PT-2024-30417 · WordPress · Mybooktable Bookstore

Name of the Vulnerable Software and Affected Versions: MyBookTable Bookstore versions 3.3.9 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Cross-Site Scripting XSS in the MyBookTable Bookstore plugin for WordPress. Users are advised to upgrade to...

PT-2024-30427 · Mediavine · Create By Mediavine

Name of the Vulnerable Software and Affected Versions: Create by Mediavine versions 1.9.8 and earlier Description: This issue exposes sensitive information to unauthorized actors. Users are urged to upgrade to the latest version to mitigate risks. Recommendations: For versions 1.9.8 and earlier,...

OESA-2024-2037 python-urllib3 security update

Sanity-friendly HTTP client for Python Security Fixes: urllib3 is a user-friendly HTTP client library for Python. When using urllib3's proxy support with ProxyManager, the Proxy-Authorization header is only sent to the configured proxy, as expected. However, when sending HTTP requests without usi...

PT-2024-27042 · Zohocorp · Zoho Manageengine Adaudit Plus

Name of the Vulnerable Software and Affected Versions: Zohocorp ManageEngine ADAudit Plus versions below 8000 Description: The issue concerns an authenticated SQL injection vulnerability in the file summary option. This vulnerability affects Zohocorp ManageEngine ADAudit Plus. Recommendations:...

PT-2024-31480

Name of the Vulnerable Software and Affected Versions llama index versions prior to 0.10.38 Description An issue was discovered in the download/integration.py file, which includes an exec call for import of a class name specified by the cls name variable. This could potentially lead to execution ...

Oracle Siebel CRM SEoL (8.2.x)

According to its version, Oracle Siebel CRM is 8.2.x. It is, therefore, no longer maintained by its vendor or provider. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it may contain security vulnerabilities. %NASLMINLEVEL 80900 C...

PT-2024-28658 · Ibm · Ibm Sterling Connect:Direct Web Services

Name of the Vulnerable Software and Affected Versions: IBM Sterling Connect:Direct Web Services versions 6.0 through 6.3 Description: The issue allows an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts due to a cross-site request forgery...

Oracle Siebel CRM SEoL (7.0.x)

According to its version, Oracle Siebel CRM is 7.0.x. It is, therefore, no longer maintained by its vendor or provider. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it may contain security vulnerabilities. %NASLMINLEVEL 80900 C...

SUSE CVE-2024-7272

A vulnerability, which was classified as critical, was found in FFmpeg up to 5.1.5. This affects the function fillaudiodata of the file /libswresample/swresample.c. The manipulation leads to heap-based buffer overflow. It is possible to initiate the attack remotely. This issue was fixed in versio...

Medium: python-tqdm

Issue Overview: tqdm is an open source progress bar for Python and CLI. Any optional non-boolean CLI arguments e.g. --delim, --buf-size, --manpath are passed through python's eval, allowing arbitrary code execution. This issue is only locally exploitable and had been addressed in release version...

Improper Authorization

Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to Improper Authorization. An attacker can gain access to minor sensitive information by bypassing security restrictions using a low-privileged account. Remediation Upgrade...

Premature Release of Resource During Expected Lifetime

Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to Premature Release of Resource During Expected Lifetime via the authorization process. A low-privileged attacker can bypass security restrictions and modify limited...

PT-2024-7320 · Adobe · Substance3D - Sampler

Name of the Vulnerable Software and Affected Versions: Substance3D - Sampler versions 4.5 and earlier Description: The issue is related to a null pointer dereference vulnerability. Exploitation of this vulnerability could lead to an application denial-of-service DoS condition, allowing an attacke...

PT-2024-30316 · WordPress · Woocommerce Product Table Lite

Name of the Vulnerable Software and Affected Versions: WooCommerce Product Table Lite versions 3.5.1 and earlier Description: The issue is related to an Improper Control of Generation of Code 'Code Injection' vulnerability in WooCommerce Product Table Lite, allowing Code Injection. Recommendation...

Improper Input Validation

Overview Affected versions of this package are vulnerable to Improper Input Validation via the resource file handling mechanism. An attacker can use resource API to access and modify all files in the machine even if they are not under resource path. Remediation Upgrade...

PT-2024-30376 · Unknown · Multivendorx Wc Marketplace

Name of the Vulnerable Software and Affected Versions: MultiVendorX WC Marketplace versions n/a through 4.1.17 Description: The issue affects the MultiVendorX WC Marketplace, allowing Reflected XSS due to improper neutralization of input during web page generation. This can lead to cross-site...

GnuPG: Multiple Vulnerabilities

Background The GNU Privacy Guard, GnuPG, is a free replacement for the PGP suite of cryptographic software. Description Multiple vulnerabilities have been discovered in GnuPG. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for...

Notepad++ < 8.1.1 Arbitrary Code Execution

The version of Notepad++ installed on the remote host is prior to 8.1.1. It is, therefore, affected by a arbitary code execution vulnerability in the dbghelp.exe file, allowing a attacker with local access to abuse the uncontrolled search path to execute arbitrary code and gain access. Note that...

Elastic Agent 8.15.0 Security Update (ESA-2024-23)

Elastic Agent Insertion of Sensitive Information into Log File ESA-2024-23 An issue was discovered whereby Elastic Agent will leak secrets from the agent policy elastic-agent.yml only when the log level is configured to debug. By default the log level is set to info, where no leak occurs. Affecte...

SUSE CVE-2024-42347

matrix-react-sdk is a react-based SDK for inserting a Matrix chat/voip client into a web page. A malicious homeserver could manipulate a user's account data to cause the client to enable URL previews in end-to-end encrypted rooms, in which case any URLs in encrypted messages would be sent to the...