PT-2024-5462

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 126.0.6478.182 Microsoft Edge affected versions not specified Description The issue is related to a use after free in the Media Stream component, which could allow a remote attacker to exploit heap corruption vi...

Low: postgresql

Issue Overview: postgresql: PostgreSQL pgstatsext and pgstatsextexprs lack authorization checks CVE-2024-4317 Affected Packages: postgresql Note: This advisory is applicable to Amazon Linux 2 - Postgresql14 Extra. Visit this page to learn more about Amazon Linux 2 AL2 Extras and this FAQ section...

Multiple vulnerabilities in "FreeFrom - the nostr client" App

Overview "FreeFrom - the nostr client" App provided by FreeFrom K.K. contains multiple vulnerabilities listed below. Improper verification of cryptographic signature CWE-347 - CVE-2024-36277 Reliance on obfuscation or encryption of security-relevant inputs without integrity checking CWE-649 -...

UBUNTU-CVE-2024-35226

Smarty is a template engine for PHP, facilitating the separation of presentation HTML/CSS from application logic. In affected versions template authors could inject php code by choosing a malicious file name for an extends-tag. Sites that cannot fully trust template authors should update asap. Al...

PT-2024-4507 · Siemens · Simatic Rtls Locating Manager

Name of the Vulnerable Software and Affected Versions: SIMATIC RTLS Locating Manager versions prior to V3.0.1.1 Description: The affected application does not properly limit the size of specific logs, which could allow an unauthenticated remote attacker to exhaust system resources by creating a...

PT-2024-24410

Name of the Vulnerable Software and Affected Versions NextMove Lite versions through 2.18.1 Description The issue is a Cross-Site Request Forgery CSRF vulnerability in XLPlugins NextMove Lite. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a we...

PT-2024-13025 · Win Zapp · Win Zapp

Name of the Vulnerable Software and Affected Versions: Win ZApp versions prior to 4.3.0.121 Description: The issue is related to a missing password type validation in the Revert Password check. This could be disabled for some features, potentially leading to security issues. Recommendations: For...

Important: composer

Issue Overview: Composer is a dependency Manager for the PHP language. In affected versions several files within the local working directory are included during the invocation of Composer and in the context of the executing user. As such, under certain conditions arbitrary code execution may lead...

PT-2024-21015 · Unknown · Microdicom Dicom Viewer

Name of the Vulnerable Software and Affected Versions: MicroDicom DICOM Viewer versions 2023.3 Build 9342 and prior Description: The issue is related to a lack of proper validation of user-supplied data, which could result in memory corruption within the application. Recommendations: For MicroDic...

PT-2024-15099 · Bestwebsoft · Error Log Viewer

Name of the Vulnerable Software and Affected Versions: The Error Log Viewer by BestWebSoft WordPress plugin versions prior to 1.1.3 Description: The issue allows users to read and download PHP logs without authorization, potentially exposing sensitive data. This is a Directory Listing issue...

PT-2024-2226 · Intel · Intel Xtu

Name of the Vulnerable Software and Affected Versions: IntelR XTU versions prior to 7.12.0.29 Description: The issue is related to improper access control in IntelR XTU software, which may allow an authenticated user to potentially enable escalation of privilege via local access. This could permi...

CVE-2024-22419

CVE-2024-22419 affects the Vyper compiler/runtime: the built-in concat can write past the allocated memory buffer, potentially corrupting memory and changing contract semantics. The root cause is the build_IR path not properly conforming to the copy_bytes API for versions >= 0.3.2, enabling a ...

PT-2024-1444 · Unknown · Rapid Scada

Name of the Vulnerable Software and Affected Versions: Rapid SCADA versions prior to Version 5.8.4 Description: The issue is related to the use of open redirection due to incorrect data cleaning on the user login page. This allows an attacker to redirect users to malicious pages through the login...

Important: bluez

Issue Overview: bluez: unauthorized HID device connections allows keystroke injection and arbitrary commands execution CVE-2023-45866 Affected Packages: bluez Issue Correction: Run dnf update bluez --releasever 2023.3.20240108 or dnf update --advisory ALAS2023-2024-473 --releasever 2023.3.2024010...

PT-2023-30931 · Unknown · Quantumcloud Chatbot

Name of the Vulnerable Software and Affected Versions: QuantumCloud AI ChatBot versions through 4.7.8 Description: The issue is related to an Improper Neutralization of Special Elements used in an SQL Command, also known as SQL Injection. This allows for potential exploitation of the QuantumCloud...

PT-2023-30947 · Svgator · Svgator

Name of the Vulnerable Software and Affected Versions: SVGator – Add Animated SVG Easily versions 1.2.4 and earlier Description: A Cross-Site Request Forgery CSRF issue has been identified. This type of issue allows an attacker to trick a user into performing unintended actions on a web applicati...

PT-2023-22021 · Ncp · Ncp Secure Enterprise Client

Name of the Vulnerable Software and Affected Versions: NCP Secure Enterprise Client versions prior to 12.22 Description: The issue allows attackers to read registry information of the operating system by creating a symbolic link. This is possible due to a flaw in the Support Assistant component o...

PT-2023-30753 · Nitin Rathod · Wp Forms Puzzle Captcha

Name of the Vulnerable Software and Affected Versions: WP Forms Puzzle Captcha versions n/a through 4.1 Description: A Cross-Site Request Forgery CSRF vulnerability in Nitin Rathod WP Forms Puzzle Captcha allows Stored XSS. Recommendations: For WP Forms Puzzle Captcha versions n/a through 4.1,...

PT-2023-6633 · Google +3 · Google Chrome +3

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 119.0.6045.105 Description: The issue is related to a use after free vulnerability in the Profiles component of Google Chrome. This vulnerability can be exploited by a remote attacker who convinces a user to...

PT-2023-28073 · Yydevelopment · Back To The Top Button

Name of the Vulnerable Software and Affected Versions: YYDevelopment Back To The Top Button plugin versions = 2.1.5 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin or higher privileges. Recommendations: For YYDevelopment...