Wireshark Security Update (wnpa-sec-2023-28) - Windows

Wireshark is prone to a denial of service DoS vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:wireshark:wireshark"...

PT-2024-17254 · WordPress · Wp Mailster

Name of the Vulnerable Software and Affected Versions: WP Mailster plugin for WordPress versions up to, and including, 1.8.17.0 Description: The issue is related to stored cross-site scripting due to insufficient input sanitization and output escaping on user-supplied attributes in the mst...

PT-2024-39394 · Elementor · Element Pack Elementor Addons

Name of the Vulnerable Software and Affected Versions: Element Pack Elementor Addons versions up to 5.10.5 Description: The issue is related to stored cross-site scripting via the Lightbox widget due to insufficient input sanitization and output escaping. This allows authenticated attackers with...

GHSA-Q849-WXRC-VQRP hull.js Code Injection Vulnerability

Versions of the library from 0.2.2 to 1.0.9 are vulnerable to the arbitrary code execution due to unsafe usage of new Function... in the module that handles points format. Applications passing the 3rd parameter to the hull function without sanitising may be impacted. The vulnerability has been...

PT-2024-35343 · Imbachat · Imbachat

Name of the Vulnerable Software and Affected Versions: ImbaChat versions prior to 3.1.4 Description: The issue is related to improper neutralization of input during web page generation, which allows for DOM-Based XSS. This means that an attacker could potentially inject malicious scripts into the...

PT-2024-35318 · WordPress · Ben Marshall Jobify - Job Board Wordpress Theme

Name of the Vulnerable Software and Affected Versions: Ben Marshall Jobify - Job Board WordPress Theme versions n/a through 4.2.3 Description: The issue is related to improper neutralization of input during web page generation, also known as Cross-site Scripting, which allows Stored XSS. This mea...

PT-2024-35309 · WordPress · Woocommerce Price Alert

Name of the Vulnerable Software and Affected Versions: WooCommerce Price Alert versions 1.0.4 and earlier Description: The issue is related to improper neutralization of input during web page generation, also known as 'Cross-site Scripting', which allows Reflected XSS. This problem affects the...

LimeSurvey < 6.5.12 XSS Vulnerability

LimeSurvey is prone to a cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

PT-2024-35891 · Yahoo · Max Engel Yahoo! Webplayer

Name of the Vulnerable Software and Affected Versions: Max Engel Yahoo! WebPlayer versions n/a through 2.0.6 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can perform actions on behalf of a user without their knowledge or...

PT-2024-35866 · Unknown · Aftab Husain Vertical Carousel

Name of the Vulnerable Software and Affected Versions: Aftab Husain Vertical Carousel versions 1.0.2 and earlier Description: The issue affects Aftab Husain Vertical Carousel, allowing Stored XSS due to improper neutralization of input during web page generation. This is a Cross-site Scripting...

PT-2024-35896 · Unknown · Ni Woocommerce Cost Of Goods

Name of the Vulnerable Software and Affected Versions: Ni WooCommerce Cost Of Goods versions 3.2.8 and earlier Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection, which can be...

PT-2024-35874 · Unknown · Best Addons For Elementor

Name of the Vulnerable Software and Affected Versions: Best Addons for Elementor versions 1.0.0 through 1.0.5 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Stored XSS, where an attacker can...

PT-2024-27094 · Zulip · Zulip

Name of the Vulnerable Software and Affected Versions: Zulip versions 8.0 through 8.3 Description: The issue is related to a memory leak vulnerability in the handling of popovers. This vulnerability occurs in the specified versions of Zulip. Recommendations: For versions 8.0 through 8.3, update t...

PT-2024-35439 · Dcme-320 +3 · Dcme-320 +3

Name of the Vulnerable Software and Affected Versions: DCME-320 versions prior to 7.4.12.90 DCME-520 versions prior to 9.25.5.11 DCME-320-L versions prior to 9.3.5.26 DCME-720 versions prior to 9.1.5.11 Description: The issue allows for Remote Code Execution and Privilege Escalation via the...

PT-2024-9173 · Jetbrains · Youtrack

Name of the Vulnerable Software and Affected Versions: JetBrains YouTrack versions prior to 2024.3.52635 Description: The issue is related to a potential spoofing attack due to the lack of Punycode encoding in JetBrains YouTrack. This could allow a remote attacker to conduct spoofing attacks. The...

PT-2024-17142 · Unknown · Rank Math Seo

Name of the Vulnerable Software and Affected Versions: Rank Math SEO versions 1.0.2 through 1.0.231 Description: A Code Injection vulnerability exists in Rank Math SEO, allowing improper control of code generation. This issue enables code injection, potentially leading to security breaches. The...

PT-2024-16918 · WordPress · Hls Player

Name of the Vulnerable Software and Affected Versions: HLS Player plugin for WordPress versions up to, and including, 1.0.10 Description: The issue is related to Stored Cross-Site Scripting via the plugin's hls player shortcode due to insufficient input sanitization and output escaping on...

Google Chrome Insufficient Data Validation Vulnerability - Windows

Google Chrome is prone to an insufficient data validation vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Mozilla Firefox ESR Security Update (MFSA2024-65) - Mac OS X

Mozilla Firefox ESR is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:firefoxesr";...

Mozilla Thunderbird ESR Security Update (MFSA2024-68) - Windows

Mozilla Thunderbird ESR is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:thunderbird...