PT-2024-16862 · WordPress · Sassy Social Share

Name of the Vulnerable Software and Affected Versions: The Social Sharing Plugin – Sassy Social Share plugin for WordPress versions up to, and including, 3.3.69 Description: The issue is related to Reflected Cross-Site Scripting via the heateor mastodon share parameter due to insufficient input...

PT-2024-35883 · Sergio Micó · Simpleschema

Name of the Vulnerable Software and Affected Versions: SimpleSchema versions through 1.7.6.9 Description: The issue is related to an Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for DOM-Based XSS. A Cross-site Scripting XSS...

PT-2024-26507 · Linkstack · Linkstack

Name of the Vulnerable Software and Affected Versions: LinkStack versions 2.7.9 through 4.7.7 Description: The issue is a Server-Side Request Forgery SSRF vulnerability. It affects the resourcesviewscomponentsfavicon.blade.php file, allowing it to be linked with SSRF. This vulnerability poses a...

PT-2024-35439 · Dcme-320 +3 · Dcme-320 +3

Name of the Vulnerable Software and Affected Versions: DCME-320 versions prior to 7.4.12.90 DCME-520 versions prior to 9.25.5.11 DCME-320-L versions prior to 9.3.5.26 DCME-720 versions prior to 9.1.5.11 Description: The issue allows for Remote Code Execution and Privilege Escalation via the...

PT-2024-16315 · WordPress · Element Pack Elementor Addons

Name of the Vulnerable Software and Affected Versions: Element Pack Elementor Addons plugin for WordPress versions prior to 5.10.3 Description: The issue concerns the Element Pack Elementor Addons plugin for WordPress, which does not validate and escape some of its block options before outputting...

PT-2024-9682

Name of the Vulnerable Software and Affected Versions Django versions 4.2 through 4.2.16 Django versions 5.0 through 5.0.9 Django versions 5.1 through 5.1.3 Description The issue is related to the strip tags method and the striptags template filter in Django, which are subject to a potential...

PT-2024-8876

Name of the Vulnerable Software and Affected Versions: Zabbix versions 6.0.0 through 6.0.31 Zabbix versions 6.4.0 through 6.4.16 Zabbix version 7.0.0 Description: A non-admin user account on the Zabbix frontend with the default User role, or with any other role that gives API access, can exploit...

PT-2024-16835 · WordPress · Otter Blocks

Name of the Vulnerable Software and Affected Versions: Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress versions up to, and including, 3.0.6 Description: The issue allows unauthenticated attackers to view arbitrary images on the server, which can conta...

PT-2024-16596 · WordPress · Product Input Fields For Woocommerce

Name of the Vulnerable Software and Affected Versions: Product Input Fields for WooCommerce plugin for WordPress versions up to, and including, 1.9 Description: The issue allows authenticated attackers with Contributor-level access and above to read the contents of arbitrary files on the server,...

PT-2024-9392

Vulnerability Summary Name of the Vulnerable Software and Affected Versions: Apache Struts versions 2.0.0 through 2.3.37, 2.5.0 through 2.5.33, and 6.0.0 through 6.3.0.2. Description A critical flaw exists in the file upload logic of Apache Struts. An attacker can manipulate file upload parameter...

PT-2024-39171

Name of the Vulnerable Software and Affected Versions: CRI-O versions prior to 1.29.11 CRI-O versions 1.30.0 through 1.30.8 CRI-O versions 1.31.0 through 1.31.3 Description: A vulnerability was found in CRI-O, where it can be requested to take a checkpoint archive of a container and later be aske...

PT-2024-17221

Name of the Vulnerable Software and Affected Versions Rustls version 0.23.13 Description A flaw was found in Rustls and related APIs, allowing denial of service panic via a fragmented TLS ClientHello message. Recommendations For Rustls version 0.23.13, consider disabling the handling of fragmente...

PT-2024-29562 · Ibm · Ibm Powervm Hypervisor

Name of the Vulnerable Software and Affected Versions: IBM PowerVM Hypervisor versions FW950.00 through FW950.90 IBM PowerVM Hypervisor versions FW1030.00 through FW1030.60 IBM PowerVM Hypervisor versions FW1050.00 through FW1050.20 IBM PowerVM Hypervisor versions FW1060.00 through FW1060.10...

PT-2024-16606 · WordPress · La-Studio Element Kit For Elementor

Name of the Vulnerable Software and Affected Versions: LA-Studio Element Kit for Elementor plugin for WordPress versions up to, and including, 1.4.2 Description: The issue allows authenticated attackers with Contributor-level access and above to include and execute arbitrary files on the server v...

mySCADA myPRO Manager

RISK EVALUATION Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands or disclose sensitive information. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such...

PT-2024-39622 · WordPress · Gmw-Premium-Settings +1

Name of the Vulnerable Software and Affected Versions: GEO my WP WordPress plugin versions prior to 4.5 gmw-premium-settings WordPress plugin versions prior to 3.1 Description: The issue is related to insufficient validation of files to be uploaded, which could allow attackers to upload arbitrary...

CISA and Partners Release Update to BianLian Ransomware Cybersecurity Advisory

Today, CISA, the Federal Bureau of Investigation FBI, and the Australian Signals Directorate’s Australian Cyber Security Centre ASD’s ACSC released updates to StopRansomware: BianLian Ransomware Group on observed tactics, techniques, and procedures TTPs and indicators of compromise attributed to...

PT-2024-9323 · Drupal +1 · Drupal Core +1

Name of the Vulnerable Software and Affected Versions: Drupal Core versions 7.0 through 7.101 Drupal Core versions 8.0.0 through 10.2.10 Drupal Core versions 10.3.0 through 10.3.8 Description: The issue is related to the deserialization of untrusted data, which allows object injection. This can...

PT-2024-9308 · Drupal · Drupal Core

Name of the Vulnerable Software and Affected Versions: Drupal Core versions 8.0.0 through 10.2.10 Drupal Core versions 10.3.0 through 10.3.8 Drupal Core versions 11.0.0 through 11.0.7 Description: The issue is related to the deserialization of untrusted data, which allows object injection. This c...

PT-2024-35431 · Dedebiz · Dedebiz

Name of the Vulnerable Software and Affected Versions: DedeBIZ version 6.3.0 Description: An arbitrary file upload vulnerability in the component "/admin/file manage control" allows attackers to execute arbitrary code via uploading a crafted file. Recommendations: For DedeBIZ version 6.3.0,...