Important: nodejs

Issue Overview: A flaw was found in Node.js. On Linux, Node.js ignores certain environment variables if they have been set by an unprivileged user while the process is running with elevated privileges, with the exception of CAPNETBINDSERVICE. Due to a bug in the implementation of this exception,...

Important: nodejs

Issue Overview: A flaw was found in Node.js. On Linux, Node.js ignores certain environment variables if they have been set by an unprivileged user while the process is running with elevated privileges, with the exception of CAPNETBINDSERVICE. Due to a bug in the implementation of this exception,...

PT-2024-11758 · Unknown · Ajax Thumbnail Rebuild

Name of the Vulnerable Software and Affected Versions: AJAX Thumbnail Rebuild versions 1.13 and earlier Description: The issue is related to a Missing Authorization vulnerability. This vulnerability affects the AJAX Thumbnail Rebuild software. Recommendations: For versions 1.13 and earlier, updat...

PT-2024-5022 · Qlik · Qlikview

Name of the Vulnerable Software and Affected Versions: Qlik Qlikview versions prior to May 2022 SR3 12.70.20300 and prior to May 2023 SR2 12.80.20200 Description: A race condition in the installer executable may allow an existing lower privileged user to cause code to be executed in the context o...

PT-2024-12520 · Ibm · Ibm Security Verify Governance

Name of the Vulnerable Software and Affected Versions: IBM Security Verify Governance version 10.0.2 Description: The issue is caused by the failure to properly enable HTTP Strict Transport Security, allowing a remote attacker to obtain sensitive information using man-in-the-middle techniques. Th...

PT-2024-22752 · Unknown · Contact Form 7 – Paypal & Stripe Add-On

Name of the Vulnerable Software and Affected Versions: Contact Form 7 – PayPal & Stripe Add-on versions n/a through 2.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Reflected XSS...

PT-2024-22722

Name of the Vulnerable Software and Affected Versions HasThemes Extensions For CF7 versions 3.0.6 and earlier Description The issue is related to improper neutralization of input during web page generation, which allows for stored cross-site scripting XSS. This means that an attacker can inject...

PT-2024-22195 · Unknown · Visual Composer Website Builder

Name of the Vulnerable Software and Affected Versions: Visual Composer Website Builder versions through 45.6.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Stored XSS. This enables potential attacker...

PT-2024-3277 · Google +4 · Google Chrome +5

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 123.0.6312.58 Description: The issue is related to an object lifecycle problem in the V8 JavaScript and WebAssembly engine, allowing a remote attacker to potentially exploit object corruption via a crafted HTML...

PT-2024-22753 · Unknown · Themefic Tourfic

Name of the Vulnerable Software and Affected Versions: Themefic Tourfic versions through 2.11.8 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as 'Cross-site Scripting', which allows Stored XSS. This means that an attacker can inject...

PT-2025-18295 · Xwiki · Xwiki

Name of the Vulnerable Software and Affected Versions: XWiki versions 15.9-rc-1 through 15.10.8 XWiki versions 16.0.0-rc-1 through 16.2.0 Description: XWiki is a generic wiki platform. The required rights analysis does not consider TextAreas with default content type, allowing a user to put...

PT-2024-22709 · Unknown · Five Star Restaurant Menu

Name of the Vulnerable Software and Affected Versions: Five Star Restaurant Menu versions through 2.4.14 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Stored XSS, which can be exploited by...

Netatalk < 3.1.18 RCE Vulnerability

Netatalk is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:netatalk:netatalk...

PT-2024-2640 · Google +3 · Google Chrome +3

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 123.0.6312.58 Description: The issue is related to inappropriate implementation in iOS, allowing a remote attacker to leak cross-origin data via a crafted HTML page. This is due to insufficient access control,...

Medium: c-ares

Issue Overview: c-ares is a C library for asynchronous DNS requests. aresreadline is used to parse local configuration files such as /etc/resolv.conf, /etc/nsswitch.conf, the HOSTALIASES file, and if using a c-ares version prior to 1.27.0, the /etc/hosts file. If any of these configuration files...

PT-2024-2234 · Adobe · Experience Manager

Name of the Vulnerable Software and Affected Versions: Adobe Experience Manager versions 6.5.19 and earlier Description: The issue exists due to inadequate protection of the web page structure, allowing for potential exploitation. This could enable a remote attacker to conduct cross-site scriptin...

Low: libpq

Issue Overview: In PostgreSQL, a modified, unauthenticated server can send an unterminated string during the establishment of Kerberos transport encryption. In certain conditions a server can cause a libpq client to over-read and report an error message containing uninitialized bytes...

PT-2024-21228 · Unknown · Formfacade

Name of the Vulnerable Software and Affected Versions: FormFacade versions 1.0.0 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This affects the FormFacade, enabling potenti...

PT-2024-12557 · Unknown · Masmobile Classic Ios +1

Name of the Vulnerable Software and Affected Versions: MASmobile Classic Android versions 1.16.18 and earlier MASmobile Classic iOS versions 1.7.24 and earlier Description: An authorization bypass can be achieved by session ID prediction, allowing remote attackers to retrieve sensitive data...

PT-2024-21026 · Woocommerce · Doofinder For Woocommerce

Name of the Vulnerable Software and Affected Versions: Doofinder for WooCommerce versions through 2.1.8 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Stored XSS. This enables potential attackers to...