PT-2024-21719 · Joomla · Joomla!

Name of the Vulnerable Software and Affected Versions: Joomla versions 3.4.6 through 5.1.2 Description: Inadequate validation of URLs could result in an invalid check of whether a redirect URL is internal or not. This issue may allow obscure unsafe links. Recommendations: For Joomla versions 3.4....

PT-2024-30020 · Unknown · Blood Bank/Donation Management System

Name of the Vulnerable Software and Affected Versions: Blood Bank And Donation Management System affected versions not specified Description: A cross-site scripting XSS vulnerability in the component update page details.php allows attackers to execute arbitrary web scripts or HTML via a crafted...

PT-2024-30065 · Pligg Cms · Pligg Cms

Name of the Vulnerable Software and Affected Versions: Pligg CMS version 2.0.2 Description: A Cross-Site Request Forgery CSRF issue was discovered in Pligg CMS. The vulnerability is exploited via the "/admin/domain management.php?whitelist add" API endpoint. Recommendations: For Pligg CMS version...

PT-2024-6564

Name of the Vulnerable Software and Affected Versions SPIP versions prior to 4.30-alpha2, 4.2.13, and 4.1.16 Description The porte plume plugin used by SPIP is vulnerable to an arbitrary code execution vulnerability. A remote and unauthenticated attacker can execute arbitrary PHP as the SPIP user...

PT-2024-9089

Name of the Vulnerable Software and Affected Versions GNU Emacs versions through 30.0.92 Description The issue is related to the elisp-completion-at-point function in GNU Emacs, which can trigger unsafe Lisp macro expansion when used on untrusted Emacs Lisp source code. This allows attackers to...

PT-2025-28263 · Invt · Invt Vt-Designer

Name of the Vulnerable Software and Affected Versions: INVT VT-Designer affected versions not specified Description: The issue is related to a remote code execution vulnerability due to out-of-bounds write when parsing PM3 files. There is no information provided about the estimated number of...

PT-2025-28262 · Invt · Invt Vt-Designer

Name of the Vulnerable Software and Affected Versions: INVT VT-Designer affected versions not specified Description: The issue is related to a remote code execution vulnerability due to out-of-bounds write when parsing PM3 files. There is no information provided about the estimated number of...

PT-2024-37695 · Directus · Directus

Name of the Vulnerable Software and Affected Versions: Directus version 10.13.0 Description: The issue allows an authenticated external attacker to execute arbitrary JavaScript on the client. This is possible because the application injects an attacker-controlled parameter into an unsanitized DOM...

Adobe Releases Security Updates for Multiple Products

Adobe released security updates to address multiple vulnerabilities in Adobe software. A cyber threat actor could exploit some of these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review the following Adobe Security Bulletins and apply the...

PT-2025-16921 · Google · Chrome Os

Name of the Vulnerable Software and Affected Versions: Google ChromeOS version 124.0.6367.34 Description: The issue allows enrolled users with local access to unenroll devices and intercept device management requests by loading components from the unencrypted stateful partition. This is due to a...

Rockwell Automation ControlLogix, GuardLogix 5580, CompactLogix, Compact GuardLogix 5380

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.7 ATTENTION : Exploitable remotely/low attack complexity Vendor : Rockwell Automation Equipment : ControlLogix, GuardLogix 5580, CompactLogix, Compact GuardLogix 5380 Vulnerability : Improper Input Validation 2. RISK EVALUATION Successful exploitation of...

PT-2024-8613 · Tenda · Tenda Ac6

Name of the Vulnerable Software and Affected Versions: Tenda AC6 version 15.03.05.19 Description: A critical issue has been found in the formWriteFacMac function of the /goform/WriteFacMac API endpoint. The manipulation of the mac parameter leads to command injection. This issue can be exploited...

PT-2024-8700 · 8X8 · Jitsi Meet

Name of the Vulnerable Software and Affected Versions: Jitsi Meet versions prior to 2.0.9779 Description: The issue is related to the insecure implementation of the video file sharing functionality in Jitsi Meet. This allows a remote attacker to load arbitrary video files if a message from anothe...

PT-2024-5547

Name of the Vulnerable Software and Affected Versions Microsoft Edge versions prior to the fixed version Microsoft Windows 10 version 1507 prior to 10.0.10240.20751 Description The vulnerability is related to a memory corruption issue in the Windows Scripting Engine, which can be exploited by...

AMD µPROF Security Notice

Bulletin ID: AMD-SB-9001 Potential Impact: Varies by CVE, see descriptions below Severity: Varies by CVE, see descriptions below Summary AMD μProf “MICRO-prof” is a software profiling analysis tool for x86 applications running on Windows®, Linux® and FreeBSD® operating systems and is designed to...

PT-2024-6342 · Google +5 · Google Chrome +6

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 128.0.6613.119 Description: The issue is related to an out of bounds write in the V8 JavaScript engine of Google Chrome and Microsoft Edge browsers. This can allow a remote attacker to potentially exploit heap...

PT-2024-5811

Name of the Vulnerable Software and Affected Versions SolarWinds Web Help Desk versions prior to 12.8.3 Hotfix 2 Description SolarWinds Web Help Desk is susceptible to a Java deserialization remote code execution issue. Exploitation of this issue could allow a malicious actor to execute arbitrary...

Best Practices for Cisco Device Configuration

In recent incidents, CISA has seen malicious cyber actors acquire system configuration files by leveraging available protocols or software on devices, such as abusing the legacy Cisco Smart Install feature. CISA recommends organizations disable Smart Install and review NSA’s Smart Install Protoco...

PT-2024-28869 · Unknown · Kashipara Live Membership System

Name of the Vulnerable Software and Affected Versions: Kashipara Live Membership System version 1.0 Description: An Unrestricted file upload vulnerability was found in "/Membership/edit member.php" of Kashipara Live Membership System, which allows attackers to execute arbitrary code via uploading...

PT-2024-28873 · Unknown · Kashipara Live Membership System

Name of the Vulnerable Software and Affected Versions: Kashipara Live Membership System version 1.0 Description: A Cross-Site Request Forgery CSRF issue was found in the Kashipara Live Membership System. This could lead to an attacker tricking the administrator into deleting valid member data via...