IBM DB2 SEoL (11.0.x <= x <= 11.1.x)

According to its version, IBM DB2 is between 11.0.x and 11.1.x. It is, therefore, no longer maintained by its vendor or provider. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it may contain security vulnerabilities. %NASLMINLEVE...

Mozilla Firefox SEoL (48.x)

According to its version, Mozilla Firefox version install on the remote host has reached end of support. It is, therefore, no longer maintained by its vendor or provider. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it may conta...

PT-2025-4728 · Daniel Walmsley · Daniel Walmsley Vr Views

Name of the Vulnerable Software and Affected Versions: Daniel Walmsley VR Views versions n/a through 1.5.1 Description: The issue is related to improper neutralization of input during web page generation, also known as 'Cross-site Scripting', which allows stored XSS. This means that an attacker c...

PT-2025-4419 · WordPress · Wp Visitor Statistics

Name of the Vulnerable Software and Affected Versions: WP Visitor Statistics Real Time Traffic versions n/a through 7.3 Description: The issue is related to a missing authorization vulnerability in WP Visitor Statistics Real Time Traffic, which allows exploitation of incorrectly configured access...

PT-2025-1646 · WordPress · Store Credit / Gift Cards For Woocommerce

Name of the Vulnerable Software and Affected Versions: Store credit / Gift cards for woocommerce plugin for WordPress versions up to, and including, 1.0.49.46 Description: The issue is related to Reflected Cross-Site Scripting via the coupon, start date, and end date parameters due to insufficien...

Guzzle OAuth Subscriber has insufficient nonce entropy

Impact Nonce generation does not use sufficient entropy nor a cryptographically secure pseudorandom source https://github.com/guzzle/oauth-subscriber/blob/0.8.0/src/Oauth1.phpL192. This can leave servers vulnerable to replay attacks when TLS is not used. Patches Upgrade to version 0.8.1 or higher...

CVE-2025-0214

CVE-2025-0214 affects OpenCart/OpenCart module TMD Custom Header Menu 4.0.0.1. The vulnerability resides in the admin/index.php processing of the headermenu_id parameter, allowing SQL injection with remote access. Impact is stated as partial confidentiality/integrity/availability implications per...

PT-2024-33639 · Fatcat Apps · Landing Page Cat

Name of the Vulnerable Software and Affected Versions: Landing Page Cat versions 1.7.4 and earlier Description: There is a Missing Authorization issue in Fatcat Apps Landing Page Cat. This problem allows unauthorized access due to a lack of proper authorization checks. Recommendations: For versio...

GHSA-R7J8-5H9C-F6FX Remote Command Execution in file editing in gogs

Impact The malicious user is able to commit and edit a crafted symlink file to a repository to gain SSH access to the server. Patches Editing symlink while changing the file name has been prohibited via the repository web editor https://github.com/gogs/gogs/pull/7857. Users should upgrade to 0.13...

Apache Struts file upload path traversal

Added: 12/20/2024 Background Apache Struts is an open-source web application framework for developing Java EE web applications. It uses and extends the Java Servlet API to encourage developers to adopt a model-view-controller MVC architecture. Problem A directory traversal vulnerability in Apache...

Zabbix 6.0.x < 6.0.32rc1, 6.4.x < 6.4.17rc1, 7.0.x < 7.0.1rc1 Authentication Bypass (ZBX-25635)

The version of Zabbix installed on the remote host is prior to 6.0.32rc1, 6.4.17rc1 and 7.0.1rc1. It is therefore affected by authentication bypass vulnerability. - A bug in the code allows an attacker to sign a forged zbxsession cookie, which then allows them to sign in with admin permissions...

CVE-2024-52590 Missing validation allows spoofed profiles in Misskey

Misskey is an open source, federated social media platform. In affected versions missing validation in ApRequestService.signedGet allows an attacker to create fake user profiles that appear to be from a different instance than the one where they actually exist. These profiles can be used to...

CVE-2024-55952 Dataease Redshift Data Source JDBC Connection Parameters Not Verified Leads to RCE Vulnerability

DataEase is an open source business analytics tool. Authenticated users can remotely execute code through the backend JDBC connection. When constructing the jdbc connection string, the parameters are not filtered. Constructing the host as...

Cleo Harmony < 5.8.0.24 Unauthenticated Arbitrary Command Execution (CVE-2024-55956)

The version of Cleo Harmony running on the remote host is prior to 5.8.0.24. It is, therefore, affected by an unauthenticated arbitrary command execution vulnerability. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number...

CVE-2024-55951

CVE-2024-55951 (Metabase) affects Metabase 1.52.x prior to 1.52.2.5, where sandboxed users could view field filter values from other sandboxed users. Root cause: sandbox isolation flaw in new sandboxing configurations created between 1.52.0 and 1.52.2.4. Impact: information disclosure within sand...

BIT-NODE-MIN-2021-3449 NULL pointer deref in signature_algorithms processing

An OpenSSL TLS server may crash if sent a maliciously crafted renegotiation ClientHello message from a client. If a TLSv1.2 renegotiation ClientHello omits the signaturealgorithms extension where it was present in the initial ClientHello, but includes a signaturealgorithmscert extension then a NU...

PT-2024-9695 · Minio +2 · Minio +2

Name of the Vulnerable Software and Affected Versions: MinIO versions prior to RELEASE.2024-12-13T22-19-12Z Description: The issue is related to a privilege escalation vulnerability in the IAM import API of MinIO, which is a high-performance, S3 compatible object store. This vulnerability allows...

PT-2024-17328 · WordPress · Permalinker

Name of the Vulnerable Software and Affected Versions: The Permalinker plugin for WordPress versions up to, and including, 1.8.1 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'permalink' shortcode due to insufficient input sanitization and output escaping on...

CVE-2024-49889 affecting package kernel for versions less than 5.15.173.1-1

CVE-2024-49889 affecting package kernel for versions less than 5.15.173.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2024-50041 affecting package kernel for versions less than 5.15.173.1-1

CVE-2024-50041 affecting package kernel for versions less than 5.15.173.1-1. An upgraded version of the package is available that resolves this issue...