WordPress Category Ajax Filter Plugin <= 2.8.2 is vulnerable to Local File Inclusion

Software Category Ajax Filter Type Plugin Vulnerable versions = 2.8.2 Fixed in 2.8.3 OWASP Top 10 A1: Injection Classification Local File Inclusion CVE CVE-2024-10871 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 41b4026eef43 Credits Le Ngoc Anh Required privilege...

Fortinet FortiProxy Out-of-bound Write in sslvpnd (FG-IR-24-255)

RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response Access-Accept, Access-Reject, or Access-Challenge to any other response using a chosen-prefix collision attack against MD5 Response Authenticator signature. Note that Nessus has...

CVE-2024-11498 Resource exhaustion via Stack overflow in libjxl

There exists a stack buffer overflow in libjxl. A specifically-crafted file can cause the JPEG XL decoder to use large amounts of stack space up to 256mb is possible, maybe 512mb, potentially exhausting the stack. An attacker can craft a file that will cause excessive memory usage. We recommend...

WordPress Video Lessons Manager Plugin <= 1.8.2 is vulnerable to Cross Site Scripting (XSS)

Software Video Lessons Manager Type Plugin Vulnerable versions = 1.8.2 Fixed in 1.8.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-11202 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID de6edf652333 Credits Peter...

PT-2024-35703 · Joplin · Joplin

Name of the Vulnerable Software and Affected Versions: Joplin versions prior to 3.0.3 Description: The issue allows attackers to abuse the lack of filtering of URI schemes in the openExternal function to obtain remote code execution in Windows environments. There are no known workarounds for this...

PT-2025-3624

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.74 Description The issue is related to the wifi mac80211 component in the Linux kernel, where the size of an unsigned long is 4 bytes on 32-bit systems, while a u64 is 8 bytes. This leads to incorrect bit...

PT-2025-16238

Name of the Vulnerable Software and Affected Versions: libsoup affected versions not specified Description: A flaw was found in libsoup, where the soup headers parse request function may be vulnerable to an out-of-bound read. This flaw allows a malicious user to use a specially crafted HTTP reque...

[SECURITY] [DLA 3965-1] ghostscript security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3965-1 [email protected] https://www.debian.org/lts/security/ Adrian Bunk November 24, 2024 https://wiki.debian.org/LTS -...

Debian dla-3965 : ghostscript - security update

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3965 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3965-1 [email protected]...

[SECURITY] [DSA 5817-1] chromium security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5817-1 [email protected] https://www.debian.org/security/ Andres Salomon November 23, 2024 https://www.debian.org/security/faq -...

PT-2024-36870

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.74 Description A vulnerability in the Linux kernel has been resolved, related to the f2fs file system. The issue occurs when creating a snapshot on an LVM device, which updates the discard max bytes to zero,...

CVE-2024-45719 Apache Answer: Predictable Authorization Token Using UUIDv1

Inadequate Encryption Strength vulnerability in Apache Answer. This issue affects Apache Answer: through 1.4.0. The ids generated using the UUID v1 version are to some extent not secure enough. It can cause the generated token to be predictable. Users are recommended to upgrade to version 1.4.1,...

PT-2024-33249 · Qurouter · Qurouter

Name of the Vulnerable Software and Affected Versions: QuRouter versions prior to 2.4.4.106 Description: An OS command injection issue has been reported, potentially allowing local network attackers to execute commands if exploited. Recommendations: For QuRouter versions prior to 2.4.4.106, updat...

Oracle Linux 7 : xerces-c (ELSA-2024-8795)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-8795 advisory. 3.1.1-10.0.1 - back port fix for CVE-2023-37536 Orabug: 37241079 Tenable has extracted the preceding description block directly from the Oracle Linux security...

PT-2024-10401

Name of the Vulnerable Software and Affected Versions Tornado versions prior to 6.4.2 Description The algorithm used for parsing HTTP cookies in Tornado sometimes has quadratic complexity, leading to excessive CPU consumption when parsing maliciously-crafted cookie headers. This parsing occurs in...

PT-2024-16570 · Codeastrology · The Product Table For Woocommerce

Name of the Vulnerable Software and Affected Versions: The Product Table for WooCommerce by CodeAstrology plugin for WordPress versions up to, and including, 3.5.1 Description: The issue allows unauthenticated attackers to expose sensitive information via the var dump table parameter. This makes ...

CVE-2024-52067 Apache NiFi: Potential Insertion of Sensitive Parameter Values in Debug Log

Apache NiFi 1.16.0 through 1.28.0 and 2.0.0-M1 through 2.0.0-M4 include optional debug logging of Parameter Context values during the flow synchronization process. An authorized administrator with access to change logging levels could enable debug logging for framework flow synchronization, causi...

PT-2024-34601 · Gibbon · Gibbon

Name of the Vulnerable Software and Affected Versions: Gibbon versions prior to 28.0.00 Description: The issue allows a remote attacker to obtain sensitive information via the email parameter found in the "/Gibbon/modules/User Admin/user manage editProcess.php" API endpoint. Recommendations: For...

PT-2025-23197 · Mikrotik · Mikrotik Routeros

Name of the Vulnerable Software and Affected Versions: MikroTik RouterOS version 6.40.5 Description: The SMB service in MikroTik RouterOS contains a memory corruption issue. Remote, unauthenticated attackers can exploit this by sending specially crafted packets, triggering a null pointer...

WordPress CM Table Of Contents – WordPress TOC Plugin Plugin < 1.2.4 is vulnerable to Cross Site Scripting (XSS)

Software CM Table Of Contents – WordPress TOC Plugin Type Plugin Vulnerable versions 1.2.4 Fixed in 1.2.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-5029 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 7d80877428bb...