PT-2024-38982 · WordPress · Safe-Svg

Name of the Vulnerable Software and Affected Versions: Safe SVG WordPress plugin versions prior to 2.2.6 Description: The issue arises because the sanitisation code in the Safe SVG WordPress plugin only runs for paths that call wp handle upload, but not for code that uses wp handle sideload, whic...

PT-2024-7681

Name of the Vulnerable Software and Affected Versions Cisco Unified Industrial Wireless Software for Cisco Ultra-Reliable Wireless Backhaul URWB Access Points versions prior to 17.15.1 Catalyst IW9165D Heavy Duty Access Points versions prior to 17.15.1 Catalyst IW9165E Rugged Access Points and...

RUSTSEC-2024-0445 cap-primitives doesn't fully sandbox all the Windows device filenames

Impact cap-primitives's filesystem sandbox implementation on Windows blocks access to special device filenames such as "COM1", "COM2", "LPT0", "LPT1", and so on, however it did not block access to the special device filenames which use superscript digits, such as "COM¹", "COM²", "LPT⁰", "LPT¹", a...

PT-2024-32618 · Unknown · Openharmony

Name of the Vulnerable Software and Affected Versions: OpenHarmony versions prior to 4.0.0 Description: The issue allows a local attacker to cause a denial of service DOS through an out-of-bounds read. Recommendations: For versions prior to 4.0.0, update to version 4.0.0 or later to resolve the...

Debian dla-3946 : context - security update

The remote Debian 11 host has a package installed that is affected by a vulnerability as referenced in the dla-3946 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3946-1 [email protected] https://www.debian.org/lts/security/...

PT-2024-39907 · 10Web · The Photo Gallery

Name of the Vulnerable Software and Affected Versions: The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress versions up to, and including, 1.8.30 Description: The issue is related to Stored Cross-Site Scripting via admin settings due to insufficient input sanitization a...

CVE-2024-51734 User data deletion by anoynmous users in Zope

Zope AccessControl provides a general security framework for use in Zope. In affected versions anonymous users can delete the user data maintained by an AccessControl.userfolder.UserFolder which may prevent any privileged access. This problem has been fixed in version 7.2. Users are advised to...

OpenJDK: integer truncation issue in Xalan-J (JAXP, 8285407)

The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. This can be used to corrupt Java class files generated by the internal XSLTC compiler and execute arbitrary Java bytecode. Users are recommended to update to version 2.7.3 o...

PT-2024-34769 · Mansur Ahamed · Woocommerce Quote Calculator

Name of the Vulnerable Software and Affected Versions: Mansur Ahamed Woocommerce Quote Calculator versions prior to 1.1 Description: The issue is related to an SQL Injection vulnerability, specifically Improper Neutralization of Special Elements used in an SQL Command, allowing Blind SQL Injectio...

RHEL 5 : JBoss Enterprise Web Platform 5.1.0 (RHSA-2010:0961)

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2010:0961 advisory. The Enterprise Web Platform is for mid-size workloads, focusing on light and rich Java applications. Web Platform is a slimmed down profile of the...

PT-2024-34156 · Webfeed · Webfeed

Name of the Vulnerable Software and Affected Versions: WebFeed versions prior to 0.9.2 Description: The issue concerns multiple HTML injection vulnerabilities that can lead to CSRF and UI spoofing attacks. A remote attacker can provide malicious RSS feeds, attracting the victim user to visit them...

RHEL 6 / 7 : qemu-kvm-rhev (RHSA-2015:1004)

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2015:1004 advisory. KVM Kernel-based Virtual Machine is a full virtualization solution for Linux on AMD64 and Intel 64 systems. The qemu-kvm-rhev package provides th...

RHEL 6 : openstack-swift (RHSA-2015:0836)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2015:0836 advisory. OpenStack Object Storage swift provides object storage in virtual containers, which allows users to store and retrieve files arbitrary data. The...

PT-2024-34662 · Cobalt · Cobalt

Name of the Vulnerable Software and Affected Versions: cobalt versions prior to 10.2.1 Description: A malicious cobalt instance could serve links with the javascript: protocol, resulting in Cross-site Scripting XSS when the user tries to download an item from a picker. This issue has been present...

Debian dla-3944 : thunderbird - security update

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3944 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3944-1 [email protected]...

PT-2024-16507 · Unknown · Phpgurukul Online Shopping Portal

Name of the Vulnerable Software and Affected Versions: PHPGurukul Online Shopping Portal version 2.0 Description: A vulnerability was found in the PHPGurukul Online Shopping Portal, allowing for cross-site scripting XSS attacks. The issue is related to an unknown function in the file...

CVE-2024-10654

A vulnerability has been found in TOTOLINK LR350 up to 9.3.5u.6369 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /formLoginAuth.htm. The manipulation of the argument authCode with the input 1 leads to authorization bypass. The attack can be...

Progress Telerik Report Server <= 10.2.24.806 Insecure Type Resolution (CVE-2024-8015)

The version of Progress Telerik Report Server installed on the remote host is affected by an insecure type resolution vulnerability: - A remote code execution attack is possible through object injection via an insecure type resolution vulnerability. CVE-2024-8015 Note that Nessus has not tested f...

PT-2024-27591 · Radiustheme · Post Grid Team

Name of the Vulnerable Software and Affected Versions: Post Grid Team by RadiusTheme versions n/a through 7.7.4 Description: The issue is related to a Missing Authorization vulnerability in the Post Grid Team by RadiusTheme. It allows exploiting incorrectly configured access control security...

PT-2024-27542 · Automattic · Newspack Blocks

Name of the Vulnerable Software and Affected Versions: Newspack Blocks versions through 3.0.8 Description: The issue is related to a Missing Authorization vulnerability in Automattic Newspack Blocks, which allows exploiting incorrectly configured access control security levels. Recommendations: F...