PT-2024-25307 · Themegrill · Themegrill Colornews

Name of the Vulnerable Software and Affected Versions: ThemeGrill ColorNews versions 1.2.6 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can...

PT-2024-15909 · WordPress · Fancy Product Designer

Name of the Vulnerable Software and Affected Versions: The Fancy Product Designer WordPress plugin versions prior to 6.1.8 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back...

PT-2024-13926 · Qnap · Qnap Qts +1

Name of the Vulnerable Software and Affected Versions: QNAP QTS versions prior to 5.1.6.2722 build 20240402 QNAP QuTS hero versions prior to h5.1.6.2734 build 20240414 Description: An incorrect authorization issue has been reported, affecting several QNAP operating system versions. If exploited,...

PT-2024-25432 · Unknown · Contact Form 7 Extension For Mailchimp

Name of the Vulnerable Software and Affected Versions: Contact Form 7 Extension For Mailchimp versions 0.5.70 and earlier Description: A Cross-Site Request Forgery CSRF issue has been identified. This issue allows an attacker to perform actions on behalf of a user without their knowledge or...

PT-2024-25439 · WordPress · Wp Republic Hide Dashboard Notifications

Name of the Vulnerable Software and Affected Versions: WP Republic Hide Dashboard Notifications versions 1.2.3 and earlier Description: A Cross-Site Request Forgery CSRF issue affects WP Republic Hide Dashboard Notifications. This allows an attacker to perform unintended actions on a user's...

PT-2024-6663 · Ivanti · Ivanti Workspace Control

Name of the Vulnerable Software and Affected Versions: Ivanti Workspace Control versions 10.18.0.0 and below Description: The issue is related to an authentication bypass weakness in the message broker service, allowing a local authenticated attacker to escalate their privileges. This is due to t...

PT-2024-25361 · Unknown · Softlab Radio Player

Name of the Vulnerable Software and Affected Versions: SoftLab Radio Player versions 2.0.73 and earlier Description: The issue is a Server-Side Request Forgery SSRF vulnerability. This means that an attacker could potentially force the server to make requests to arbitrary domains, which could lea...

PT-2024-24806 · Elementor · Elementor

Name of the Vulnerable Software and Affected Versions: The Pack Elementor versions through 2.0.8.2 Description: A Server-Side Request Forgery SSRF issue has been identified. This allows an attacker to trick the server into making requests to arbitrary domains, potentially leading to unauthorized...

PT-2024-24794 · Ghozylab · Ghozylab Image Slider Widget

Name of the Vulnerable Software and Affected Versions: GhozyLab Image Slider Widget versions 1.1.125 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Stored XSS attacks. Recommendation...

FreeRDP < 3.5.1 Multiple Vulnerabilities

FreeRDP is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:freerdpproject:freerdp";...

PT-2024-12261 · Elementor · Unlimited Elements For Elementor

Name of the Vulnerable Software and Affected Versions: Unlimited Elements For Elementor Free Widgets, Addons, Templates versions 1.5.60 and earlier Description: The issue allows for the unrestricted upload of files with dangerous types, potentially enabling an attacker to upload a web shell to a...

PT-2024-24995 · Repute Infosystems · Armember

Name of the Vulnerable Software and Affected Versions: Repute Infosystems ARMember versions 4.0.28 and earlier Description: The issue is related to a Missing Authorization vulnerability. There is no information provided about the estimated number of potentially affected devices worldwide or...

PT-2024-24877 · Woocommerce · Superfaktura Woocommerce

Name of the Vulnerable Software and Affected Versions: SuperFaktura WooCommerce versions 1.40.3 and earlier Description: A Server-Side Request Forgery SSRF issue has been identified. This allows an attacker to trick the server into making requests to arbitrary domains, potentially leading to...

PT-2024-7005

Name of the Vulnerable Software and Affected Versions Grafana versions prior to v11.0.6+security-01 Grafana versions prior to v11.1.7+security-01 Grafana versions prior to v11.2.2+security-01 Description The SQL Expressions experimental feature of Grafana allows for the evaluation of duckdb queri...

PT-2024-13553

Name of the Vulnerable Software and Affected Versions QuickJS versions prior to c4cdd61 Description The issue is caused by a NULL pointer dereference due to an erroneous lexical scope of this with eval, leading to a build for in iterator error. Recommendations For versions prior to c4cdd61, updat...

FreeRDP < 2.11.6, 3.x < 3.5.0 Multiple Vulnerabilities

FreeRDP is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:freerdpproject:freerdp";...

PT-2024-19588 · Unknown · Axe Credit Portal

Name of the Vulnerable Software and Affected Versions: Axe Credit Portal versions 3.0 and later Description: The issue allows authenticated attackers to execute unintended queries and disclose sensitive information from database tables via crafted requests, specifically through the Save Favorite...

PT-2024-24552 · Inducer · Inducer

Name of the Vulnerable Software and Affected Versions: inducer versions prior to 2024.1 Description: The issue allows a remote attacker to execute arbitrary code via a crafted payload to the Page Sandbox feature. Recommendations: For versions prior to 2024.1, update to version 2024.1 or later to...

Huawei EulerOS: Security Advisory for sudo (EulerOS-SA-2024-1556)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2024-24778 · Woocommerce · Active Products Tables For Woocommerce

Name of the Vulnerable Software and Affected Versions: Active Products Tables for WooCommerce versions 1.0.6.2 and earlier Description: The issue is related to a Missing Authorization vulnerability in the Active Products Tables for WooCommerce plugin. Recommendations: For versions 1.0.6.2 and...