OESA-2024-2252 rubygem-puma security update

A simple, fast, threaded, and highly concurrent HTTP 1.1 server for Ruby/Rack applications. Security Fixes: Puma is a simple, fast, multi-threaded, parallel HTTP 1.1 server for Ruby/Rack applications. When using Puma behind a proxy that does not properly validate that the incoming HTTP request...

SUSE CVE-2024-47167

Gradio is an open-source Python package designed for quick prototyping. This vulnerability relates to Server-Side Request Forgery SSRF in the /queue/join endpoint. Gradio's asyncsaveurltocache function allows attackers to force the Gradio server to send HTTP requests to user-controlled URLs. This...

PT-2024-39928 · 07Flycrm +1 · 07Flycrm +1

Name of the Vulnerable Software and Affected Versions: 07FLYCMS versions up to 1.2.0 07FLY-CMS versions up to 1.2.0 07FlyCRM versions up to 1.2.0 Description: A critical vulnerability was found in the affected products, which affects the pictureUpload function of the file /admin/File/pictureUploa...

PT-2024-39927 · 07Flycrm +1 · 07Flycrm +1

Name of the Vulnerable Software and Affected Versions: 07FLYCMS versions up to 1.2.0 07FLY-CMS versions up to 1.2.0 07FlyCRM versions up to 1.2.0 Description: A critical vulnerability has been found in the affected products, affecting the fileUpload function of the file /admin/File/fileUpload. Th...

PT-2024-32960 · Unknown · Cm Tooltip Glossary

Name of the Vulnerable Software and Affected Versions: CM Tooltip Glossary versions through 4.3.9 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS attacks. Recommendations: For...

PT-2025-25265 · Trend Micro · Trend Micro Endpoint Encryption

Name of the Vulnerable Software and Affected Versions: Trend Micro Endpoint Encryption versions prior to 6.0.0.4013 Description: An insecure deserialization operation in the Trend Micro Endpoint Encryption PolicyServer could lead to a pre-authentication remote code execution on affected...

PT-2024-39774

Name of the Vulnerable Software and Affected Versions Hunk Companion plugin for WordPress versions prior to 1.9.0 WP Query Console versions affected versions not specified Description The Hunk Companion plugin for WordPress has a flaw allowing unauthorized plugin installation and activation. This...

PT-2024-33245 · Sbondco · Sbondco Watcharr

Name of the Vulnerable Software and Affected Versions: sbondCo Watcharr version 1.43.0 Description: The issue allows a remote attacker to execute arbitrary code and escalate privileges via the Change Password function. Recommendations: For sbondCo Watcharr version 1.43.0, consider disabling the...

PT-2024-6803 · Unknown · Angular-Base64-Upload

Name of the Vulnerable Software and Affected Versions: angular-base64-upload versions prior to v0.1.21 Description: The issue is related to the angular-base64-upload library, which has a vulnerability that allows an attacker to execute arbitrary code on the server by uploading a specially crafted...

PYSEC-2024-198

Gradio is an open-source Python package designed for quick prototyping. This vulnerability involves data exposure due to the enablemonitoring flag not properly disabling monitoring when set to False. Even when monitoring is supposedly disabled, an attacker or unauthorized user can still access th...

PT-2024-39613 · WordPress +1 · Custom-Registration-Form-Builder-With-Submission-Manager +1

Name of the Vulnerable Software and Affected Versions: RegistrationMagic WordPress plugin versions prior to 6.0.2.1 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for...

PT-2025-28387 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions prior to 15 Description: The issue is related to an out-of-bounds read in the decoding frame header in libsavsvc.so. This allows local attackers to cause memory corruption. Recommendations: For Android versions prior to 15,...

PT-2024-27962 · Btcd +1 · Btcd +1

Name of the Vulnerable Software and Affected Versions: btcd versions 0.10 through 0.24 Description: The btcd Bitcoin client did not correctly re-implement Bitcoin Core's 'FindAndDelete' functionality, leading to discrepancies in Bitcoin block validation. This can result in a chain split or Denial...

PT-2025-28386 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions prior to 15 Description: The issue is related to out-of-bounds writing when accessing uninitialized memory in libsavsvc.so. This allows local attackers to cause memory corruption. Recommendations: For Android versions prior t...

PT-2025-28388 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions prior to 15 Description: The issue is related to an out-of-bounds read in decoding a malformed frame header in libsavsvc.so. This allows local attackers to cause memory corruption. Recommendations: For versions prior to Andro...

PT-2024-22312 · Apache +2 · Apache Xml Graphics +2

Name of the Vulnerable Software and Affected Versions: Apache XML Graphics FOP version 2.9 Description: The issue is related to an Improper Restriction of XML External Entity Reference, also known as an XXE vulnerability, in Apache XML Graphics FOP. This vulnerability is due to the improper...

PT-2024-30: Stored DOM-Based Cross-Site Scripting (stored DOM XSS) in Passwork

The vulnerability was identified in Passwork version 6.4.0. The application does not process the data received from the user, which is necessary for safety use during web page formation. Exploitation of the vulnerability is possible for an authorized user and leads to the possibility of executing...

PT-2024-38043 · Unknown · Open-Webui

Name of the Vulnerable Software and Affected Versions: open-webui version v0.3.8 Description: The issue is related to improper privilege management in the API endpoints "GET /api/v1/documents/" and "POST /rag/api/v1/doc". This allows a lower-privileged user to access and overwrite files managed b...

PT-2024-7663 · Curl +9 · Curl +9

Name of the Vulnerable Software and Affected Versions: curl versions prior to 8.10.1 Description: The issue is related to the implementation of the HSTS HTTP Strict Transport Security mechanism in the curl utility. When curl is asked to use HSTS, the expiry time for a subdomain might overwrite a...

PT-2024-33: Business logic vulnerability in Passwork

The vulnerability was identified in Passwork version 6.4.0. The application's logic requires the user to perform a correct sequence of actions to implement the functionality. The vulnerability in the business logic can be exploited by an attacker to gain access to the application's functionality...