PT-2024-35464 · Unknown · Wp-Affiliate-Platform

Name of the Vulnerable Software and Affected Versions: wp-affiliate-platform versions prior to 6.5.1 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back in the page. This cou...

PT-2024-30108 · WordPress · Svg Block

Name of the Vulnerable Software and Affected Versions: SVG Block WordPress plugin versions prior to 1.1.20 Description: The issue allows users with at least the author role to upload SVG files containing malicious JavaScript, enabling Stored XSS attacks due to the lack of sanitization of SVG file...

PT-2024-33678 · WordPress · Index Wp Mysql For Speed

Name of the Vulnerable Software and Affected Versions: Index WP MySQL For Speed WordPress plugin versions prior to 1.4.18 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back ...

PT-2024-34143 · WordPress · Sully

Name of the Vulnerable Software and Affected Versions: SULly WordPress plugin versions prior to 4.3.1 Description: The issue concerns a lack of CSRF check in certain areas and missing sanitization as well as escaping. This could allow attackers to make logged-in admins add Stored XSS payloads via...

PT-2024-35470 · Unknown · Wp-Affiliate-Platform

Name of the Vulnerable Software and Affected Versions: wp-affiliate-platform versions prior to 6.5.1 Description: The issue concerns a lack of CSRF check when updating settings, which could allow attackers to make a logged-in user change them via a CSRF attack. Recommendations: For versions prior...

PT-2024-23304 · WordPress · Maxbuttons

Name of the Vulnerable Software and Affected Versions: MaxButtons WordPress plugin versions prior to 9.7.8 Description: The issue allows users with a role as low as editor to perform Cross-Site Scripting attacks due to the plugin's failure to sanitise and escape some parameters. Recommendations:...

PT-2024-33860 · WordPress · User Submitted Posts

Name of the Vulnerable Software and Affected Versions: User Submitted Posts WordPress plugin versions prior to 20240516 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for...

PT-2024-34135 · WordPress · Sully

Name of the Vulnerable Software and Affected Versions: SULly WordPress plugin versions prior to 4.3.1 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back in the page. This...

PT-2024-28728 · Fog · Fog

Name of the Vulnerable Software and Affected Versions: FOG versions prior to 1.5.10.34 Description: The issue is related to a command injection via the filename parameter to the "/fog/management/export.php" API endpoint. This allows for code execution. The estimated number of potentially affected...

PT-2024-35691 · WordPress · Form Vibes

Name of the Vulnerable Software and Affected Versions: Form Vibes plugin for WordPress versions up to, and including, 1.4.10 Description: The issue allows authenticated attackers with Subscriber-level access and above to inject SQL queries, potentially extracting sensitive information from the...

PT-2024-5033 · Ibm · Ibm Datacap Navigator

Name of the Vulnerable Software and Affected Versions: IBM Datacap Navigator versions 9.1.5 through 9.1.9 Description: The issue is related to the temporary storage of data from different environments in an unencrypted manner, which could be obtained by a malicious user. This could allow an...

PT-2024-37326 · WordPress · Content Blocks

Name of the Vulnerable Software and Affected Versions: ContentLock WordPress plugin versions 1.0.0 through 1.0.3 Description: The issue concerns a lack of CSRF check when adding emails, which could allow attackers to make a logged-in admin perform such an action via a CSRF attack. Recommendations...

PT-2024-37327 · WordPress · Content Blocks

Name of the Vulnerable Software and Affected Versions: ContentLock WordPress plugin versions 1.0.0 through 1.0.3 Description: The issue concerns a lack of CSRF check in the ContentLock WordPress plugin, which could allow attackers to trick a logged-in admin into removing groups or emails via a CS...

Security Bulletin: IBM DataPower Gateway Virtual Edition vulnerable to security bypass due to use of open-vm-tools (CVE-2023-20900)

Summary open-vm-tools provides an interface between IBM DataPower Gateway Virtual Edition and the hypervisor. This issue may permit hypervisor users to perform unauthorized guest operations. Vulnerability Details CVEID:CVE-2023-20900 DESCRIPTION: VMware Tools could allow a remote attacker to bypa...

[SECURITY] [DSA 5728-1] exim4 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5728-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso July 10, 2024 https://www.debian.org/security/faq -...

PT-2024-37713 · WordPress · Smartcrawl

Name of the Vulnerable Software and Affected Versions: SmartCrawl WordPress SEO checker plugin versions up to, and including, 3.10.8 Description: The issue is due to the plugin utilizing mobiledetect without preventing direct access to the files, making it possible for unauthenticated attackers t...

PT-2024-28836 · Tenda · Tenda Ax12

Name of the Vulnerable Software and Affected Versions: Tenda AX12 version 1.0 v22.03.01.46 Description: The issue is a stack overflow in the deviceList parameter of the sub 42E410 function. Recommendations: For Tenda AX12 version 1.0 v22.03.01.46, consider disabling the sub 42E410 function or...

PT-2024-37453 · WordPress · Duplicator

Name of the Vulnerable Software and Affected Versions: Duplicator plugin for WordPress versions up to, and including, 1.5.9 Description: The issue allows unauthenticated attackers to obtain the full path to instances, which may be used in combination with other vulnerabilities or to simplify...

PT-2024-5185

Name of the Vulnerable Software and Affected Versions: Apache HTTP Server versions 2.4.61 Description: The issue is related to the core of Apache HTTP Server, where a partial fix ignores some use of the legacy content-type based configuration of handlers. This can result in source code disclosure...

PT-2024-5133 · Zoom · Zoom Workplace Desktop App

Name of the Vulnerable Software and Affected Versions: Zoom Workplace Desktop App for macOS versions prior to 6.0.10 Description: The issue is related to an uncontrolled search path element in the installer, which may allow an authenticated user to conduct a denial of service via local access. Th...