PT-2024-24011 · Themify · Themify Post Type Builder

Name of the Vulnerable Software and Affected Versions: Themify Post Type Builder PTB versions 2.0.8 and earlier Description: The issue is related to a Missing Authorization vulnerability in Themify Post Type Builder PTB. Recommendations: For Themify Post Type Builder PTB versions 2.0.8 and earlie...

PT-2024-23126

Name of the Vulnerable Software and Affected Versions DIRAC versions prior to 8.0.41 Description DIRAC is a software framework for distributed computing. During the proxy generation process, such as when using dirac-proxy-init, unauthorized users on the same machine can gain read access to the...

PT-2024-15080 · WordPress · Wp Go Maps

Name of the Vulnerable Software and Affected Versions: WP Go Maps plugin for WordPress versions up to, and including, 9.0.34 Description: The issue allows unauthenticated attackers to obtain the developer's Google API key due to the plugin adding the API key to several plugin files. This does not...

PT-2024-2848 · Adobe · Experience Manager

Name of the Vulnerable Software and Affected Versions: Adobe Experience Manager versions 6.5.19 and earlier Description: The issue is related to a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious...

Smart Forms < 2.6.96 - Admin+ Stored XSS

Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup 1. Add a new form or edit an existing...

PT-2024-3762

Name of the Vulnerable Software and Affected Versions OpenSSL versions prior to 3.3.0 Description The issue is related to unbounded memory growth when processing TLSv1.3 sessions due to the use of the non-default SSL OP NO TICKET option. This can lead to a Denial of Service. The problem occurs wh...

PT-2024-23874 · Unknown · Sizam Rehub

Name of the Vulnerable Software and Affected Versions: Sizam Rehub versions through 19.6.1 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for potential exploitation by injecting malicious S...

PT-2024-23904 · Edwiser · Edwiser Bridge

Name of the Vulnerable Software and Affected Versions: Edwiser Bridge versions 3.0.2 and earlier Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for potential exploitation by injecting...

PT-2024-18038 · WordPress · Element Pack Elementor Addons

Name of the Vulnerable Software and Affected Versions: The Element Pack Elementor Addons plugin for WordPress versions up to, and including, 5.5.3 Description: The issue is related to Stored Cross-Site Scripting via the element pack wrapper link attribute of the Trailer Box widget due to...

PT-2024-5024

Name of the Vulnerable Software and Affected Versions: tiagorlampert CHAOS version 5.0.1 tiagorlampert CHAOS versions before 1b451cf62582295b7225caf5a7b506f0bad56f6b and 24c9e109b5be34df7b2bce8368eae669c481ed5e Description: The issue allows a remote attacker to execute arbitrary code via the...

WP Chat App < 3.6.4 - Admin+ Stored XSS

Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admins to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed 1. Navigate to http://vulnerable-site.tld/wp-admin/admin.php?page=ntawhatsappfloatingwidge...

PT-2024-23887

Name of the Vulnerable Software and Affected Versions ConvertKit versions through 2.4.5 Description The issue is related to the insertion of sensitive information into log files. Recommendations For versions through 2.4.5, update to a version that contains a fix for this issue. At the moment, the...

PT-2024-24580 · WordPress · Embedpress

Name of the Vulnerable Software and Affected Versions: EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor plugin for WordPress versions up to, and including, 3.9.14 Description: The issue is related to Stored...

PT-2024-21010 · Elecom · Wmc-X1800Gst-B +2

Name of the Vulnerable Software and Affected Versions: ELECOM wireless LAN routers versions prior to v1.25 WRC-G01-W versions prior to v1.24 WMC-X1800GST-B versions prior to v1.41 Description: The issue allows a network-adjacent unauthenticated attacker to execute arbitrary OS commands by sending...

PT-2024-22489 · Axigen · Axigen Mail Server

Name of the Vulnerable Software and Affected Versions: Axigen Mail Server for Windows versions 10.5.18 and before Description: An issue was discovered in Axigen Mail Server for Windows, allowing local low-privileged attackers to execute arbitrary code and escalate privileges via insecure DLL...

PT-2024-22178 · Very Good Plugins · Wp Fusion Lite

Name of the Vulnerable Software and Affected Versions: WP Fusion Lite versions 3.41.24 and earlier Description: The issue is related to an Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability. This vulnerability allows Command Injection in Very Good...

PT-2024-24203 · Unknown · Concrete Cms

Name of the Vulnerable Software and Affected Versions: Concrete CMS versions 9 below 9.2.8 and versions below 8.5.16 Description: The issue concerns Cross-site Scripting XSS in the Advanced File Search Filter. A rogue administrator could add malicious code in the file manager due to insufficient...

PT-2024-3273 · Google +4 · Google Chrome +4

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 123.0.6312.105 Description: The issue is related to a use after free in the Bookmarks element, which can be exploited by a remote attacker using a crafted HTML page, potentially leading to heap corruption. The...

VMware Fusion SEoL (3.0.x)

According to its version, VMware Fusion is 3.0.x. It is, therefore, no longer maintained by its vendor or provider. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it may contain security vulnerabilities. %NASLMINLEVEL 80900 C...

PT-2024-22563 · Mbed Tls +1 · Mbed Tls +1

Name of the Vulnerable Software and Affected Versions: Mbed TLS versions 3.5.x through 3.5.x before 3.6.0 Mbed TLS versions prior to 3.6.0 Description: An issue was discovered in Mbed TLS when an SSL context was reset with the mbedtls ssl session reset API, the maximum TLS version to be negotiate...