. Vulnerability Details CVEID:CVE-2023-49921 DESCRIPTION: An issue was...

Apache OpenMeetings vulnerable to Deserialization of Untrusted Data

Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 2.1.0 before 8.0.0 Description: Default clustering instructions at https://openmeetings.apache.org/Clustering.html doesn't specify white/black lists for OpenJPA this leads to possible deserialisation of untrusted...

Apache Airflow Fab Provider Insufficient Session Expiration vulnerability

Insufficient Session Expiration vulnerability in Apache Airflow Fab Provider. This issue affects Apache Airflow Fab Provider: before 1.5.2. When user password has been changed with admin CLI, the sessions for that user have not been cleared, leading to insufficient session expiration, thus logged...

CVE-2024-54676 Apache OpenMeetings: Deserialisation of untrusted data in cluster mode

Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 2.1.0 before 8.0.0 Description: Default clustering instructions at https://openmeetings.apache.org/Clustering.html doesn't specify white/black lists for OpenJPA this leads to possible deserialisation of untrusted...

PT-2025-1844 · Gitlab · Gitlab Ce/Ee

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 15.5 through 17.5.5 GitLab CE/EE versions 17.6 through 17.6.3 GitLab CE/EE versions 17.7 through 17.7.1 Description: An issue was discovered in GitLab CE/EE where unauthorized users could manipulate the status of issues ...

PT-2025-1027

Name of the Vulnerable Software and Affected Versions Ivanti Connect Secure versions prior to 22.7R2.5 Ivanti Policy Secure versions prior to 22.7R1.2 Ivanti Neurons for ZTA gateways versions prior to 22.7R2.3 Description A stack-based buffer overflow exists in Ivanti Connect Secure, Ivanti Polic...

PT-2025-3705 · WordPress · Wordpress Auction Plugin

Name of the Vulnerable Software and Affected Versions: WordPress Auction Plugin versions 3.7 and earlier Description: The issue allows high privilege users, such as editors, to perform Stored Cross-Site Scripting attacks due to the plugin not sanitizing and escaping some of its settings...

Google Chrome < 131.0.6778.264 Vulnerability

The version of Google Chrome installed on the remote Windows host is prior to 131.0.6778.264. It is, therefore, affected by a vulnerability as referenced in the 202501stable-channel-update-for-desktop advisory. - Type Confusion in V8 in Google Chrome prior to 131.0.6778.264 allowed a remote...

PT-2025-2906 · Unknown · Cubewp Forms

Name of the Vulnerable Software and Affected Versions: CubeWP Forms – All-in-One Form Builder versions 1.1.5 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. This can lead to...

PT-2025-2645 · Unknown · Themeglow Jobboard

Name of the Vulnerable Software and Affected Versions: ThemeGlow JobBoard Job listing versions 1.2.6 and earlier Description: The issue allows for the unrestricted upload of files with dangerous types, enabling the upload of a web shell to a web server. This can be exploited by uploading a...

PT-2025-1576 · WordPress · Rbs Image Gallery

Name of the Vulnerable Software and Affected Versions: Rbs Image Gallery WordPress plugin versions prior to 3.2.22 Description: The issue concerns the Rbs Image Gallery WordPress plugin, where some of its Gallery settings are not properly sanitised and escaped. This could allow high privilege...

PT-2025-1666 · WordPress · Tabs Shortcode

Name of the Vulnerable Software and Affected Versions: Tabs Shortcode WordPress plugin versions 2.0.2 and earlier Description: The issue concerns the Tabs Shortcode WordPress plugin, which does not validate and escape some of its shortcode attributes before outputting them back in a page or post...

PT-2025-1320 · Givewp · Givewp

The software that is vulnerable is the GiveWP WordPress Plugin, specifically versions from n/a through 3.19.3. The vulnerability is a Deserialization of Untrusted Data vulnerability, also known as an Unauthenticated PHP Object Injection, which allows attackers to take control of websites. This...

PT-2025-4409 · Wp Job Manager · Gravity Master Custom Field For Wp Job Manager

Name of the Vulnerable Software and Affected Versions: Gravity Master Custom Field For WP Job Manager versions n/a through 1.3 Description: The issue is related to improper neutralization of input during web page generation, also known as Cross-site Scripting, which allows Reflected XSS. This mea...

PT-2025-4519 · WordPress · Huurkalender Wp

Name of the Vulnerable Software and Affected Versions: Huurkalender WP versions 1.5.6 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for stored cross-site scripting XSS. This means that an attacker can inject malicious...