PT-2024-35855 · Elementor · Elementor Button Plus

Name of the Vulnerable Software and Affected Versions: Elementor Button Plus versions 1.3.3 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for stored cross-site scripting XSS. This means that an attacker can inject...

PT-2024-35856 · Unknown · Nutttaro Video Player For Wpbakery

Name of the Vulnerable Software and Affected Versions: NuttTaro Video Player for WPBakery versions n/a through 1.0.1 Description: The issue is related to improper neutralization of input during web page generation, which allows for stored Cross-site Scripting XSS. This means that an attacker can...

com.hazelcast:hazelcast Dependency in Confluence Data Center and Server

This High severity com.hazelcast:hazelcast Dependency vulnerability was introduced in versions 3.7 of Confluence Data Center and Server. This com.hazelcast:hazelcast Dependency vulnerability, with a CVSS Score of 7.6 and a CVSS Vector of CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L allows an...

PT-2024-16479 · 10Web · The Photo Gallery

Name of the Vulnerable Software and Affected Versions: The Photo Gallery by 10Web versions prior to 1.8.31 Description: The issue concerns a Stored Cross-Site Scripting XSS vulnerability. It arises because the plugin does not properly sanitise and escape some of its settings, allowing...

PT-2024-26463 · FFmpeg +2 · Ffmpeg +2

Name of the Vulnerable Software and Affected Versions: FFmpeg version n6.1.1 Description: A potential security issue exists in FFmpeg due to insufficient validation of certain parameters when parsing Speex codec extradata. This could lead to integer overflow conditions, resulting in undefined...

PT-2024-9174 · Jetbrains · Jetbrains Youtrack

Name of the Vulnerable Software and Affected Versions: JetBrains YouTrack versions prior to 2024.3.52635 Description: The issue is related to a potential ReDoS Regular Expression Denial of Service in the Ruby syntax detector of JetBrains YouTrack. This is due to a vulnerable RegExp with inefficie...

[SECURITY] [DLA 3973-1] redis security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-3973-1 [email protected] https://www.debian.org/lts/security/ Adrian Bunk November 28, 2024 https://wiki.debian.org/LTS -...

PT-2024-16540 · WordPress · The Restaurant & Cafe Addon For Elementor

Name of the Vulnerable Software and Affected Versions: The Restaurant & Cafe Addon for Elementor plugin for WordPress versions up to, and including, 1.5.9 Description: The issue allows authenticated attackers with Contributor-level access and above to extract data from private or draft posts...

PT-2024-16302 · WordPress · Logo Slider

Name of the Vulnerable Software and Affected Versions: The Logo Slider WordPress plugin versions prior to 4.5.0 Description: The issue concerns a Cross-Site Scripting vulnerability. It arises because the plugin does not properly sanitise and escape some of its Logo Settings when outputting them i...

Schneider Electric Modicon M340, MC80, and Momentum Unity M1E Improper Restriction of Operations Within the Bounds of a Memory Buffer (CVE-2024-8938)

Arbitrary code execution can potentially be achieved after a successful Man-In-The Middle attack followed by sending a crafted Modbus function call to tamper with memory area involved in memory size computation. This plugin only works with Tenable.ot. Please visit...

CVE-2024-53859 go-gh `auth.TokenForHost` violates GitHub host security boundary within a codespace

go-gh is a Go module for interacting with the gh utility and the GitHub API from the command line. A security vulnerability has been identified in go-gh that could leak authentication tokens intended for GitHub hosts to non-GitHub hosts when within a codespace. go-gh sources authentication tokens...

PT-2025-7892

Name of the Vulnerable Software and Affected Versions X.Org and Xwayland affected versions not specified Description A use-after-free flaw was found, where the root cursor is referenced as a global variable in the X server. If a client frees the root cursor, the internal reference points to freed...

PT-2024-35797 · Unknown · Phpgurukul Covid19 Testing Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul COVID 19 Testing Management System version 1.0 Description: A Reflected Cross Site Scripting XSS issue was found in the /covid-tms/patient-search-report.php endpoint, which allows remote attackers to execute arbitrary code via the...

PT-2025-15430 · Fortinet · Fortiisolator

Name of the Vulnerable Software and Affected Versions: Fortinet FortiIsolator versions prior to 2.4.6 Description: The issue is related to an improper neutralization of special elements used in an OS command, also known as 'OS Command Injection'. This allows a privileged attacker with a super-adm...

CVE-2024-11407

There exists a denial of service through Data corruption in gRPC-C++ - gRPC-C++ servers with transmit zero copy enabled through the channel arg GRPCARGTCPTXZEROCOPYENABLED can experience data corruption issues. The data sent by the application may be corrupted before transmission over the network...

CVE-2024-11407 Denial of Service through Data corruption in gRPC-C++

There exists a denial of service through Data corruption in gRPC-C++ - gRPC-C++ servers with transmit zero copy enabled through the channel arg GRPCARGTCPTXZEROCOPYENABLED can experience data corruption issues. The data sent by the application may be corrupted before transmission over the network...

CVE-2024-47248 Apache NimBLE: Buffer overflow in NimBLE MESH Bluetooth stack

Buffer Copy without Checking Size of Input 'Classic Buffer Overflow' vulnerability in Apache NimBLE. Specially crafted MESH message could result in memory corruption when non-default build configuration is used. This issue affects Apache NimBLE: through 1.7.0. Users are recommended to upgrade to...

PT-2024-32493 · Apache · Apache Nimble

Name of the Vulnerable Software and Affected Versions: Apache NimBLE versions through 1.7.0 Description: A Buffer Copy without Checking Size of Input, also known as a 'Classic Buffer Overflow', vulnerability in Apache NimBLE could result in memory corruption when a specially crafted MESH message ...

PT-2024-34506

Name of the Vulnerable Software and Affected Versions: TCPDF version 6.7.5 Description: A Local File Inclusion LFI issue has been discovered, allowing a user to read arbitrary files from the server's file system through the src tag in an img element, potentially exposing sensitive information...

PT-2024-16611 · WordPress · Sugar Calendar

Name of the Vulnerable Software and Affected Versions: Sugar Calendar – Simple Event Management plugin for WordPress versions prior to 3.3.0 Description: The issue is related to Reflected Cross-Site Scripting due to the use of add query arg and remove query arg without proper escaping on the URL...