PT-2024-12236 · Sparkle Themes · Sparkle Themes Blogger Buzz

Name of the Vulnerable Software and Affected Versions: Sparkle Themes Blogger Buzz versions 1.2.2 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: For Sparkle...

HashiCorp Consul: Multiple Vulnerabilities

Background HashiCorp Consul is a tool for service discovery, monitoring and configuration. Description Multiple vulnerabilities have been discovered in HashiCorp Consul. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details...

PT-2024-35922 · Unknown · Basix Nex-Forms

Name of the Vulnerable Software and Affected Versions: Basix NEX-Forms – Ultimate Form Builder versions prior to 8.7.9 Description: The issue is related to the improper neutralization of special elements used in an SQL command, also known as 'SQL Injection'. This allows for malicious SQL commands...

PT-2025-3620

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.74 Description The issue arises from ksmbd attempting to set atime and mtime via notify change without also setting ctime, resulting in a warning. This warning is triggered by the setattr copy function. The...

PT-2024-35930 · Unknown · Pinpoint Booking System

Name of the Vulnerable Software and Affected Versions: Pinpoint Booking System versions through 2.9.9.5.1 Description: The issue is related to an SQL Injection vulnerability, specifically a Blind SQL Injection, which arises from the improper neutralization of special elements used in an SQL...

PT-2024-35927 · WordPress · Wp Geonames

Name of the Vulnerable Software and Affected Versions: WP GeoNames versions 1.8 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Reflected XSS. Recommendations: For WP GeoNames version...

Debian dsa-5824 : chromium - security update

The remote Debian 12 host has packages installed that are affected by a vulnerability as referenced in the dsa-5824 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-5824-1 [email protected] https://www.debian.org/security/ Andres...

PT-2024-16921 · WordPress · Smart Popup Blaster

Name of the Vulnerable Software and Affected Versions: Smart PopUp Blaster plugin for WordPress versions up to, and including, 1.4.3 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'spb-button' shortcode due to insufficient input sanitization and output escaping ...

PT-2024-17002 · WordPress · Onlyoffice Docs

Name of the Vulnerable Software and Affected Versions: ONLYOFFICE Docs plugin for WordPress versions up to, and including, 2.0.0 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'onlyoffice' shortcode due to insufficient input sanitization and output escaping on...

PT-2024-35909 · Unknown · Andy Moyle Church Admin

Name of the Vulnerable Software and Affected Versions: Andy Moyle Church Admin versions 5.0.8 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows accessing functionality not properly constrained by ACLs. Recommendations: For versions 5.0.8 and...

CVE-2024-52798 path-to-regexp Unpatched `path-to-regexp` ReDoS in 0.1.x

path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. The regular expression that is vulnerable to backtracking can be generated in the 0.1.x release of path-to-regexp. Upgra...

GHSA-VXCF-C7MX-PG53 Build corruption when using `PYO3_CONFIG_FILE` environment variable

In PyO3 0.23.0 the PYO3CONFIGFILE environment variable used to configure builds regressed such that changing the environment variable would no longer trigger PyO3 to reconfigure and recompile. In combination with workflows using tools such as maturin to build for multiple versions in a single...

rPGP Panics on Malformed Untrusted Input

During a security audit, Radically Open Security discovered several reachable edge cases which allow an attacker to trigger rpgp crashes by providing crafted data. Impact When processing malformed input, rpgp can run into Rust panics which halt the program. This can happen in the following...

CVE-2024-12227 MSI Dragon Center IOCTL NTIOLib_X64.sys MmUnMapIoSpace null pointer dereference

A vulnerability, which was classified as problematic, was found in MSI Dragon Center up to 2.0.146.0. This affects the function MmUnMapIoSpace in the library NTIOLibX64.sys of the component IOCTL Handler. The manipulation leads to null pointer dereference. It is possible to launch the attack on t...

Planet Technology Planet WGS-804HPT

RISK EVALUATION Successful exploitation of these vulnerabilities could result in remote code execution. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as: Minimize network exposure for all control system...

PT-2024-36919

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.74 Description The issue arises from the migrate to node function assuming there is at least one VMA in a MM, which is not always true. This can lead to find vma returning NULL, and subsequently, a null point...

PT-2024-17295 · WordPress · Listdom

Name of the Vulnerable Software and Affected Versions: Listdom – Business Directory and Classified Ads Listings WordPress Plugin versions up to, and including, 3.7.0 Description: The issue is related to Stored Cross-Site Scripting via the shortcode parameter due to insufficient input sanitization...

PT-2024-36009 · Unknown · Dependency-Track

Name of the Vulnerable Software and Affected Versions: Dependency-Track versions prior to 4.12.2 Description: The issue allows actors to enumerate valid names of managed users by leveraging the observable difference in request duration when performing a login request against the...

PT-2024-17330 · WordPress · Mightyforms

Name of the Vulnerable Software and Affected Versions: Contact Form, Survey & Form Builder – MightyForms plugin for WordPress versions up to, and including, 1.3.9 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'mightyforms' shortcode due to insufficient input...

Fuji Electric Tellus Lite V-Simulator (Update A)

RISK EVALUATION Successful exploitation of these vulnerabilities could crash the device being accessed. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. CISA reminds organizations to perform proper impact...