PT-2024-32603 · WordPress · Wp Compress – Image Optimizer [All-In-One]

Name of the Vulnerable Software and Affected Versions: WP Compress – Image Optimizer All-In-One versions n/a through 6.20.13 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows Reflected XSS, which c...

PT-2024-9615

Name of the Vulnerable Software and Affected Versions GStreamer versions prior to 1.24.10 Description A vulnerability has been identified in the gst wavparse smpl chunk function within gstwavparse.c. This function attempts to read 4 bytes from the data + 12 offset without checking if the size of...

PT-2024-39609 · WordPress · Quantity Dynamic Pricing & Bulk Discounts For Woocommerce

Name of the Vulnerable Software and Affected Versions: The Quantity Dynamic Pricing & Bulk Discounts for WooCommerce plugin for WordPress versions up to, and including, 3.8.0 Description: The issue is related to Reflected Cross-Site Scripting due to the use of add query arg without appropriate...

PT-2024-9202

Name of the Vulnerable Software and Affected Versions LibJXL versions prior to commit 9cc451b91b74ba470fd72bd48c121e9f33d24c99 libjpeg affected versions not specified libmozjs-115-0-115.15.0-4.1 libmozjs-128-0-128.5.1-3.1 libjxl-devel-0.11.1-1.1 qt6-webengine Description An out-of-bounds read/wri...

PT-2024-37565

Name of the Vulnerable Software and Affected Versions OpenText Vertica versions 10.0 through 10.X OpenText Vertica versions 11.0 through 11.X OpenText Vertica versions 12.0 through 12.X OpenText Vertica versions 23.0 through 23.X OpenText Vertica versions 24.0 through 24.X Description The issue i...

PT-2024-39264 · WordPress · Rabbitloader

Name of the Vulnerable Software and Affected Versions: RabbitLoader plugin for WordPress versions up to, and including, 2.21.0 Description: The issue is related to Reflected Cross-Site Scripting due to the use of add query arg without appropriate escaping on the URL. This allows unauthenticated...

PT-2024-39492 · WordPress · Mc4Wp: Mailchimp Top Bar

Name of the Vulnerable Software and Affected Versions: MC4WP: Mailchimp Top Bar plugin for WordPress versions up to, and including, 1.6.0 Description: The issue is related to Reflected Cross-Site Scripting due to the use of add query arg without appropriate escaping on the URL. This allows...

Important: postgresql

Issue Overview: Time-of-check Time-of-use TOCTOU race condition in pgdump in PostgreSQL allows an object creator to execute arbitrary SQL functions as the user running pgdump, which is often a superuser. The attack involves replacing another relation type with a view or foreign table. The attack...

Important: cups-filters

Issue Overview: A flaw in cups-filters allows a remote unauthenticated client to create a PPD configuration file with code injection. If a job is sent to the compromised printer, the code is executed allowing for remote code execution. CVE-2024-47175 Affected Packages: cups-filters Issue...

PT-2024-25149 · Flatpress · Flatpress

Name of the Vulnerable Software and Affected Versions: Flatpress version 1.3 Description: A cross-site scripting XSS issue has been identified, allowing an attacker to inject malicious scripts into web pages viewed by other users. Recommendations: For Flatpress version 1.3, update to a version th...

PT-2024-38939 · WordPress · Xo Slider

Name of the Vulnerable Software and Affected Versions: XO Slider plugin for WordPress versions up to, and including, 3.8.6 Description: The issue is related to Stored Cross-Site Scripting via the get slider function due to insufficient input sanitization and output escaping. This allows...

JVN#42445661: Multiple vulnerabilities in Smart-tab

Smart-tab provided by TECHNO SUPPORT COMPANY is a multi-functional guest room tablet system for hotels and other accommodation facilities. Smart-tab contains multiple vulnerabilities listed below. Active debug code CWE-489 CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Base Score 6.8 CVE-2024-41999...

CKEditor 40.x < 43.1.1 XSS Vulnerability

CKEditor 5 is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

PHP < 8.1.30, 8.2.x < 8.2.24, 8.3.x < 8.3.12 Multiple Vulnerabilities - Windows

PHP is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:php:php"; if description...

PT-2024-9621 · Gstreamer +7 · Gstreamer +7

Name of the Vulnerable Software and Affected Versions: GStreamer versions prior to 1.24.10 Description: A vulnerability has been discovered in the qtdemux merge sample table function within qtdemux.c, which is part of the GStreamer library. This issue is related to an out-of-bounds OOB read in...

PT-2024-29643 · Unknown · Mf Teacher Performance Management System

Name of the Vulnerable Software and Affected Versions: MF Teacher Performance Management System version 6 Description: A cross-site scripting issue exists, allowing an arbitrary script to be executed on the user's web browser if exploited. This can occur when a user accesses the website using the...

Fedora 39 : chromium (2024-e60359f212)

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-e60359f212 advisory. Update to 129.0.6668.70 High CVE-2024-9120: Use after free in Dawn High CVE-2024-9121: Inappropriate implementation in V8 High CVE-2024-9122: Type...

PT-2024-31819 · Facebook · Facebook Thrift

Name of the Vulnerable Software and Affected Versions: Facebook Thrift versions v2024.09.09.00 through v2024.09.23.00 Description: A null-dereference vulnerability involving parsing requests specifying invalid protocols can cause the application to crash or potentially result in other undesirable...

CVE-2024-45838

The goTenna Pro ATAK Plugin does not encrypt callsigns in messages. It is advised to not use sensitive information in callsigns when using this and previous versions of the plugin. Update to current plugin version which uses AES-256 encryption for callsigns in encrypted operation...

PT-2024-32454 · Agnai · Agnai

Name of the Vulnerable Software and Affected Versions: Agnai versions prior to 1.0.330 Description: A vulnerability in Agnai permits attackers to read arbitrary JSON files at attacker-chosen locations on the server, leading to unauthorized access to sensitive information and exposure of...