Medium: thunderbird

Issue Overview: A heap overflow vulnerability exists in libvpx - Encoding a frame that has larger dimensions than the originally configured size with VP9 may result in a heap overflow in libvpx. We recommend upgrading to version 1.13.1 or above CVE-2023-6349 Affected Packages: thunderbird Note:...

PT-2024-8345 · FFmpeg +3 · Ffmpeg +3

Name of the Vulnerable Software and Affected Versions: FFmpeg versions up to 7.0.1 Description: A critical issue has been found in the function pnm decode frame in the /libavcodec/pnmdec.c library, which can lead to a heap-based buffer overflow. This can be exploited remotely, potentially allowin...

CVE-2024-38856 Apache OFBiz: Unauthenticated endpoint could allow execution of screen rendering code

Incorrect Authorization vulnerability in Apache OFBiz. This issue affects Apache OFBiz: through 18.12.14. Users are recommended to upgrade to version 18.12.15, which fixes the issue. Unauthenticated endpoints could allow execution of screen rendering code of screens if some preconditions are met...

PT-2024-5831 · Mailcow · Mailcow

Name of the Vulnerable Software and Affected Versions: mailcow: dockerized versions prior to 2024-07 Description: The issue allows an unauthenticated attacker to inject a JavaScript payload into the API logs. This payload is executed when the API logs page is viewed, potentially allowing an...

PT-2024-34418 · WordPress · Wp-Emember

Name of the Vulnerable Software and Affected Versions: wp-eMember WordPress plugin versions prior to 10.7.0 Description: The issue concerns a lack of CSRF check in some areas and missing sanitization as well as escaping. This could allow attackers to make logged-in admins add Stored XSS payloads...

PT-2024-37587 · WordPress · The Quiz/Survey Master

Name of the Vulnerable Software and Affected Versions: The Quiz and Survey Master QSM WordPress plugin versions prior to 9.1.0 Description: The issue concerns the improper sanitization and escaping of some Quizz settings in the plugin, which could allow high-privilege users, such as contributors,...

PT-2024-18272 · WordPress · Woocommerce Customers Manager

Name of the Vulnerable Software and Affected Versions: WooCommerce Customers Manager WordPress plugin versions prior to 30.2 Description: The issue concerns a lack of authorization and CSRF protection in various AJAX actions within the plugin, allowing any authenticated user to update, delete, or...

PT-2024-28204 · Elementor · The Pack Elementor Addons

Name of the Vulnerable Software and Affected Versions: The Pack Elementor addons versions 2.0.8.6 and earlier Description: The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as 'Path Traversal', which allows PHP Local File Inclusion. This enables...

PT-2024-37670 · WordPress · Light Poll Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: The Light Poll WordPress plugin versions through 1.0.0 Description: The issue concerns a lack of CSRF checks when deleting polls, which could allow attackers to make logged-in users perform such actions via a CSRF attack. Recommendations: For...

PT-2024-35718 · WordPress · Breakdance

Name of the Vulnerable Software and Affected Versions: Breakdance plugin for WordPress versions up to, and including, 1.7.2 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows authenticated attackers with...

PT-2024-29664 · Elektra +1 · Elektra +1

Name of the Vulnerable Software and Affected Versions: Elektra versions prior to the version containing commit 8bce00be93b95a6512ff68fe86bf9554e486bc02 Description: A code injection issue was discovered in the live search functionality of the Elektra web application, which is built on Ruby on...

PT-2024-5608 · Vim +3 · Vim +3

Name of the Vulnerable Software and Affected Versions: Vim versions prior to 9.1.0648 Description: The issue arises from a double-free error in the dialog changed function when abandoning a buffer. If a user chooses to save a modified buffer without a name, Vim may create a new Untitled file...

PT-2024-5614 · Provision Isr +2 · Sh-8100A-2L +5

Name of the Vulnerable Software and Affected Versions: TVT DVR TD-2104TS-CL affected versions not specified DVR TD-2108TS-HP affected versions not specified Provision-ISR DVR SH-4050A5-5LMM affected versions not specified AVISION DVR AV108T affected versions not specified TD-2116TE-HP affected...

PT-2024-19874 · Elastic · Elasticsearch

Name of the Vulnerable Software and Affected Versions: Elasticsearch versions prior to 8.12.x Description: The issue arises when the elasticsearch-certutil CLI tool is used with the csr option to create a new Certificate Signing Request. In this scenario, the associated private key generated is...

PT-2024-29331 · Goframe · Goframe

Name of the Vulnerable Software and Affected Versions: goframe version 2.7.2 Description: The issue allows attackers to execute a man-in-the-middle attack due to the software being configured to skip TLS certificate verification via the gclient component. Recommendations: For goframe version 2.7....

PT-2024-29658

Name of the Vulnerable Software and Affected Versions Haystack versions prior to 2.3.1 Description The issue concerns Haystack clients that allow users to create and run Pipelines from scratch, making them vulnerable to remote code executions. Certain components in Haystack utilize Jinja2...

PT-2024-29659

Name of the Vulnerable Software and Affected Versions Pheonix App versions prior to 0.2.4 Pheonix App versions prior to 0.2.5 Description The issue is related to the map of encoding/decoding languages being visible in the code, which can have a moderate impact, particularly for users who want to...

PT-2024-10758 · Lenovo · Lenovo Pcmanager

Name of the Vulnerable Software and Affected Versions: Lenovo PC Manager versions prior to 2.8.90.11211 Description: A local attacker could exploit the issue to escalate privileges. Recommendations: For versions prior to 2.8.90.11211, update to version 2.8.90.11211 or later to resolve the issue...

PT-2024-13610 · Apache · Apache Seatunnel

Name of the Vulnerable Software and Affected Versions: Apache SeaTunnel version 1.0.0 Description: The issue is related to a Web Authentication vulnerability in Apache SeaTunnel, where the jwt key is hardcoded in the application. This allows an attacker to forge any token and log in as any user...

PT-2024-37172 · WordPress · Wp Ajax Contact Form

Name of the Vulnerable Software and Affected Versions: WP Ajax Contact Form WordPress plugin versions 2.2.2 and earlier Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back in...