PT-2024-36832 · Tcpdf +1 · Tcpdf +1

Name of the Vulnerable Software and Affected Versions: TCPDF versions prior to 6.8.0 Description: An issue was discovered in the Error function, which lacks an htmlspecialchars call for the error message. This could potentially lead to issues with error message handling. Recommendations: For...

PT-2024-17347

Name of the Vulnerable Software and Affected Versions GiveWP WordPress plugin versions prior to 3.19.0 Description The issue arises from the plugin's failure to properly sanitise and escape a parameter before outputting it back in the page. This leads to a Reflected Cross-Site Scripting error,...

PT-2024-36417 · Unknown · Dcat-Admin

Name of the Vulnerable Software and Affected Versions: Dcat-Admin versions 2.2.0-beta through 2.2.2-beta Description: The issue is a Cross-Site Scripting XSS vulnerability. It can be exploited via the "/admin/auth/menu" and "/admin/auth/extensions" API endpoints. Recommendations: For versions...

PT-2024-36964 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.6.74 Description: The issue is related to the netfilter component of the Linux kernel, specifically with the nf tables subsystem. The problem arises when the nf tables chain destroy function is used from call...

PT-2024-36828 · Tcpdf +1 · Tcpdf +1

Name of the Vulnerable Software and Affected Versions: TCPDF versions prior to 6.8.0 Description: An issue was discovered in the setSVGStyles function, which does not sanitize the SVG font-family attribute. This could potentially lead to security issues, although specific details about the nature...

PT-2024-36831 · Tcpdf +1 · Tcpdf +1

Name of the Vulnerable Software and Affected Versions: TCPDF versions prior to 6.8.0 Description: An issue was discovered in the unserializeTCPDFtag function, which uses loose comparison != and does not utilize a constant-time function to compare TCPDF tag hashes. This could potentially lead to...

PT-2024-17290 · WordPress · Dn Shipping By Weight

Name of the Vulnerable Software and Affected Versions: DN Shipping by Weight for WooCommerce WordPress plugin version 1.2 and earlier Description: The issue concerns the lack of CSRF verification when updating the plugin's settings. This could allow attackers to make a logged-in administrator...

CVE-2024-56510

Marp Core vulnerability CVE-2024-56510 affects Marp Core versions from v3.0.2 to v3.9.0 and v4.0.0, where improper neutralization of HTML sanitization leads to Cross-Site Scripting (XSS). The issue is addressed in Marp Core v3.9.1 and v4.0.1. If immediate upgrading is not feasible, a workaround i...

Amazon Redshift Python Connector vulnerable to SQL Injection

Summary A SQL injection in the Amazon Redshift Python Connector in version 2.1.4 allows a user to gain escalated privileges via schema injection in the getschemas, gettables, or getcolumns Metadata APIs. Users should upgrade to the driver version 2.1.5 or revert to driver version 2.1.3. Impact A...

PT-2024-16838 · WordPress · Wpforms

Name of the Vulnerable Software and Affected Versions: WPForms WordPress plugin versions prior to 1.9.2.3 Description: The issue allows high privilege users, such as admin, to perform Stored Cross-Site Scripting attacks even when the unfiltered html capability is disallowed, for example in...

PT-2024-10260 · Oracle · Primavera P6 Enterprise Project Portfolio Management

Name of the Vulnerable Software and Affected Versions: Primavera P6 Enterprise Project Portfolio Management versions 20.12.1.0 through 20.12.21.5 Primavera P6 Enterprise Project Portfolio Management versions 21.12.1.0 through 21.12.20.0 Primavera P6 Enterprise Project Portfolio Management version...

PT-2024-10244 · Oracle +8 · Mysql Server +7

Name of the Vulnerable Software and Affected Versions: MySQL Server versions 8.0.40 and prior MySQL Server versions 8.4.3 and prior MySQL Server versions 9.1.0 and prior Description: The issue is related to a vulnerability in the InnoDB component of Oracle MySQL Server, which can be easily...

PT-2024-10243 · Oracle +8 · Mysql Server +7

Name of the Vulnerable Software and Affected Versions: MySQL Server versions 8.0.40 and prior MySQL Server versions 8.4.3 and prior MySQL Server versions 9.1.0 and prior Description: The issue is related to the InnoDB component of Oracle MySQL Server and is caused by inadequate authorization...

PT-2024-17413 · WordPress · Advanced Google Recaptcha Plugin

Name of the Vulnerable Software and Affected Versions: Advanced Google reCAPTCHA plugin for WordPress versions up to 1.25 Description: The issue arises because the plugin does not utilize a strong unique key when generating an unblock request. This makes it possible for unauthenticated attackers ...

CVE-2018-25106 webuidesigning NebulaX Theme Legacy.php nebula_send_to_hubspot sql injection

A vulnerability, which was classified as critical, has been found in webuidesigning NebulaX Theme up to 5.0 on WordPress. This issue affects the function nebulasendtohubspot of the file libs/Legacy/Legacy.php. The manipulation leads to sql injection. The attack may be initiated remotely. The patc...

CVE-2018-25106

The NebulaX Theme for WordPress (versions up to 5.0) contains a SQL injection vulnerability in the function nebula_send_to_hubspot (libs/Legacy/Legacy.php). The issue can be triggered remotely and may lead to data exposure or modification. A patch named 41230a81db0f671c570c2644bc2f80565ca83c5a fi...

GHSA-VQ94-9PFV-CCQR SQL injection in Apache Traffic Control

An SQL injection vulnerability in Traffic Ops in Apache Traffic Control = 8.0.0 allows a privileged user with role "admin", "federation", "operations", "portal", or "steering" to execute arbitrary SQL against the database by sending a specially-crafted PUT request. Users are recommended to upgrad...

CVE-2024-45387

An SQL injection vulnerability in Traffic Ops in Apache Traffic Control = 8.0.0 allows a privileged user with role "admin", "federation", "operations", "portal", or "steering" to execute arbitrary SQL against the database by sending a specially-crafted PUT request. Users are recommended to upgrad...

CVE-2024-45387 Apache Traffic Control: SQL Injection in Traffic Ops endpoint PUT deliveryservice_request_comments

An SQL injection vulnerability in Traffic Ops in Apache Traffic Control = 8.0.0 allows a privileged user with role "admin", "federation", "operations", "portal", or "steering" to execute arbitrary SQL against the database by sending a specially-crafted PUT request. Users are recommended to upgrad...

CVE-2024-45387 Apache Traffic Control: SQL Injection in Traffic Ops endpoint PUT deliveryservice_request_comments

An SQL injection vulnerability in Traffic Ops in Apache Traffic Control = 8.0.0 allows a privileged user with role "admin", "federation", "operations", "portal", or "steering" to execute arbitrary SQL against the database by sending a specially-crafted PUT request. Users are recommended to upgrad...