PT-2024-15190 · WordPress · Advanced File Manager Shortcodes

Name of the Vulnerable Software and Affected Versions: Advanced File Manager Shortcodes plugin for WordPress versions up to, and including, 2.5.3 Description: The issue allows authenticated attackers with contributor access or above to upload arbitrary files on the affected site's server, which m...

PT-2024-27535

Name of the Vulnerable Software and Affected Versions Andy Moyle Church Admin versions n/a through 4.4.6 Description The issue allows an attacker to upload a web shell to a web server due to an unrestricted upload of file with dangerous type vulnerability. This enables potential remote code...

PT-2024-26732 · Automattic · Woocommerce

Name of the Vulnerable Software and Affected Versions: WooCommerce versions through 8.9.2 Description: The issue is related to an Improper Neutralization of Special Elements in Output Used by a Downstream Component, also known as an 'Injection' vulnerability. This allows for Content Spoofing in...

PT-2024-37535 · WordPress · Testimonials

Name of the Vulnerable Software and Affected Versions: IQ Testimonials plugin for WordPress versions up to, and including, 2.2.7 Description: The issue is related to insufficient file type validation in the process image upload function, allowing unauthenticated attackers to upload arbitrary file...

PT-2024-27530 · Beaver Builder · Beaver Addons Powerpack Lite

Name of the Vulnerable Software and Affected Versions: Beaver Addons PowerPack Lite for Beaver Builder versions 1.3.0.3 and earlier Description: The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as a Path Traversal vulnerability. This vulnerability...

PT-2024-13880 · Fortinet · Fortiadc

Name of the Vulnerable Software and Affected Versions: FortiADC versions 7.0 through 7.4.0 Description: An improper certificate validation issue may allow a remote and unauthenticated attacker to perform a Man-in-the-Middle attack on the communication channel between the device and public SDN...

QNAP QTS OS Command Injection Vulnerability (QSA-24-26)

QNAP QTS is prone to an OS command injection vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/o:qnap:qts";...

PT-2024-27581

Name of the Vulnerable Software and Affected Versions Woffice Core versions through 5.4.8 Description A Cross Site Scripting XSS vulnerability in WofficeIO Woffice Core allows Reflected XSS. Recommendations For versions through 5.4.8, update to a version later than 5.4.8 to resolve the issue. At...

Discourse 3.3.x < 3.3.0.beta3 Multiple Vulnerabilities

Discourse is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:discourse:discourse"; ifdescripti...

Debian Linux SEoL (8.x)

According to its version, Debian Linux is 8.x. It is, therefore, no longer maintained by its vendor or provider. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it may contain security vulnerabilities. %NASLMINLEVEL 80900 C Tenable...

PT-2024-19355 · WordPress · Himer

Name of the Vulnerable Software and Affected Versions: Himer WordPress theme versions prior to 2.1.1 Description: The issue concerns a lack of CSRF checks in certain areas, potentially allowing attackers to manipulate users into voting on polls they do not have access to through a CSRF attack...

PT-2024-5149

Name of the Vulnerable Software and Affected Versions: Artifex Ghostscript versions prior to 10.03.1 Artifex Ghostscript version 10.02.1 and earlier Description: The issue is related to incorrect restriction of the directory path name with limited access. Exploitation can allow a remote attacker ...

PT-2024-27232 · Splunk · Splunk Enterprise

Name of the Vulnerable Software and Affected Versions: Splunk Enterprise versions prior to 9.2.2 Splunk Enterprise versions prior to 9.1.5 Splunk Enterprise versions prior to 9.0.10 Description: The issue allows an authenticated user to execute a specially crafted query, which can then be used to...

PT-2024-28698 · Newpass · Newpass

Name of the Vulnerable Software and Affected Versions: NewPass versions prior to 1.2.0 Description: The issue allows unauthorized access to sensitive information because passwords are stored directly rather than as password hashes. Although data at rest is encrypted, it is decrypted within proces...

PT-2024-37106 · WordPress · Pagerank Tools

Name of the Vulnerable Software and Affected Versions: Pagerank tools WordPress plugin versions 1.1.5 and earlier Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back in the...

PT-2024-9034 · Ivanti · Ivanti Policy Secure +1

Name of the Vulnerable Software and Affected Versions: Ivanti Connect Secure versions prior to 22.7R2.1 and prior to 9.1R18.7 Ivanti Policy Secure versions prior to 22.7R1.1 Description: The issue is related to argument injection, allowing a remote authenticated attacker with admin privileges to...

PT-2024-26870 · Kalkitech · Kalkitech Ase Ase61850 Iedsmart

Name of the Vulnerable Software and Affected Versions: Kalkitech ASE ASE61850 IEDSmart versions 2.3.5 and earlier Description: The issue allows attackers to read and write arbitrary files via the IEC61850 File Transfer protocol. This is a result of a Directory Traversal vulnerability...

PT-2024-6028 · Dell · Powerscale Onefs

Name of the Vulnerable Software and Affected Versions: Dell PowerScale OneFS versions 8.2.2.x through 9.8.0.0 Description: The issue is related to an incorrect privilege assignment in the PowerScale OneFS operating system. This could allow a local high-privileged attacker to potentially exploit t...

Important: kernel-livepatch-4.14.343-259.562

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: exthdr: fix 4-byte stack OOB write If priv-len is a multiple of 4, then dstlen / 4 can write past the destination array which leads to stack corruption. This construct is necessary to clean th...

Important: libndp

Issue Overview: A vulnerability was found in libndp. A buffer overflow in NetworkManager that can be triggered by sending a malformed IPv6 router advertisement packet via malicious user locally. This happens as libndp was not validating correctly the route length information and hence leading to ...