PT-2024-15219 · WordPress · Persian Fonts Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Persian Fonts WordPress plugin versions 1.6 and earlier Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for example, i...

PT-2024-1970 · Apache · Apache Airflow

Name of the Vulnerable Software and Affected Versions: Apache Airflow versions prior to 2.8.2 Description: The issue allows authenticated users to view DAG code and import errors of DAGs they do not have permission to view through the API and the UI. This is related to the disclosure of informati...

PT-2024-15651 · Git +2 · Anything-Llm +1

Name of the Vulnerable Software and Affected Versions: Software affected versions not specified Description: The issue allows exports of the database and associated exported information of the system via the default user role. An attacker would need to have been granted access to the system prior...

PT-2024-15248 · WordPress · Login As User/Customer

Name of the Vulnerable Software and Affected Versions: Login as User or Customer WordPress plugin versions 3.8 and earlier Description: The issue allows users to log in as any other user on the site, potentially leading to complete administrator account takeover. It is crucial to keep WordPress...

PT-2024-15218

Name of the Vulnerable Software and Affected Versions JetBackup WordPress plugin versions prior to 2.0.9.9 Description The issue allows malicious actors to leak backup files due to the plugin not using index files to prevent public directory listing of sensitive directories in certain...

PT-2024-21387 · Tabatkins · Railroad-Diagrams

Name of the Vulnerable Software and Affected Versions: tabatkins/railroad-diagrams versions before commit ea9a123 Description: A DOM based cross-site scripting XSS vulnerability in the component generator.html of tabatkins/railroad-diagrams allows attackers to execute arbitrary Javascript via...

PT-2024-19612 · Unknown · Dynamic Lab Management System Project In Php

Name of the Vulnerable Software and Affected Versions: Dynamic Lab Management System Project in PHP version 1.0 Description: The issue allows a remote attacker to execute arbitrary code via a crafted script. This is a result of a SQL injection vulnerability. Recommendations: For Dynamic Lab...

PT-2024-21902

Name of the Vulnerable Software and Affected Versions LangChain versions prior to 0.1.8 langchain experimental versions prior to 0.0.52 Description The issue allows an attacker to bypass a previous fix and execute arbitrary code via certain attributes in Python code, including import , subclasses...

[SECURITY] [DSA 5630-1] thunderbird security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5630-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff February 23, 2024 https://www.debian.org/security/faq -...

PT-2024-19634 · Zkteco · Zkteco Zkbio Wdms

Name of the Vulnerable Software and Affected Versions: zkteco zkbio WDMS version 8.0.5 Description: An issue in the software allows an attacker to execute arbitrary code via the "/files/backup/" component. Recommendations: For zkteco zkbio WDMS version 8.0.5, consider restricting access to the...

PT-2024-13564 · WordPress · Socialdriver

Name of the Vulnerable Software and Affected Versions: SocialDriver WordPress theme versions prior to 2024 Description: The issue is related to a prototype pollution vulnerability. This could allow an attacker to inject arbitrary properties, resulting in a cross-site scripting XSS attack...

PT-2024-20350 · Prestashop · Ecomiz Survey Tma Module

Name of the Vulnerable Software and Affected Versions: Ecomiz Survey TMA module for PrestaShop versions up to 2.0.0 Description: A guest can download personal information without restriction in the affected module. Recommendations: For versions up to 2.0.0, update to a version later than 2.0.0 to...

PT-2024-20768 · Unknown · Codeql Cli

Name of the Vulnerable Software and Affected Versions: CodeQL CLI versions prior to 2.16.3 Description: The CodeQL CLI is vulnerable to an XML External Entity attack due to an XML parser used to read auxiliary files. This vulnerability can be exploited when processing maliciously modified CodeQL...

PT-2024-40455 · Pypqc · Pypqc

Name of the Vulnerable Software and Affected Versions: PyPQC versions prior to 0.0.6.1 Description: An attacker able to submit many decapsulation requests against a single private key, and to gain timing information about the decapsulation, could recover the private key. A proof-of-concept exploi...

PT-2024-1800

Name of the Vulnerable Software and Affected Versions ConnectWise ScreenConnect versions prior to 23.9.8 Description A path traversal flaw exists due to improper restriction of directory path names. This allows a remote attacker to bypass directory restrictions, potentially enabling the upload of...

PT-2024-20566 · Unknown · Soninow Team Debug

Name of the Vulnerable Software and Affected Versions: SoniNow Team Debug versions 1.10 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web application that...

PT-2024-20611 · Unknown · Powerpack Pro For Elementor

Name of the Vulnerable Software and Affected Versions: PowerPack Pro for Elementor versions prior to 2.10.8 Description: A Cross-Site Request Forgery CSRF issue affects the PowerPack Pro for Elementor. This issue allows for malicious requests to be made on behalf of a user without their knowledge...

CVE-2024-25141 Apache Airflow Mongo Provider: Certificate validation isn't respected even if SSL is enabled for apache-airflow-providers-mongo

When ssl was enabled for Mongo Hook, default settings included "allowinsecure" which caused that certificates were not validated. This was unexpected and undocumented. Users are recommended to upgrade to version 4.0.0, which fixes this issue...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the dynamic file upload feature. An attacker can modify the file names of the records being uploaded to the server, which could lead to the execution of malicious scripts. This vulnerability is present in...

PT-2024-5216 · Google +4 · Google Chrome +4

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 122.0.6261.57 Description: The issue is related to a use after free in DevTools, which could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This could enable the attacke...