PT-2024-15038 · WordPress · Caos | Host Google Analytics Locally

Name of the Vulnerable Software and Affected Versions: CAOS | Host Google Analytics Locally plugin for WordPress versions up to, and including, 4.7.14 Description: The issue allows unauthorized modification of data due to a missing capability check on the update settings function. This makes it...

PT-2024-15003 · Tecnick.Com +3 · Tcexam

Name of the Vulnerable Software and Affected Versions: Software affected versions not specified Description: The issue arises when access to the "admin" folder is not protected by external authorization mechanisms, such as Apache Basic Auth. This allows any user to download protected information,...

PT-2024-1166

The vulnerable software is Google Chrome, specifically the V8 JavaScript engine, which is also used in other Chromium-based browsers such as Microsoft Edge, Brave, and Opera. The issue is an out-of-bounds memory access vulnerability that can be exploited by attackers to trigger crashes or execute...

PT-2024-15007 · WordPress · Import/Export Users/Customers Plugin For Wordpress

Name of the Vulnerable Software and Affected Versions: Export and Import Users and Customers plugin for WordPress versions up to, and including, 2.4.8 Description: The issue is related to insufficient file type validation on the upload import file function, allowing authenticated attackers with...

PT-2024-13047 · WordPress · Givewp

Name of the Vulnerable Software and Affected Versions: GiveWP plugin for WordPress versions up to, and including, 2.33.3 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the give stripe disconnect connect stripe account function. This...

PT-2024-13768 · Apache · Apache Answer

Name of the Vulnerable Software and Affected Versions: Apache Answer versions through 1.2.0 Description: The issue is related to a 'Race Condition' vulnerability due to improper synchronization when using shared resources. Normally, a user can only bookmark a question once, increasing the bookmar...

PT-2024-16: OS Command Injection in Pandora FMS

The vulnerability was identified in Pandora FMS, versions from 700 through 776. The vulnerability allows an attacker to inject a command into the operating system. The vulnerability is a part of a chain that leads to remote code execution and complete server compromise PT-ID-2024-15,...

Lenovo Tablet Vulnerabilities - Lenovo Support US

No description provided...

PT-2024-13704 · Trendnet · Trendnet Tv-Ip1314Pi

Name of the Vulnerable Software and Affected Versions: TRENDnet TV-IP1314PI version 5.5.3 200714 Description: An issue was discovered in libremote dbg.so where filtering of debug information is mishandled during use of popen. Consequently, an attacker can bypass validation and execute a shell...

UC Software – Unverified Password Change

A potential vulnerability was discovered in certain Poly devices. An attacker who can take over a web server session can also change the administrator password without knowledge of the current password due to an improper authentication check. HP recommends that customers disable the web server an...

PT-2024-14482 · Unknown · Woocommerce Tranzila Payment Gateway

Name of the Vulnerable Software and Affected Versions: WooCommerce Tranzila Payment Gateway versions 1.0.8 and earlier Description: The issue is related to the deserialization of untrusted data in the Anton Bond WooCommerce Tranzila Payment Gateway. Recommendations: For versions 1.0.8 and earlier...

PT-2024-15109 · WordPress · Commenttweets

Name of the Vulnerable Software and Affected Versions: CommentTweets WordPress plugin versions 0.6 and earlier Description: The issue concerns the lack of CSRF checks in certain areas of the plugin, which could allow attackers to make logged-in users perform unwanted actions via CSRF attacks...

Withdraw amount returned by getLiquidityAmountsAndPositions may be incorrect

Lines of code Vulnerability details Impact The getLiquidityAmountsAndPositions function in the liquiditylockbox contract is used to calculate the liquidity amounts and positions to be withdrawn for a given total withdrawal amount. It iterates through each deposited position following a FIFO order...

PT-2024-14893 · WordPress · Wp Crowdfunding

Name of the Vulnerable Software and Affected Versions: WP Crowdfunding WordPress plugin versions prior to 2.1.9 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back in the pag...

PT-2024-14996 · WordPress · Wp Vr

Name of the Vulnerable Software and Affected Versions: WP VR WordPress plugin versions prior to 8.3.15 Description: The issue concerns a lack of authorization and CSRF protection in a function hooked to admin init, allowing unauthenticated users to downgrade the plugin. This can lead to Reflected...

Medium: tomcat9

Issue Overview: Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M10, from 10.1.0-M1 through 10.1.15, from 9.0.0-M1 through 9.0.82 and from 8.5.0 through 8.5.95 did not correctly parse HTTP trailer headers. A trailer header that exceeded the header siz...

PT-2024-13707 · Gradle · Gradle Enterprise

Name of the Vulnerable Software and Affected Versions: Gradle Enterprise versions prior to 2023.1 Description: A remote attacker may gain access to a new installation of Gradle Enterprise in certain scenarios due to a non-unique initial system user password. Although this password must be changed...

PT-2024-15030 · WordPress · Wp Go Maps

Name of the Vulnerable Software and Affected Versions: WP Go Maps versions prior to 9.0.28 Description: The issue concerns the WP Go Maps WordPress plugin, where most of its REST API routes are not properly protected. This allows attackers to store malicious HTML/Javascript on the site...

PT-2024-2589 · Apache · Apache Traffic Server

Name of the Vulnerable Software and Affected Versions: Apache Traffic Server versions 8.0.0 through 8.1.9 Apache Traffic Server versions 9.0.0 through 9.2.3 Description: The HTTP/2 CONTINUATION DoS attack can cause Apache Traffic Server to consume more resources on the server. This issue is relat...

CVE-2023-51784 Apache InLong: Remote Code Execution vulnerability in Apache InLong Manager

Improper Control of Generation of Code 'Code Injection' vulnerability in Apache InLong.This issue affects Apache InLong: from 1.5.0 through 1.9.0, which could lead to Remote Code Execution. Users are advised to upgrade to Apache InLong's 1.10.0 or cherry-pick 1 to solve it. 1...