PT-2024-32957 · Cubewp · Cubewp

Name of the Vulnerable Software and Affected Versions: CubeWP – All-in-One Dynamic Content Framework versions 1.1.15 and earlier Description: The issue affects the CubeWP – All-in-One Dynamic Content Framework due to a Missing Authorization vulnerability. This vulnerability allows for the...

PT-2024-27440 · Unknown · Paid Memberships Pro

Name of the Vulnerable Software and Affected Versions: Paid Memberships Pro versions n/a through 3.0.4 Description: The issue is related to an Authorization Bypass Through User-Controlled Key vulnerability, which allows accessing functionality not properly constrained by ACLs. Recommendations: Fo...

PT-2024-30378 · Unknown · Creativemotion Social Slider Feed

Name of the Vulnerable Software and Affected Versions: creativemotion Social Slider Feed versions through 2.2.2 Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: For versions...

PT-2024-30479 · Woocommerce · Wpc Frequently Bought Together

Name of the Vulnerable Software and Affected Versions: WPC Frequently Bought Together for WooCommerce versions prior to 7.1.9 Description: The issue affects the WPC Frequently Bought Together for WooCommerce plugin due to a Missing Authorization vulnerability. This vulnerability allows for the...

PT-2024-32526 · WordPress · Wp Sunshine Sunshine Photo Cart

Name of the Vulnerable Software and Affected Versions: WP Sunshine Sunshine Photo Cart versions 3.2.8 and earlier Description: The issue is related to a Missing Authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. Recommendations: For WP...

PT-2024-16124 · WordPress · Wp Team – Wordpress Team Member Plugin

Name of the Vulnerable Software and Affected Versions: WP Team – WordPress Team Member Plugin versions up to, and including, 1.1.4 Description: The issue is related to Stored Cross-Site Scripting via the plugin's htteamember shortcode due to insufficient input sanitization and output escaping on...

PT-2024-16245 · WordPress · Download Monitor

Name of the Vulnerable Software and Affected Versions: Download Monitor plugin for WordPress versions up to, and including, 5.0.13 Description: The issue is related to a missing capability check on the ajax search users function, allowing authenticated attackers with Subscriber-level access and...

PT-2024-16096 · WordPress · Newsletters

Name of the Vulnerable Software and Affected Versions: Newsletters plugin for WordPress versions up to, and including, 4.9.9.4 Description: The issue is related to Stored Cross-Site Scripting via the plugin's newsletters video shortcode due to insufficient input sanitization and output escaping o...

PT-2024-34199 · Roland Murg · Wp Booking System

Name of the Vulnerable Software and Affected Versions: WP Booking System versions 2.0.19.10 and earlier Description: The issue affects the exposure of sensitive system information to an unauthorized control sphere in the Veribo, Roland Murg WP Booking System. Recommendations: For WP Booking Syste...

PT-2024-33271 · Kyverno +1 · Kyverno +1

Name of the Vulnerable Software and Affected Versions: Kyverno versions prior to 1.13.0 Description: A kyverno ClusterPolicy can be overridden by the creation of a PolicyException in a random namespace. By design, PolicyExceptions are consumed from any namespace, which may allow users with...

PT-2024-34196 · Cloudways · Cloudways Breeze

Name of the Vulnerable Software and Affected Versions: Cloudways Breeze versions 2.1.14 and earlier Description: The issue is related to a Missing Authorization vulnerability in Cloudways Breeze, which allows exploitation due to incorrectly configured access control security levels...

PT-2024-34184 · Unknown · Namaste! Lms

Name of the Vulnerable Software and Affected Versions: Namaste! LMS versions through 2.6.4 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS attacks. Recommendations: For versions...

PT-2024-34195 · Wp Overnight · Woocommerce Pdf Invoices & Packing Slips

Name of the Vulnerable Software and Affected Versions: WooCommerce PDF Invoices & Packing Slips versions 3.8.6 and earlier Description: The issue is related to a Missing Authorization vulnerability in WP Overnight WooCommerce PDF Invoices & Packing Slips, which allows exploiting incorrectly...

PT-2024-7627 · Google +5 · Google Chrome +5

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 130.0.6723.92 Microsoft Edge versions prior to the fixed version affected versions not specified Description: The issue is related to a use-after-free vulnerability in the implementation of WebRTC technology in...

PT-2024-34180 · Unknown · Namaste! Lms

Name of the Vulnerable Software and Affected Versions: Namaste! LMS versions through 2.6.2 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Reflected XSS attacks. Recommendations: For versions...

Internet Bug Bounty: CVE-2024-49761: ReDoS vulnerability in REXML

CVE-2024-49761 was a ReDoS vulnerability in the REXML gem. The vulnerability was caused by the parsing of XML input with many digits between "&" and "x...;" in a hex numeric character reference. This issue was resolved by updating the REXML gem to version 3.3.9 or later...

PT-2024-34236 · Unknown · Firelight Lightbox

Name of the Vulnerable Software and Affected Versions: Firelight Lightbox versions 2.3.3 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS attacks. Recommendations: For...

Fedora 40 : chromium (2024-f1117faa03)

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-f1117faa03 advisory. update to 130.0.6723.69 High CVE-2024-10229: Inappropriate implementation in Extensions High CVE-2024-10230: Type Confusion in V8 High CVE-2024-1023...

PT-2024-31116 · Apple · Macos Sequoia +1

Name of the Vulnerable Software and Affected Versions: macOS Sequoia versions prior to 15.1 Description: A privacy issue was addressed by improving private data redaction for log entries. This allows a user to potentially view sensitive user information. The issue was fixed in macOS Sequoia 15.1...

PT-2024-31099 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 13.7.1 macOS versions prior to 14.7.1 Description: The issue allows a malicious application to modify protected parts of the file system. This was addressed with improved checks. Recommendations: For macOS versions pri...