Important: sqlite

Issue Overview: A vulnerability was found in SQLite SQLite3 up to 3.43.0 and classified as critical. This issue affects the function sessionReadRecord of the file ext/session/sqlite3session.c of the component make alltest Handler. The manipulation leads to heap-based buffer overflow. It is...

PT-2024-1289

Name of the Vulnerable Software and Affected Versions Linux kernel versions through 6.7.1 Description The issue is related to the btrfs get root ref function in the Linux kernel, specifically in fs/btrfs/disk-io.c. It can cause an assertion failure and crash because a subvolume can be read out to...

PT-2024-12006 · Beaver Builder · Ultimate Addons For Beaver Builder – Lite

Name of the Vulnerable Software and Affected Versions: Ultimate Addons for Beaver Builder – Lite versions 1.5.5 and earlier Description: The issue is related to a Missing Authorization vulnerability. There is no information provided about the estimated number of potentially affected devices...

GHSA-XGFM-FJX6-62MJ readthedocs-sphinx-search vulnerable to cross-site scripting when including search results from malicious projects

Impact This vulnerability could have allowed an attacker to include arbitrary HTML content in search results by having a user search a malicious project. This was due to our search client not correctly escaping all user content from search results. You can find more information in the advisory...

PT-2024-1188 · Oracle · Oracle Zfs Storage Appliance Kit

Name of the Vulnerable Software and Affected Versions: Oracle ZFS Storage Appliance Kit version 8.8 Description: The issue is related to insufficient input validation in the Core component of the Oracle ZFS Storage Appliance Kit. This allows a high-privileged attacker with logon to the...

PT-2024-1228

Name of the Vulnerable Software and Affected Versions Oracle Java SE versions 8u391, 8u391-perf, 11.0.21, 17.0.9, 21.0.1 Oracle GraalVM for JDK versions 17.0.9, 21.0.1 Oracle GraalVM Enterprise Edition versions 20.3.12, 21.3.8, 22.3.4 Description The issue exists due to insufficient input...

PT-2024-1339 · Oracle +8 · Mysql Server +7

Name of the Vulnerable Software and Affected Versions: MySQL Server versions 8.0.35 and prior MySQL Server versions 8.2.0 and prior Description: The issue is related to insufficient input validation in the Server: Optimizer component of Oracle MySQL Server. It allows a high-privileged attacker wi...

CVE-2023-46749 Apache Shiro before 1.13.0 or 2.0.0-alpha-4, may be susceptible to a path traversal attack that results in an authentication bypass when used together with path rewriting

Apache Shiro before 1.13.0 or 2.0.0-alpha-4, may be susceptible to a path traversal attack that results in an authentication bypass when used together with path rewriting Mitigation: Update to Apache Shiro 1.13.0+ or 2.0.0-alpha-4+, or ensure blockSemicolon is enabled this is the default...

PT-2024-19223 · Mailmunch · Constant Contact Forms By Mailmunch

Name of the Vulnerable Software and Affected Versions: Constant Contact Forms by MailMunch versions 2.0.11 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an...

PT-2024-15072 · WordPress · Envira Photo Gallery

Name of the Vulnerable Software and Affected Versions: Envira Photo Gallery plugin for WordPress versions up to, and including, 1.8.7.1 Description: The issue allows authenticated attackers with contributor access and above to modify galleries on other users' posts due to an improper capability...

PT-2024-1149 · Microsoft · Windows +1

Name of the Vulnerable Software and Affected Versions: Remote Desktop Client versions prior to 1.2.5105 Description: The issue is related to errors in synchronization when using a shared resource in the Remote Desktop Protocol RDP of the Windows operating system. This can allow a remote attacker ...

PT-2024-1040 · Siemens · Solid Edge

Name of the Vulnerable Software and Affected Versions: Solid Edge SE2023 versions prior to V223.0 Update 10 Description: A vulnerability has been identified in the affected application, which contains an out of bounds write past the end of an allocated buffer while parsing a specially crafted PAR...

PT-2024-1328 · Intel +1 · Intel(R) Hid Event Filter Driver +1

Name of the Vulnerable Software and Affected Versions: Intel HID Event Filter drivers for Windows 10 versions prior to 2.2.2.1 Description: The issue is related to insecure inherited permissions in some Intel HID Event Filter drivers for Windows 10, which may allow an authenticated user to...

PT-2024-1025 · Adobe · Substance3D - Stager

Name of the Vulnerable Software and Affected Versions: Adobe Substance 3D Stager versions 2.1.3 and earlier Description: The issue is related to insufficient input validation, which may allow an attacker to execute arbitrary code. It is an out-of-bounds read vulnerability that could lead to...

PT-2024-1635 · Siemens · Solid Edge

Name of the Vulnerable Software and Affected Versions: Solid Edge SE2023 versions prior to V223.0 Update 10 Description: A vulnerability has been identified in the affected applications, which contain an out of bounds read past the end of an allocated structure while parsing specially crafted PAR...

HPESBGN04586 rev.3 - HPE OneView, Multiple Vulnerabilities

Potential Security Impact: Local: Denial of Service DoS, Escalation of Privilege, Server-Side Request Forgery SSRF; Remote: Code Execution SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE OneView - All versions prior to 8.70 and all 6.6 LTS versions prior to 6.60.07 CVSS Scores...

Medium: python-urllib3

Issue Overview: urllib3 is a user-friendly HTTP client library for Python. urllib3 previously wouldn't remove the HTTP request body when an HTTP redirect response using status 301, 302, or 303 after the request had its method changed from one that could accept a request body like POST to GET as i...

QNAP QTS Video Station Multiple Vulnerabilities (QSA-23-52)

QNAP Video Station is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:qnap:videostation"; if...

PT-2024-14888 · WordPress · Essential Real Estate

Name of the Vulnerable Software and Affected Versions: The Essential Real Estate WordPress plugin versions prior to 4.4.0 Description: The issue arises from the plugin not applying proper capability checks on its AJAX actions. This allows attackers with a subscriber account to conduct Stored XSS...

PT-2024-14164 · Unknown · Jordy Meow Database Cleaner

Name of the Vulnerable Software and Affected Versions: Jordy Meow Database Cleaner: Clean, Optimize & Repair versions 0.9.8 and earlier Description: The issue is related to the exposure of sensitive information to an unauthorized actor. This is a problem where sensitive data is made accessible to...