CVE-2024-51989 Cross-site Scripting (XSS) Vulnerability in PasswordPusher

Password Pusher is an open source application to communicate sensitive information over the web. A cross-site scripting XSS vulnerability was identified in the PasswordPusher application, affecting versions v1.41.1 through and including v.1.48.0. The issue arises from an un-sanitized parameter...

Fedora 39 : firefox (2024-c4b84c1215)

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-c4b84c1215 advisory. - New upstream build 132.0 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has no...

PT-2024-10857 · Circontrol · Circontrol Raption

Name of the Vulnerable Software and Affected Versions: Circontrol Raption versions through 5.6.2 Description: The pwrstudio web application of EV Charger is vulnerable to OS command injection via three fields of the configuration menu for ntpserver0, ntpserver1, and pingip. This issue affects...

Ubuntu 18.04 LTS : Linux kernel vulnerabilities (USN-7088-3)

"The remote Ubuntu 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7088-3 advisory. Ziming Zhang discovered that the VMware Virtual GPU DRM driver in the Linux kernel contained an integer overflow vulnerability. A local attacker could u...

PYSEC-2024-202

OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up until and including 1.10.2 contain a vulnerability that allows an attacker that has gained temporary control over an authenticated victim's OctoPrint browser session to retrieve/recreate/delete the user...

PT-2024-33516 · Samsung · Samsung Pass

Name of the Vulnerable Software and Affected Versions: Samsung Pass versions prior to 4.4.04.7 Description: The issue is related to improper authentication in the Private Info feature of Samsung Pass, allowing physical attackers to access sensitive information in a specific scenario...

PT-2024-26094 · Modem · Modem

Name of the Vulnerable Software and Affected Versions: Modem versions prior to SMR Nov-2024 Release 1 Description: The issue is related to improper input validation in the IpcProtocol of the Modem, allowing local attackers to cause a Denial-of-Service. Recommendations: For versions prior to SMR...

PT-2024-34827 · Coderevolution · Wp Pocket Urls

Name of the Vulnerable Software and Affected Versions: CodeRevolution WP Pocket URLs versions 1.0.3 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS attacks...

PT-2024-34829 · Elementor · Elementor

Name of the Vulnerable Software and Affected Versions: Custom post type templates for Elementor versions 1.10.1 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS attacks...

PT-2024-34823 · Marcel Pol · Elo Rating Shortcode

Name of the Vulnerable Software and Affected Versions: Elo Rating Shortcode versions 1.0.3 and earlier Elo Rating Shortcode versions prior to 1.0.4 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows...

Fedora 40 : chromium (2024-b92c0289c9)

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-b92c0289c9 advisory. Update to 130.0.6723.91 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...

EulerOS 2.0 SP12 : python-setuptools (EulerOS-SA-2024-2791)

According to the versions of the python-setuptools packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A vulnerability in the packageindex module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download...

PT-2024-38653 · WordPress · The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin

Name of the Vulnerable Software and Affected Versions: The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin WordPress plugin versions prior to 1.6.7.55 Description: The issue is related to the lack of sanitization and escaping of some Notification settings in the plugin,...

PT-2024-27580 · Unknown · Woffice Core

Name of the Vulnerable Software and Affected Versions: Woffice Core versions 5.4.8 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows accessing functionality not properly constrained by ACLs. Recommendations: For versions 5.4.8 and earlier, update...

PT-2024-30786 · Unknown · Envira Photo Gallery

Name of the Vulnerable Software and Affected Versions: Envira Photo Gallery versions 1.8.14 and earlier Description: The issue is related to a Missing Authorization vulnerability in Envira Gallery Team Envira Photo Gallery, which allows exploiting incorrectly configured access control security...

PT-2024-30332 · Tutor Lms · Tutor Lms

Name of the Vulnerable Software and Affected Versions: Tutor LMS versions 2.7.3 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: For Tutor LMS versions 2.7.3 and...

Important: qt5-qtxmlpatterns

Issue Overview: An issue was discovered in HTTP2 in Qt before 5.15.18, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.7, and 6.6.x through 6.7.x before 6.7.3. Code to make security-relevant decisions about an established connection may execute too early, because the encrypted signal has not ye...

Important: qt5-qtbase

Issue Overview: An issue was discovered in HTTP2 in Qt before 5.15.18, 6.x before 6.2.13, 6.3.x through 6.5.x before 6.5.7, and 6.6.x through 6.7.x before 6.7.3. Code to make security-relevant decisions about an established connection may execute too early, because the encrypted signal has not ye...

PT-2024-28592 · Unknown · Fetch Designs Sign-Up Sheets

Name of the Vulnerable Software and Affected Versions: Fetch Designs Sign-up Sheets versions 2.2.12 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. Recommendations: For Fetch...

PT-2024-16129 · WordPress · Group Chat & Video Chat By Atomchat

Name of the Vulnerable Software and Affected Versions: Group Chat & Video Chat by AtomChat plugin for WordPress versions up to, and including, 1.1.5 Description: The vulnerability is a Stored Cross-Site Scripting issue due to insufficient input sanitization and output escaping on user-supplied...