GHSA-MQ39-4GV4-MVPX vulnerabilities

Vulnerabilities for packages: zot, kubescape, up, buf, aactl, wolfictl, kaniko, conftest-fips, ctop, cadvisor-fips, cilium-cli, ko, buildkitd, crossplane, grype, trivy, syft, spire-server, docker-compose, cadvisor, loki, prometheus, melange, tkn, dagger, conftest, spire-server-fips, kargo...

kube-controller-manager: malformed HPA v1 manifest causes crash

A flaw was found in kube-controller-manager. This issue occurs when the initial application of a HPA config YAML lacking a .spec.behavior.scaleUp block causes a denial of service due to KCM pods going into restart churn...

PT-2024-18242 · Mediavine · Create By Mediavine Plugin For Wordpress

Name of the Vulnerable Software and Affected Versions: Create by Mediavine plugin for WordPress versions up to, and including, 1.9.4 Description: The issue allows for SQL Injection via the id parameter due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation ...

PrestaShop Best-Kit Pop-up Security Vulnerability

PrestaShop is an open source e-commerce solution from PrestaShop, Inc. in the United States. The solution provides multiple payment methods, short message alerts and product image scaling. A security vulnerability exists in PrestaShop Best-Kit Pop-up v.1.7.2 and earlier versions, which stems from...

PT-2024-19643 · WordPress · Animated Headline

Name of the Vulnerable Software and Affected Versions: Animated Headline plugin for WordPress versions up to, and including, 4.0 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the 'animated-headline' shortcode. This allows...

CVE-2024-29107

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPVibes Elementor Addon Elements allows Stored XSS.This issue affects Elementor Addon Elements: from n/a through 1.12.10...

up-front-works.jp Cross Site Scripting vulnerability OBB-3878099

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

PT-2024-22736 · Zaytech · Zaytech Smart Online Order For Clover

Name of the Vulnerable Software and Affected Versions: Zaytech Smart Online Order for Clover versions 1.5.5 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an...

PT-2024-21373 · Unknown · Bdtask Wholesale Inventory Management System

Name of the Vulnerable Software and Affected Versions: Bdtask Wholesale Inventory Management System versions up to 20240311 Description: A vulnerability was found in the system, affecting an unknown functionality, which leads to session fixiation. The attack can be launched remotely. The exploit...

After upgrading to 13.1 49.x build , the PE CPU significantly increases after running for some time

You may observe the following issues when you're running the below version 13.1 52.x/14.1 17.x and using hundreds of admin partitions: All newnslog files have a very small time range, for example, 1-5 seconds. nsconmsg -K newnslog -d setime start time Fri Sep 8 03:25:28 2023 end time Fri Sep 8...

PT-2024-22725 · WordPress · Timersys Wp Popups

Name of the Vulnerable Software and Affected Versions: Timersys WP Popups versions n/a through 2.1.5.5 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Stored XSS. This means that an attacker can inject...

VulnCheck KEV: CVE-2024-29136

Deserialization of Untrusted Data vulnerability in Themefic Tourfic.This issue affects Tourfic: from n/a through 2.11.17...

PT-2024-21307 · Fujian Kelixin · Fujian Kelixin Communication Command/Dispatch Platform

Name of the Vulnerable Software and Affected Versions: Fujian Kelixin Communication Command and Dispatch Platform versions up to 20240318 Description: A critical issue has been found in the Fujian Kelixin Communication Command and Dispatch Platform, affecting an unknown functionality of the file...

CVE-2024-27957

Unrestricted Upload of File with Dangerous Type vulnerability in Pie Register.This issue affects Pie Register: from n/a through 3.8.3.1...

CVE-2024-27958

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Themeisle Visualizer allows Reflected XSS.This issue affects Visualizer: from n/a through 3.10.5...

CVE-2024-25933

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Pepro Dev. Group PeproDev Ultimate Invoice.This issue affects PeproDev Ultimate Invoice: from n/a through 1.9.7...

VulnCheck KEV: CVE-2024-0305

A vulnerability was found in Guangzhou Yingke Electronic Technology Ncast up to 2017 and classified as problematic. Affected by this issue is some unknown functionality of the file /manage/IPSetup.php of the component Guest Login. The manipulation leads to information disclosure. The attack may...

PandaX SQL Injection Vulnerability

PandaX is PandaX open source a Go language open source low-code development framework for enterprise IoT platforms. An SQL injection vulnerability exists in PandaX version 20240310 and earlier versions, which stems from the fact that incorrect manipulation of the parameter roleKey can lead to sql...

PT-2024-21632 · Linux +3 · Linux Kernel +3

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue arises when a lower file's size is changed underneath overlayfs, causing an assertion in the copy up data loop. This type of use case is documented to cause undefined behavio...

CVE-2024-1733

The Word Replacer Pro plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wordreplacerultra function in all versions up to, and including, 1.0. This makes it possible for unauthenticated attackers to update arbitrary content on the...