PT-2024-37116 · WordPress · Wp-Emember

Name of the Vulnerable Software and Affected Versions: wp-eMember WordPress plugin versions prior to 10.6.7 Description: The issue concerns a Reflected Cross-Site Scripting problem. It arises because the $ SERVER'REQUEST URI' parameter is not properly escaped before being outputted back in an...

PT-2024-35468 · Unknown · Wp-Affiliate-Platform

Name of the Vulnerable Software and Affected Versions: wp-affiliate-platform versions prior to 6.5.1 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back in the page. This cou...

PT-2024-34409 · WordPress · Wp-Emember

Name of the Vulnerable Software and Affected Versions: wp-eMember WordPress plugin versions prior to 10.6.7 Description: The issue allows unauthenticated users to perform Stored Cross-Site Scripting attacks due to the lack of sanitization and escaping of certain fields during member registration...

PT-2024-30108 · WordPress · Svg Block

Name of the Vulnerable Software and Affected Versions: SVG Block WordPress plugin versions prior to 1.1.20 Description: The issue allows users with at least the author role to upload SVG files containing malicious JavaScript, enabling Stored XSS attacks due to the lack of sanitization of SVG file...

PT-2024-23304 · WordPress · Maxbuttons

Name of the Vulnerable Software and Affected Versions: MaxButtons WordPress plugin versions prior to 9.7.8 Description: The issue allows users with a role as low as editor to perform Cross-Site Scripting attacks due to the plugin's failure to sanitise and escape some parameters. Recommendations:...

PT-2024-35470 · Unknown · Wp-Affiliate-Platform

Name of the Vulnerable Software and Affected Versions: wp-affiliate-platform versions prior to 6.5.1 Description: The issue concerns a lack of CSRF check when updating settings, which could allow attackers to make a logged-in user change them via a CSRF attack. Recommendations: For versions prior...

PT-2024-35465 · Unknown · Wp-Affiliate-Platform

Name of the Vulnerable Software and Affected Versions: wp-affiliate-platform versions prior to 6.5.1 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back in the page. This cou...

PT-2024-34135 · WordPress · Sully

Name of the Vulnerable Software and Affected Versions: SULly WordPress plugin versions prior to 4.3.1 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back in the page. This...

PT-2024-5309 · Juniper Networks · Junos Evolved

Name of the Vulnerable Software and Affected Versions: Junos OS Evolved versions 22.2R1-EVO through 22.4R2-EVO Description: The issue is related to an Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine PFE of Juniper Networks Junos OS Evolved on...

PT-2024-27605 · Vcita · Vcita Online Booking & Scheduling Calendar

Name of the Vulnerable Software and Affected Versions: vCita Online Booking & Scheduling Calendar for WordPress by vcita versions through 4.4.2 Description: The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as a Path Traversal vulnerability. This...

Installing Teams 2.x in an App Layering

Teams will not work properly in an image if it was installed in an App Layer using any version for App Layering prior to 2403.2...

PT-2024-6617

Name of the Vulnerable Software and Affected Versions: Botan versions prior to 2.19.5 Botan versions prior to 3.5.0 Description: A bug in the parsing of name constraint extensions in X.509 certificates meant that if the extension included both permitted subtrees and excluded subtrees, only the...

SUSE SLES12 Security Update : go1.21 (SUSE-SU-2024:2294-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:2294-1 advisory. Updated to version 1.21.12 bsc1212475: - CVE-2024-24791: Fixed a potential denial of service due to improper handling of HTTP 100-continue...

PT-2024-37584 · Libbson +3 · Libbson +3

Name of the Vulnerable Software and Affected Versions: libbson versions prior to 1.27.1 Description: The issue is related to a potential buffer overflow in the bson string append function, which may lead to memory corruption of neighbouring heap memory. This occurs when the function attempts to...

PT-2024-37620 · Mattermost · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost versions 9.5.x through 9.5.5 Mattermost versions 9.6.x through 9.6.2 Mattermost versions 9.7.x through 9.7.4 Mattermost version 9.8.0 Description: The issue allows an attacker to specify both a remoteId and the user ID when creatin...

PT-2024-37512

Name of the Vulnerable Software and Affected Versions: github.com/google/nftables version 0.1.0 Description: The issue arises from IP addresses being encoded in the wrong byte order, resulting in an nftables configuration that does not work as intended. This could lead to either blocking or not...

PT-2024-37104 · WordPress · Animated Al List Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Animated AL List WordPress plugin versions 1.0.0 through 1.0.6 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back in t...

PT-2024-27331 · Dell · Dell Powerprotect Dd

Name of the Vulnerable Software and Affected Versions: Dell PowerProtect DD versions prior to 8.0 Dell PowerProtect DD LTS 7.13.1.0 Dell PowerProtect DD LTS 7.10.1.30 Dell PowerProtect DD LTS 7.7.5.40 Description: The issue is an open redirect vulnerability that could be exploited by a remote low...

KLA69718 SB vulnerability in LibreOffice

Improper certificate validation vulnerability was found in LibreOffice. Malicious users can exploit this vulnerability to bypass security restrictions. Original advisories TLS certificate are not properly verified when utilizing LibreOfficeKit Related products LibreOffice CVE list CVE-2024-5261...

go-retryablehttp can leak basic auth credentials to log files

Summary go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file. This could lead to go-retryablehttp writing sensitive HTTP basic auth credentials to its log file. This vulnerability, CVE-2024-6104, was fixed in go-retryablehttp 0.7.7. Background go-retryablehttp i...