PT-2024-06: Reading arbitrary files in the component Web IDE in PT Application Inspector (PT AI)

The vulnerability was identified in PT AI affecting versions 4.4 to 4.7.2. The vulnerability can be exploited by an attacker with network access to the PT AI control server to read source code files of other user's projects. Exploitation of the vulnerability requires authorization of the...

PT-2024-41002 · Unknown · Containerized-Data-Importer

Name of the Vulnerable Software and Affected Versions: containerized-data-importer versions prior to 1.59.0 Description: The issue is fixed by updating to version 1.59.0. Release notes for versions 1.59.0 and 1.58.1 are available. Recommendations: Update to version 1.59.0 to resolve the issue...

PT-2024-37702 · WordPress · Admin Trim Interface

Name of the Vulnerable Software and Affected Versions: Admin Trim Interface plugin for WordPress versions up to, and including, 3.5.1 Description: The issue is related to Full Path Disclosure, which occurs because the plugin utilizes bootstrap and leaves test files with display errors on. This...

PT-2024-6067

Name of the Vulnerable Software and Affected Versions runc versions 1.1.13 and earlier, as well as 1.2.0-rc2 and earlier Description The issue is related to a race condition that allows an attacker to create empty files or directories in arbitrary locations on the host filesystem. This can be...

PT-2025-46931

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 126.0.6478.182 Description An issue in the DevTools component of Google Chrome could allow a remote attacker to potentially escape the sandbox through a specially crafted HTML page. The security severity is rate...

PT-2024-30114 · WordPress · Support Svg Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: The Support SVG WordPress plugin versions prior to 1.1.0 Description: The issue allows users with at least the author role to upload SVG files containing malicious JavaScript, leading to Stored XSS attacks. This is due to the lack of...

PT-2024-28730 · Fog · Fog

Name of the Vulnerable Software and Affected Versions: FOG versions prior to 1.5.10.30 Description: The issue concerns the NFS configuration in /etc/exports generated by the FOG installer, which allows an attacker to modify files outside the export in the default installation. The no subtree chec...

PT-2024-25415 · Siemens · Simcenter Femap

Name of the Vulnerable Software and Affected Versions: Simcenter Femap versions prior to V2406 Description: A vulnerability has been identified in the affected applications, which contain an out of bounds read past the end of an allocated structure while parsing specially crafted BMP files. This...

PT-2024-14289 · Jungo · Windriver

Name of the Vulnerable Software and Affected Versions: Jungo WinDriver versions prior to 12.1.0 Description: A Denial of Service DoS issue allows local attackers to cause a Windows blue screen error. Recommendations: For versions prior to 12.1.0, update to version 12.1.0 or later to resolve the...

openldap security update

2.4.46-19 - Bump version to 2.4.46-19 - Resolves: RHEL-34283 - openldap: null pointer dereference in bermemallocx function...

PT-2024-37105 · WordPress · Simple Al Slider

Name of the Vulnerable Software and Affected Versions: Simple AL Slider WordPress plugin versions prior to 1.2.11 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back in the...

PT-2024-25705 · Adobe · Acrobat For Edge

Name of the Vulnerable Software and Affected Versions: Acrobat for Edge versions 126.0.2592.68 and earlier Description: The issue is an out-of-bounds read vulnerability that occurs when parsing a crafted file, potentially resulting in a read past the end of an allocated memory structure. This cou...

PT-2024-37122 · Lunary Ai · Lunary

Name of the Vulnerable Software and Affected Versions: lunary-ai/lunary versions =v1.2.11 Description: The issue allows an attacker to bypass email validation by using a dot character '.' in the email address, enabling the creation of multiple accounts with essentially the same email address. Thi...

PT-2024-33960 · Ipswitch · Whatsup Gold

Name of the Vulnerable Software and Affected Versions: WhatsUp Gold versions prior to 2023.1.3 Description: An unauthenticated Denial of Service issue was identified, allowing an unauthenticated attacker to put the application into the SetAdminPassword installation step. This renders the...

PT-2024-5610 · Dell · Dell Inventory Collector

Name of the Vulnerable Software and Affected Versions: Dell Inventory Collector versions prior to 12.3.0.6 Description: The issue is related to incorrect restriction of a directory path with limited access. Exploitation of this issue may allow an attacker to execute arbitrary code. A local...

"ZOZOTOWN" App for Android fails to restrict custom URL schemes properly

Overview "ZOZOTOWN" App for Android provided by ZOZO, Inc. provides the function to access a URL requested via Custom URL Scheme. The App does not restrict access to the function properly CWE-939 which may be exploited to direct the App to access any sites. Impact A remote attacker may lead a use...

CVE-2024-38351 Password auth and OAuth2 unverified email linking

Pocketbase is an open source web backend written in go. In affected versions a malicious user may be able to compromise other user accounts. In order to be exploited users must have both OAuth2 and Password auth methods enabled. A possible attack scenario could be: 1. a malicious actor register...

PT-2024-4378 · Google +5 · Google Chrome +6

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 126.0.6478.114 Microsoft Edge affected versions not specified Description: The issue is related to an inappropriate implementation in V8, allowing a remote attacker to perform out of bounds memory access via a...

PT-2024-4245 · Google +5 · Google Chrome +5

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 126.0.6478.54 Description: The issue is related to an inappropriate implementation in DevTools, which can be exploited by an attacker to execute arbitrary code via a crafted Chrome Extension. This can happen if...

PT-2024-12297 · Sparkle Wp · Editorialmag

Name of the Vulnerable Software and Affected Versions: Editorialmag versions 1.1.9 and earlier Description: The issue is related to a Missing Authorization vulnerability in Sparkle WP Editorialmag. Recommendations: For versions 1.1.9 and earlier, update to a version later than 1.1.9 to resolve th...