PT-2024-25677 · Pterodactyl · Pterodactyl Wings

Name of the Vulnerable Software and Affected Versions: Pterodactyl Wings versions prior to 1.11.12 Description: The issue allows an attacker to gain arbitrary file write and read access on a node if the Wings token is leaked, either by viewing the node configuration or posting it accidentally...

PT-2024-12506 · Apache · Apache Hive

Name of the Vulnerable Software and Affected Versions: Apache Hive versions 4.0.0-alpha-1 through 4.0.0 Description: The issue affects the Hive JDBC driver component and can potentially lead to arbitrary code execution on the machine/endpoint that the JDBC driver client is running. The malicious...

PT-2024-26962 · WordPress · Responsive Contact Form Builder & Lead Generation Plugin

Name of the Vulnerable Software and Affected Versions: The Responsive Contact Form Builder & Lead Generation Plugin WordPress plugin versions 1.8.9 and earlier Description: The issue concerns the lack of sanitization and escaping of some settings in the plugin, which could allow high-privilege...

PT-2024-25570 · Nico Martin · Progressive Wordpress

Name of the Vulnerable Software and Affected Versions: Progressive WordPress PWA versions 2.1.13 and earlier Description: The issue is related to a Missing Authorization vulnerability in Nico Martin Progressive WordPress PWA. Recommendations: For versions 2.1.13 and earlier, update to a version...

PT-2024-25859 · Savsoft · Savsoft Quiz

Name of the Vulnerable Software and Affected Versions: Savsoft Quiz version 6.0 Description: The issue allows stored XSS via the quiz name parameter in the "index.php/quiz/insert quiz/" endpoint. This enables potential attackers to inject malicious scripts into the application. Recommendations: F...

PT-2024-25554 · Reviewx · Reviewx

Name of the Vulnerable Software and Affected Versions: ReviewX versions 1.6.21 and earlier Description: The issue is related to a Broken Access Control vulnerability. Recommendations: For ReviewX versions 1.6.21 and earlier, update to a version later than 1.6.21 to resolve the issue...

PT-2024-3777

Name of the Vulnerable Software and Affected Versions protocol buffers versions prior to 4.24.x Description The issue is related to the JsonToBinaryStream function, which is part of the protocol buffers C++ implementation. This function is used to parse JSON from a stream. If the input is broken ...

Medium: httpd

Issue Overview: Faulty input validation in the core of Apache allows malicious or exploitable backend/content generators to split HTTP responses. This issue affects Apache HTTP Server: through 2.4.58. CVE-2023-38709 HTTP Response splitting in multiple modules in Apache HTTP Server allows an...

PT-2024-25684

Name of the Vulnerable Software and Affected Versions sagemaker-python-sdk versions prior to 2.214.3 Description The capture dependencies function in the sagemaker.serve.save retrive.version 1 0 0.save.utils module allows for potentially unsafe Operating System OS Command Injection if an...

PT-2024-18352 · WordPress · Wpbakery

Name of the Vulnerable Software and Affected Versions: wpbakery plugin for WordPress versions up to, and including, 7.5 Description: The issue is related to Stored Cross-Site Scripting via the Post Title tag attribute due to insufficient input sanitization and output escaping. This allows...

PT-2024-18215 · WordPress · Print Labels With Barcodes

Name of the Vulnerable Software and Affected Versions: The Print Labels with Barcodes plugin for WordPress versions up to, and including, 3.4.6 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping in the template and javascrip...

PT-2024-26827 · WordPress · Wp Cookie Consent

Name of the Vulnerable Software and Affected Versions: WP Cookie Consent plugin for WordPress versions up to, and including, 3.0.2 Description: The issue is related to a missing capability check on the gdpr policy process delete function, which allows unauthorized loss of data. This makes it...

PT-2024-12603 · Alt N Technologies · Automationmanager.Agentservice.Exe

Name of the Vulnerable Software and Affected Versions: AutomationManager.AgentService.exe versions prior to 2.91.0.0 Description: The affected AutomationManager.AgentService.exe application contains a TOCTOU race condition vulnerability that allows standard users to create a pseudo-symlink at...

PT-2024-26771 · WordPress · Getwid

Name of the Vulnerable Software and Affected Versions: Getwid – Gutenberg Blocks plugin for WordPress versions up to, and including, 2.0.7 Description: The issue is related to Stored Cross-Site Scripting via the plugin's Countdown block due to insufficient input sanitization and output escaping o...

PT-2024-18353 · WordPress · Wpbakery

Name of the Vulnerable Software and Affected Versions: wpbakery plugin for WordPress versions up to, and including, 7.5 Description: The issue is related to Stored Cross-Site Scripting via the Custom Heading tag attribute due to insufficient input sanitization and output escaping. This allows...

PT-2024-26178 · WordPress · Popup Box

Name of the Vulnerable Software and Affected Versions: The Popup Box WordPress plugin versions prior to 2.2.7 Description: The issue is related to the lack of CSRF checks in some bulk actions, which could allow attackers to make logged-in admins perform unwanted actions, such as deleting popups v...

PT-2024-24943 · Unknown · Librespeed Speedtest

Name of the Vulnerable Software and Affected Versions: librespeed/speedtest versions 5.2.5 through 5.3.0 Description: The issue arises from missing neutralization of the ISP information in a speedtest result, leading to stored Cross-site scripting in the JSON API. The processedString field in the...

PT-2024-26167 · WordPress · Side Menu Lite

Name of the Vulnerable Software and Affected Versions: The Side Menu Lite WordPress plugin versions prior to 4.2.1 Description: The issue is related to the lack of CSRF checks in some bulk actions, which could allow attackers to make logged-in admins perform unwanted actions, such as deleting...

PT-2024-25020 · Pluto · Pluto

Name of the Vulnerable Software and Affected Versions: Pluto versions prior to 0.9.3 Description: The issue affects Pluto, a superset of Lua 5.4, allowing an attacker who can intercept network traffic to use a specifically-crafted certificate to fool Pluto into trusting it as the intended remote...

PT-2024-12677 · Ibm · Ibm Storage Scale

Name of the Vulnerable Software and Affected Versions: IBM Storage Scale versions 5.1.0.0 through 5.1.9.2 Description: The issue allows an authenticated user to steal or manipulate an active session to gain access to the system. Recommendations: For versions 5.1.0.0 through 5.1.9.2, update to a...