PT-2024-26507 · Linkstack · Linkstack

Name of the Vulnerable Software and Affected Versions: LinkStack versions 2.7.9 through 4.7.7 Description: The issue is a Server-Side Request Forgery SSRF vulnerability. It affects the resourcesviewscomponentsfavicon.blade.php file, allowing it to be linked with SSRF. This vulnerability poses a...

PT-2024-9682

Name of the Vulnerable Software and Affected Versions Django versions 4.2 through 4.2.16 Django versions 5.0 through 5.0.9 Django versions 5.1 through 5.1.3 Description The issue is related to the strip tags method and the striptags template filter in Django, which are subject to a potential...

PT-2024-16315 · WordPress · Element Pack Elementor Addons

Name of the Vulnerable Software and Affected Versions: Element Pack Elementor Addons plugin for WordPress versions prior to 5.10.3 Description: The issue concerns the Element Pack Elementor Addons plugin for WordPress, which does not validate and escape some of its block options before outputting...

PT-2024-16835 · WordPress · Otter Blocks

Name of the Vulnerable Software and Affected Versions: Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress versions up to, and including, 3.0.6 Description: The issue allows unauthenticated attackers to view arbitrary images on the server, which can conta...

PT-2024-8876

Name of the Vulnerable Software and Affected Versions: Zabbix versions 6.0.0 through 6.0.31 Zabbix versions 6.4.0 through 6.4.16 Zabbix version 7.0.0 Description: A non-admin user account on the Zabbix frontend with the default User role, or with any other role that gives API access, can exploit...

PT-2024-9392

Vulnerability Summary Name of the Vulnerable Software and Affected Versions: Apache Struts versions 2.0.0 through 2.3.37, 2.5.0 through 2.5.33, and 6.0.0 through 6.3.0.2. Description A critical flaw exists in the file upload logic of Apache Struts. An attacker can manipulate file upload parameter...

PT-2024-16596 · WordPress · Product Input Fields For Woocommerce

Name of the Vulnerable Software and Affected Versions: Product Input Fields for WooCommerce plugin for WordPress versions up to, and including, 1.9 Description: The issue allows authenticated attackers with Contributor-level access and above to read the contents of arbitrary files on the server,...

PT-2024-39171 · Cri-O · Cri-O

Name of the Vulnerable Software and Affected Versions: CRI-O versions prior to 1.29.11 CRI-O versions 1.30.0 through 1.30.8 CRI-O versions 1.31.0 through 1.31.3 Description: A vulnerability was found in CRI-O, where it can be requested to take a checkpoint archive of a container and later be aske...

PT-2024-29562 · Ibm · Ibm Powervm Hypervisor

Name of the Vulnerable Software and Affected Versions: IBM PowerVM Hypervisor versions FW950.00 through FW950.90 IBM PowerVM Hypervisor versions FW1030.00 through FW1030.60 IBM PowerVM Hypervisor versions FW1050.00 through FW1050.20 IBM PowerVM Hypervisor versions FW1060.00 through FW1060.10...

PT-2024-16606 · WordPress · La-Studio Element Kit For Elementor

Name of the Vulnerable Software and Affected Versions: LA-Studio Element Kit for Elementor plugin for WordPress versions up to, and including, 1.4.2 Description: The issue allows authenticated attackers with Contributor-level access and above to include and execute arbitrary files on the server v...

PT-2024-17221

Name of the Vulnerable Software and Affected Versions Rustls version 0.23.13 Description A flaw was found in Rustls and related APIs, allowing denial of service panic via a fragmented TLS ClientHello message. Recommendations For Rustls version 0.23.13, consider disabling the handling of fragmente...

mySCADA myPRO Manager

RISK EVALUATION Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands or disclose sensitive information. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such...

PT-2024-39622 · WordPress · Gmw-Premium-Settings +1

Name of the Vulnerable Software and Affected Versions: GEO my WP WordPress plugin versions prior to 4.5 gmw-premium-settings WordPress plugin versions prior to 3.1 Description: The issue is related to insufficient validation of files to be uploaded, which could allow attackers to upload arbitrary...

CISA and Partners Release Update to BianLian Ransomware Cybersecurity Advisory

Today, CISA, the Federal Bureau of Investigation FBI, and the Australian Signals Directorate’s Australian Cyber Security Centre ASD’s ACSC released updates to StopRansomware: BianLian Ransomware Group on observed tactics, techniques, and procedures TTPs and indicators of compromise attributed to...

PT-2024-9307 · Drupal · Drupal Core

Name of the Vulnerable Software and Affected Versions: Drupal Core versions 8.0.0 through 10.2.10 Drupal Core versions 10.3.0 through 10.3.8 Drupal Core versions 11.0.0 through 11.0.7 Description: The issue is related to the deserialization of untrusted data, which allows object injection. This c...

PT-2024-35431 · Dedebiz · Dedebiz

Name of the Vulnerable Software and Affected Versions: DedeBIZ version 6.3.0 Description: An arbitrary file upload vulnerability in the component "/admin/file manage control" allows attackers to execute arbitrary code via uploading a crafted file. Recommendations: For DedeBIZ version 6.3.0,...

PT-2024-9308 · Drupal · Drupal Core

Name of the Vulnerable Software and Affected Versions: Drupal Core versions 8.0.0 through 10.2.10 Drupal Core versions 10.3.0 through 10.3.8 Drupal Core versions 11.0.0 through 11.0.7 Description: The issue is related to the deserialization of untrusted data, which allows object injection. This c...

PT-2024-35150 · Rancher · Rancher Manager

Name of the Vulnerable Software and Affected Versions: Rancher Manager versions prior to 2.8.10 Rancher Manager versions prior to 2.9.5 Description: A vulnerability has been identified in Rancher Manager where applications installed via the Apps Catalog store their Helm values directly into the...

PT-2024-9323 · Drupal +1 · Drupal Core +1

Name of the Vulnerable Software and Affected Versions: Drupal Core versions 7.0 through 7.101 Drupal Core versions 8.0.0 through 10.2.10 Drupal Core versions 10.3.0 through 10.3.8 Description: The issue is related to the deserialization of untrusted data, which allows object injection. This can...

PT-2024-9380 · Drupal · Drupal Core

Name of the Vulnerable Software and Affected Versions: Drupal Core versions 8.0.0 through 10.2.11 Drupal Core versions 10.3.0 through 10.3.9 Drupal Core versions 11.0.0 through 11.0.8 Description: A vulnerability in Drupal Core allows privilege escalation. This issue is related to inconsistencies...