PT-2024-18759 · WordPress · Ht Mega – Absolute Addons For Elementor

Name of the Vulnerable Software and Affected Versions: HT Mega – Absolute Addons For Elementor plugin for WordPress versions up to, and including, 2.4.6 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping on user-supplied...

PT-2024-28237 · WordPress · Premium Addons For Elementor

Name of the Vulnerable Software and Affected Versions: Premium Addons for Elementor plugin for WordPress versions up to, and including, 4.10.28 Description: The issue is related to Stored Cross-Site Scripting via the subcontainer value parameter due to insufficient input sanitization and output...

Foxit PhantomPDF Multiple Vulnerabilities (June-1 2024)

Foxit PhantomPDF is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:foxitsoftware:phantompdf";...

Important: nghttp2

Issue Overview: nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. The nghttp2 library prior to version 1.61.0 keeps reading the unbounded number of HTTP/2 CONTINUATION frames even after a stream is reset to keep HPACK context in sync. This causes excessive CPU usage ...

PT-2024-18147 · Secomea · Secomea Gatemanager

Name of the Vulnerable Software and Affected Versions: Secomea GateManager versions prior to 11.2.624071020 Description: The issue is related to the incorrect usage of seeds in the Pseudo-Random Number Generator PRNG in the Secomea GateManager's Webserver modules, allowing session hijacking...

Fedora 40 : cjson (2024-b93a6b1325)

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-b93a6b1325 advisory. Update to latest upstream version 1.7.17 closes rhbz2255953 Tenable has extracted the preceding description block directly from the Fedora security advisory...

QNAP QTS Integer Overflow Vulnerability (QSA-24-16)

QNAP QTS is prone to an integer overflow vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/o:qnap:qts"; ifdescription...

PT-2024-25259 · Cubecart · Cubecart

Name of the Vulnerable Software and Affected Versions: CubeCart versions prior to 6.5.5 Description: The issue allows an authenticated user to execute arbitrary code via a crafted .phar file. This is a result of a File Upload vulnerability. Recommendations: For versions prior to 6.5.5, update to...

Fedora 40 : rclone (2023-ff1e594f3d)

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-ff1e594f3d advisory. Automatic update for rclone-1.64.0-1.fc40. Changelog Thu Oct 12 2023 Mikel Olasagasti Uranga - 1.64.0-1 - Update to 1.64.0 - Closes rhbz2238581...

PT-2024-25365 · Five Star Plugins · Five Star Restaurant Reservations

Name of the Vulnerable Software and Affected Versions: Five Star Restaurant Reservations versions n/a through 2.6.16 Description: The issue is related to a Missing Authorization vulnerability in Five Star Plugins Five Star Restaurant Reservations. Recommendations: For versions n/a through 2.6.16,...

PT-2024-25355 · Unknown · Secure Copy Content Protection/Content Locking

Name of the Vulnerable Software and Affected Versions: Secure Copy Content Protection and Content Locking versions 3.9.0 and earlier Description: A Missing Authorization issue has been identified, affecting Secure Copy Content Protection and Content Locking. The issue allows for potential...

PT-2024-15859 · Grandstream · Grandstream Ucm Series Ip Pbx

Name of the Vulnerable Software and Affected Versions: Grandstream UCM Series IP PBX versions prior to 1.0.20.52 Description: The issue is related to a parameter injection vulnerability in the HTTP interface. A remote and authenticated attacker can execute arbitrary code by sending a crafted HTTP...

PT-2024-25441 · Extend Themes · Extend Themes Colibri Wp +6

Name of the Vulnerable Software and Affected Versions: Extend Themes Pathway versions 1.0.15 and earlier Extend Themes Hugo WP versions 1.0.8 and earlier Extend Themes Althea WP versions 1.0.13 and earlier Extend Themes Elevate WP versions 1.0.15 and earlier Extend Themes Brite versions 1.0.11 an...

PT-2024-25330 · 8Theme · 8Theme Xstore

Name of the Vulnerable Software and Affected Versions: 8theme XStore versions through 9.3.5 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This can be exploited by an attacker to...

PT-2024-25307 · Themegrill · Themegrill Colornews

Name of the Vulnerable Software and Affected Versions: ThemeGrill ColorNews versions 1.2.6 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can...

PT-2024-13926 · Qnap · Qnap Qts +1

Name of the Vulnerable Software and Affected Versions: QNAP QTS versions prior to 5.1.6.2722 build 20240402 QNAP QuTS hero versions prior to h5.1.6.2734 build 20240414 Description: An incorrect authorization issue has been reported, affecting several QNAP operating system versions. If exploited,...

PT-2024-25432 · Unknown · Contact Form 7 Extension For Mailchimp

Name of the Vulnerable Software and Affected Versions: Contact Form 7 Extension For Mailchimp versions 0.5.70 and earlier Description: A Cross-Site Request Forgery CSRF issue has been identified. This issue allows an attacker to perform actions on behalf of a user without their knowledge or...

PT-2024-25439 · WordPress · Wp Republic Hide Dashboard Notifications

Name of the Vulnerable Software and Affected Versions: WP Republic Hide Dashboard Notifications versions 1.2.3 and earlier Description: A Cross-Site Request Forgery CSRF issue affects WP Republic Hide Dashboard Notifications. This allows an attacker to perform unintended actions on a user's...

PT-2024-15909 · WordPress · Fancy Product Designer

Name of the Vulnerable Software and Affected Versions: The Fancy Product Designer WordPress plugin versions prior to 6.1.8 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back...

PT-2024-6663 · Ivanti · Ivanti Workspace Control

Name of the Vulnerable Software and Affected Versions: Ivanti Workspace Control versions 10.18.0.0 and below Description: The issue is related to an authentication bypass weakness in the message broker service, allowing a local authenticated attacker to escalate their privileges. This is due to t...