PT-2024-14843 · WordPress · The Royal Elementor Addons/Templates

Name of the Vulnerable Software and Affected Versions: The Royal Elementor Addons and Templates WordPress plugin versions prior to 1.3.81 Description: The issue allows unauthenticated users to access arbitrary draft, private, and password-protected posts/pages content. This is due to the plugin n...

PT-2024-14861 · WordPress · Eventon

Name of the Vulnerable Software and Affected Versions: EventON WordPress plugin versions prior to 2.2 Description: The issue allows high privilege users, such as admin, to perform Stored HTML Injection attacks even when the unfiltered html capability is disallowed, due to the plugin not sanitizin...

Stable Channel Update for ChromeOS / ChromeOS Flex

Hello All, The Stable channel is being updated to 120.0.6099.235 Platform version: 15662.76.0 for ChromeOS devices and will be rolled out over the next few days. If you find new issues, please let us know one of the following ways: File a bug Visit our Chrome OS communities General: Chromebook He...

PT-2024-11511 · WordPress · Wp-Invoice

Name of the Vulnerable Software and Affected Versions: WP-Invoice WordPress plugin versions 4.3.1 and earlier Description: The issue is related to the lack of CSRF check when updating settings and insufficient sanitization and escaping in some settings, allowing an attacker to make a logged-in...

PT-2024-1173 · Totolink · Totolink X2000R

Name of the Vulnerable Software and Affected Versions: Totolink X2000R version 1.0.0-B20221212.1452 Description: A critical issue is related to the function formMapDelDevice in the /boafrm/formMapDelDevice file, where the manipulation of the macstr argument leads to command injection. This can be...

CVE-2023-46226 Apache IoTDB: Remote Code Execution (RCE) risk via the UDF

Remote Code Execution vulnerability in Apache IoTDB.This issue affects Apache IoTDB: from 1.0.0 through 1.2.2. Users are recommended to upgrade to version 1.3.0, which fixes the issue...

CVE-2023-50290 Apache Solr: Host environment variables are published via the Metrics API

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Solr. The Solr Metrics API publishes all unprotected environment variables available to each Apache Solr instance. Users are able to specify which environment variables to hide, however, the default list is designe...

PT-2024-1074

Name of the Vulnerable Software and Affected Versions Atlassian Confluence versions 8.0.x through 8.5.3 Description A template injection vulnerability in older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve remote code execution RCE on an affected...

PT-2024-14894 · WordPress · Wp Crowdfunding

Name of the Vulnerable Software and Affected Versions: WP Crowdfunding WordPress plugin versions prior to 2.1.10 Description: The issue concerns the WP Crowdfunding WordPress plugin, which does not properly sanitise and escape some of its settings. This could allow high-privilege users, such as...

PT-2024-1269 · Hitachi · Hitachi Device Manager

Name of the Vulnerable Software and Affected Versions: Hitachi Device Manager versions prior to 8.8.5-04 Description: The issue is related to insufficient protection of password input fields in the Device Manager Agent component of the Hitachi Device Manager system. This could allow a remote...

PT-2024-13540 · Alinto +2 · Alinto Sogo +2

Name of the Vulnerable Software and Affected Versions: Alinto SOGo versions 5.8.0 through 5.9.0 Description: The issue is related to HTML Injection. There is no information provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was...

PT-2024-19277 · Edx · Open Edx Platform

Name of the Vulnerable Software and Affected Versions: Open edX Platform versions prior to the version containing commit 019888f Description: The issue affects the Open edX Platform, a service-oriented platform for authoring and delivering online learning. A user with a JWT and limited scopes cou...

PT-2024-13661 · FFmpeg · Ffmpeg

Name of the Vulnerable Software and Affected Versions: Jave2 version 3.3.1 Description: An issue was discovered in Jave2, allowing attackers to execute arbitrary code via the FFmpeg function. Recommendations: For Jave2 version 3.3.1, consider disabling the FFmpeg function until a patch is...

PT-2024-1138 · Apache · Apache Solr

Name of the Vulnerable Software and Affected Versions: Apache Solr versions 9.0.0 through 9.3.0 Description: The Solr Metrics API publishes all unprotected environment variables available to each Apache Solr instance. Users are able to specify which environment variables to hide, however, the...

Juniper Networks Releases Security Bulletin for Junos OS and Junos OS Evolved

Juniper Networks has released a security advisory to address a vulnerability CVE-2024-21611 in Junos OS and Junos OS Evolved. A cyber threat actor could exploit this vulnerability to cause a denial-of-service condition. CISA encourages users and administrators to review the Juniper Advisory...

PT-2024-19268 · Unknown · Django Template Engine

Name of the Vulnerable Software and Affected Versions: Django template engine for Fiber versions prior to the latest patched version Description: This issue specifically impacts web applications that render user-supplied data through the Django template engine, potentially leading to the executio...

PT-2024-10342 · Fortinet · Forticlientems

Name of the Vulnerable Software and Affected Versions: FortiClientEMS versions 7.2.0 through 7.2.4 FortiClientEMS versions prior to 7.0.10 Description: The issue is related to an improper restriction of excessive authentication attempts, which may allow an unauthenticated attacker to perform a...

PT-2024-14981 · WordPress · The User Profile Builder – Beautiful User Registration Forms

Name of the Vulnerable Software and Affected Versions: The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress versions up to, and including, 3.10.7 Description: The issue is related to unauthorized access of data due to a missing...

PT-2024-14940 · WordPress · Export Wp Page To Static Html/Css

Name of the Vulnerable Software and Affected Versions: Export WP Page to Static HTML/CSS plugin for WordPress versions up to, and including, 2.1.9 Description: The issue is related to a missing capability check on multiple AJAX actions, allowing authenticated attackers with subscriber-level acces...

PT-2024-11628 · Elite Crm · Elite Crm

Name of the Vulnerable Software and Affected Versions: Elite CRM version 1.2.11 Description: A Cross Site Scripting issue allows an attacker to execute arbitrary code via the language parameter to the "/ngs/login" endpoint. Recommendations: For Elite CRM version 1.2.11, avoid using the language...