PT-2024-07: Reading arbitrary files via API in PT Application Inspector (PT AI)

The vulnerability was identified in PT AI affecting versions 4.3.1 to 4.7.2. The vulnerability can be exploited by an attacker with network access to the PT AI control server to read source code files of other user's projects. The vulnerability can be exploited for privilege escalation...

PT-2024-27058 · Unknown · Chaos-Mesh

Name of the Vulnerable Software and Affected Versions: chaos-mesh version 2.6.3 Description: The issue allows attackers to access sensitive data and escalate privileges by obtaining the service account's token due to insecure permissions. Recommendations: For chaos-mesh version 2.6.3, update to a...

Django 4.x < 4.2.14, 5.x < 5.0.7 Multiple Vulnerabilities - Linux

Django is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:djangoproject:django"; if descriptio...

PT-2024-4400 · Pgadmin · Pgadmin

Name of the Vulnerable Software and Affected Versions: pgAdmin versions prior to 8.8 pgAdmin 4 affected versions not specified Description: The issue is related to errors in permission handling, which can allow an attacker to gain unauthorized access to the installation directory on certain...

PT-2024-26693 · Theme Freesia · Theme Freesia Pixgraphy

Name of the Vulnerable Software and Affected Versions: Theme Freesia Pixgraphy versions 1.3.8 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS, which allows Stored XSS. This means that an attacker...

PT-2024-4025

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 125.0.6422.112 Description: The issue is related to a type confusion vulnerability in the V8 engine of Google Chrome, which can be exploited by a remote attacker to execute arbitrary code inside a sandbox via a...

PT-2024-26999 · WordPress · Newsletter Popup

Name of the Vulnerable Software and Affected Versions: Newsletter Popup WordPress plugin versions 1.2 and earlier Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This is possible because some settings are not properly sanitised a...

Medium: clamav

Issue Overview: A vulnerability in the OLE2 file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. This vulnerability is due to an incorrect check for end-of-string values during scanning, which may result in ...

Important: flatpak

Issue Overview: Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. in versions before 1.10.9, 1.12.9, 1.14.6, and 1.15.8, a malicious or compromised Flatpak app could execute arbitrary code outside its sandbox. Normally, the --command argument of...

PT-2024-4483 · Lenovo · Lenovo Service Bridge

Name of the Vulnerable Software and Affected Versions: Lenovo Service Bridge versions prior to 5.0.2.17 Description: A privilege escalation issue was reported that could allow operating system commands to be executed if a specially crafted link is visited. The vulnerability is related to the...

PT-2024-25867 · Unknown · Thim Elementor Kit

Name of the Vulnerable Software and Affected Versions: Thim Elementor Kit versions 1.1.8 and earlier Description: The issue is related to improper neutralization of input during web page generation, which can lead to Stored XSS. This allows for the storage of malicious scripts in a website, which...

PT-2024-26962 · WordPress · Responsive Contact Form Builder & Lead Generation Plugin

Name of the Vulnerable Software and Affected Versions: The Responsive Contact Form Builder & Lead Generation Plugin WordPress plugin versions 1.8.9 and earlier Description: The issue concerns the lack of sanitization and escaping of some settings in the plugin, which could allow high-privilege...

PT-2024-24799 · Mycred · Mycred

Name of the Vulnerable Software and Affected Versions: myCred versions n/a through 2.6.3 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can inject malicious...

PT-2024-13797 · WordPress · Wp-Formassembly

Name of the Vulnerable Software and Affected Versions: WP-FormAssembly versions n/a through 2.0.10 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Stored XSS attacks. Recommendations: For...

PT-2024-24689 · Melapress · Melapress Wp 2Fa

Name of the Vulnerable Software and Affected Versions: Melapress WP 2FA versions n/a through 2.6.2 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This means that an attacker can inje...

PT-2024-22472 · WordPress · The Simple Buttons Creator

Name of the Vulnerable Software and Affected Versions: The Simple Buttons Creator WordPress plugin versions 1.04 and earlier Description: The issue affects the add button function of the plugin, which lacks authorization and CSRF protection, allowing unauthenticated users to call it directly or v...

PT-2024-18277 · WordPress · Nps Computy Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: NPS computy WordPress plugin versions 2.7.5 and earlier Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for example, i...

PT-2024-14945 · WordPress · Wordpress Ping Optimizer

Name of the Vulnerable Software and Affected Versions: WordPress Ping Optimizer plugin versions through 2.35.1.3.0 Description: The issue concerns the lack of CSRF checks in certain areas, potentially allowing attackers to trick logged-in users into performing unwanted actions, such as clearing...

PT-2024-23882 · WordPress · Wp Poll Maker

Name of the Vulnerable Software and Affected Versions: WP Poll Maker versions prior to 3.1 Description: The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as a 'Path Traversal' vulnerability. This allows for potential unauthorized access to files...

PT-2024-2720

Name of the Vulnerable Software and Affected Versions Rust versions prior to 1.77.2 Description A critical security flaw in the Rust standard library could be exploited to target Windows users and stage command injection attacks. The vulnerability allows attackers to execute arbitrary shell...