PT-2024-34389 · Oro · Oroplatform Cms

Name of the Vulnerable Software and Affected Versions: OroPlatform CMS version 5.1 Description: A cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Search parameter. This enables attackers to potentially manipulate...

PT-2024-35925 · Unknown · Najeeb Ahmad Simple User Registration

Name of the Vulnerable Software and Affected Versions: Najeeb Ahmad Simple User Registration versions through 5.5 Description: The issue is related to a Missing Authorization vulnerability, which allows accessing functionality not properly constrained by ACLs. This enables unauthorized access...

PT-2024-35939 · Elementor · The Plus Addons For Elementor Page Builder

Name of the Vulnerable Software and Affected Versions: The Plus Addons for Elementor Page Builder Lite versions through 5.6.14 Description: The issue is related to improper neutralization of input during web page generation, which allows for DOM-Based XSS. This means that an attacker could...

PT-2025-2750 · Linux +3 · Linux Kernel +3

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.6.74 Description: The issue is related to the Linux kernel, specifically in the drm/amdgpu component. It occurs when a CS fails validation and is rejected after job-num ibs is incremented, leading to a crash d...

PT-2024-16984 · WordPress · Stars Testimonials

Name of the Vulnerable Software and Affected Versions: Stars Testimonials plugin for WordPress versions up to, and including, 3.3.3 Description: The Stars Testimonials plugin for WordPress is vulnerable to Local File Inclusion via the stars-testimonials-with-slider-and-masonry-grid shortcode. Thi...

PT-2024-35143 · Tenda · Tenda Ac6V2

Name of the Vulnerable Software and Affected Versions: Tenda AC6V2 versions through 15.03.06.50 Description: The issue is a stack-based buffer overflow vulnerability in the setDoublePppoeConfig-guest ip check modules of Tenda AC6V2, where the mask argument can cause buffer overflows...

CVE-2024-45106 Apache Ozone: Improper authentication when generating S3 secrets

Improper authentication of an HTTP endpoint in the S3 Gateway of Apache Ozone 1.4.0 allows any authenticated Kerberos user to revoke and regenerate the S3 secrets of any other user. This is only possible if: ozone.s3g.secret.http.enabled is set to true. The default value of this configuration is...

PT-2025-11225

Name of the Vulnerable Software and Affected Versions libxslt versions prior to 1.1.43 libxslt versions 1.1.34-4ubuntu0.20.04.2 libxslt versions 1.1.35-1+deb12u1 Description libxslt is a library used for transforming XML files into other formats using XSLT. A use-after-free issue exists in the...

PT-2024-35961

Name of the Vulnerable Software and Affected Versions: Synapse versions prior to 1.120.1 Description: Synapse is an open-source Matrix homeserver. Enabling the dynamic thumbnails option or processing a specially crafted request could trigger the decoding and thumbnail generation of uncommon image...

PT-2024-17004 · WordPress · Wordpress Pinterest Plugin

Name of the Vulnerable Software and Affected Versions: WordPress Pinterest Plugin versions up to, and including, 1.8.8 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'gs pin widget' shortcode due to insufficient input sanitization and output escaping on...

PT-2024-36007 · Unknown · Mobile Security Framework

Name of the Vulnerable Software and Affected Versions: Mobile Security Framework MobSF versions prior to 3.9.7 Description: The issue concerns a server-side request forgery vulnerability. It occurs when the requests.get request in the check url method is set to allow redirects=True, allowing a...

PT-2024-9247 · Solana · @Solana/Web3.Js

Name of the Vulnerable Software and Affected Versions: @solana/web3.js versions 1.95.6 through 1.95.7 Description: A publish-access account was compromised for @solana/web3.js, a JavaScript library commonly used by Solana dapps. This allowed an attacker to publish unauthorized and malicious...

PT-2024-35960

Name of the Vulnerable Software and Affected Versions: Argo Workflows versions 3.5.7 through 3.5.8 Description: Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. When using --auth-mode=client, archived workflows can be retrieved with ...

PT-2024-35305 · Data443 · Data443 Lgpd Framework

Name of the Vulnerable Software and Affected Versions: Data443 LGPD Framework versions n/a through 2.0.2 Description: The issue is related to improper neutralization of input during web page generation, which allows reflected Cross-site Scripting XSS. This enables attackers to inject malicious...

PT-2024-36935 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.6.74 Description: A vulnerability in the Linux kernel has been resolved. The issue is related to the LoongArch system, where invalid huge pte entries should be marked as invalid pte table or have a single PAGE...

PT-2024-35856 · Unknown · Nutttaro Video Player For Wpbakery

Name of the Vulnerable Software and Affected Versions: NuttTaro Video Player for WPBakery versions n/a through 1.0.1 Description: The issue is related to improper neutralization of input during web page generation, which allows for stored Cross-site Scripting XSS. This means that an attacker can...

PT-2024-35855 · Elementor · Elementor Button Plus

Name of the Vulnerable Software and Affected Versions: Elementor Button Plus versions 1.3.3 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for stored cross-site scripting XSS. This means that an attacker can inject...

PT-2024-35857 · WordPress · Wp Mermaid

Name of the Vulnerable Software and Affected Versions: WP Mermaid versions 1.0.2 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows stored cross-site scripting XSS. This means an attacker can inject malicious scripts into the...

com.hazelcast:hazelcast Dependency in Confluence Data Center and Server

This High severity com.hazelcast:hazelcast Dependency vulnerability was introduced in versions 3.7 of Confluence Data Center and Server. This com.hazelcast:hazelcast Dependency vulnerability, with a CVSS Score of 7.6 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L allows an...

PT-2024-9174 · Jetbrains · Jetbrains Youtrack

Name of the Vulnerable Software and Affected Versions: JetBrains YouTrack versions prior to 2024.3.52635 Description: The issue is related to a potential ReDoS Regular Expression Denial of Service in the Ruby syntax detector of JetBrains YouTrack. This is due to a vulnerable RegExp with inefficie...