PT-2024-20738 · Kadence Blocks · Gutenberg Blocks

Name of the Vulnerable Software and Affected Versions: Gutenberg Blocks by Kadence Blocks versions prior to 3.2.26 Description: The issue is related to the Gutenberg Blocks by Kadence Blocks WordPress plugin, which does not validate and escape some of its block options before outputting them back...

PT-2024-4391

Name of the Vulnerable Software and Affected Versions Net::CIDR::Lite versions prior to 0.22 Description The issue is related to the improper handling of extraneous zero characters at the beginning of an IP address string. This can allow attackers to bypass access control based on IP addresses in...

PT-2024-11204 · Unknown · Net::Ipaddress::Util

Name of the Vulnerable Software and Affected Versions: Net::IPAddress::Util versions prior to 5.000 Description: The issue arises from the Net::IPAddress::Util module not properly handling extraneous zero characters in IP address strings. This can lead to attackers bypassing access control based ...

PT-2024-20437 · Fusionpbx · Fusionpbx

Name of the Vulnerable Software and Affected Versions: FusionPBX versions prior to 5.2.0 Description: The issue is related to a lack of session validation. Recommendations: For versions prior to 5.2.0, update to version 5.2.0 or later to resolve the issue...

CVE-2024-28848

CVE-2024-28848 is a SpEL injection vulnerability in OpenMetadata's GET /api/v1/policies/validation/condition/. The CompiledRule.validateExpression flow evaluates user-supplied SpEL against Java types (e.g., Runtime), enabling remote code execution. The issue is exploitable by authenticated non-ad...

CVE-2024-23944

CVE-2024-23944 is a ZooKeeper information-disclosure vulnerability involving persistent watchers. The issue arises when a watcher attached to a parent znode to which the attacker already has access is triggered; the server does not perform an ACL check at watch-trigger time, exposing the full pat...

PT-2024-5872 · Glpi +1 · Glpi +1

Name of the Vulnerable Software and Affected Versions: GLPI versions prior to 10.0.13 Description: The issue is related to CSV injection, where an attacker can create an asset with a crafted title, potentially allowing a remote attacker to impact the confidentiality, integrity, and availability o...

PT-2024-3243 · Oracle +1 · Virtualbox +1

Name of the Vulnerable Software and Affected Versions: Oracle VM VirtualBox versions prior to 7.0.16 Description: The issue is related to insufficient access control in the Core component of Oracle VM VirtualBox, allowing a low-privileged attacker with logon access to the infrastructure where...

PT-2024-13383 · Epmm · Epmm

Name of the Vulnerable Software and Affected Versions: EPMM versions prior to 12.1.0.0 Description: The issue allows an authenticated user with appropriate privilege to access or modify data in the underlying database due to an SQL Injection vulnerability in the web component. Recommendations: Fo...

PT-2024-22410 · Unknown +1 · Prestashop +1

Name of the Vulnerable Software and Affected Versions: Advanced Plugins ultimateimagetool module for PrestaShop versions prior to 2.2.01 Description: An issue in the ultimateimagetool module allows a remote attacker to escalate privileges and obtain sensitive information via Improper Access...

PT-2024-22280 · Offis +4 · Dcmtk +4

Name of the Vulnerable Software and Affected Versions: OFFIS DCMTK version 3.6.8 Description: An incorrect type conversion vulnerability exists in the DVPSSoftcopyVOI PList::createFromImage functionality. A specially crafted malformed file can lead to arbitrary code execution. An attacker can...

CVE-2024-24549

Denial of Service due to improper input validation vulnerability for HTTP/2 requests in Apache Tomcat. When processing an HTTP/2 request, if the request exceeded any of the configured limits for headers, the associated HTTP/2 stream was not reset until after all of the headers had been...

PT-2024-22330 · Unknown · Yourspotify

Name of the Vulnerable Software and Affected Versions: YourSpotify versions prior to 1.9.0 Description: The issue concerns a clickjacking vulnerability that can be used to trick an existing user into triggering actions, such as allowing signup of other users or deleting the current user account...

PT-2024-17551

Name of the Vulnerable Software and Affected Versions Exclusive Addons for Elementor versions through 2.6.9 Description The Exclusive Addons for Elementor plugin for WordPress is susceptible to Stored Cross-Site Scripting through the data attribute. This is due to insufficient input sanitization...

CVE-2022-34321

Improper Authentication vulnerability in Apache Pulsar Proxy allows an attacker to connect to the /proxy-stats endpoint without authentication. The vulnerable endpoint exposes detailed statistics about live connections, along with the capability to modify the logging level of proxied connections...

PT-2024-2079 · Microsoft · Windows Hyper-V +1

Name of the Vulnerable Software and Affected Versions: Windows Hyper-V affected versions not specified Description: The vulnerability is related to insufficient input validation in the Windows Hyper-V system, allowing a remote attacker to execute arbitrary code. This issue can be exploited by an...

PT-2024-22121 · Sap · Sap Abap Platform

Name of the Vulnerable Software and Affected Versions: SAP ABAP Platform versions 758, 795 Description: The issue is due to a missing authorization check, allowing an attacker with a business user account to change the privacy setting of job templates from shared to private, making the selected...

PT-2024-15659 · WordPress · The Ultimate Posts Widget

Name of the Vulnerable Software and Affected Versions: The Ultimate Posts Widget WordPress plugin versions prior to 2.3.1 Description: The issue concerns the Ultimate Posts Widget WordPress plugin, where it fails to validate and escape some of its widget options before outputting them back in...

PT-2024-14956 · WordPress · Seriously Simple Podcasting

Name of the Vulnerable Software and Affected Versions: Seriously Simple Podcasting WordPress plugin versions prior to 3.0.0 Description: The issue discloses the Podcast owner's email address, which by default is the admin email address, via an unauthenticated crafted request. Recommendations: For...

PT-2024-18012 · WordPress · Profile Box Shortcode/Widget

Name of the Vulnerable Software and Affected Versions: The Profile Box Shortcode And Widget WordPress plugin versions prior to 1.2.1 Description: The issue concerns the lack of sanitization and escaping of some settings in the plugin, which could allow high-privilege users, such as admins, to...