PT-2024-12885 · WordPress · Wp-Postratings

Name of the Vulnerable Software and Affected Versions: WP-PostRatings versions 1.91 and earlier Description: The issue is related to an Improper Control of Interaction Frequency vulnerability, allowing Functionality Misuse in WP-PostRatings. Recommendations: For WP-PostRatings versions 1.91 and...

PT-2024-32634 · WordPress · Wp-Emember

Name of the Vulnerable Software and Affected Versions: wp-eMember WordPress plugin versions prior to 10.3.9 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because the fieldId parameter is not properly sanitized and escaped before being outputted back in t...

PT-2024-27928

Name of the Vulnerable Software and Affected Versions qdrant/qdrant version 1.9.0-dev Description The issue allows for arbitrary file read and write during the snapshot recovery process. Attackers can exploit this by manipulating snapshot files to include symlinks, leading to arbitrary file read ...

SUSE-SU-2024:1872-1 Security update for python-tqdm

This update for python-tqdm fixes the following issues: Update to version 4.66.4: rich: fix completion cli: eval safety CVE-2024-34062, bsc1223880 pandas: add DataFrame.progressmap notebook: fix HTML padding keras: fix resuming training when verbose=2 fix formatnum negative fractions missing...

PT-2024-26755 · WordPress · Simple Like Page Plugin

Name of the Vulnerable Software and Affected Versions: The Simple Like Page Plugin for WordPress versions up to, and including, 1.5.2 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the plugin's shortcodes, allowing authenticat...

SUSE SLES15: warewulf4 / warewulf4-man / warewulf4-overlay / etc (SUSE-SU-2024:1838-1)

The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:1838-1 advisory. - fixed wwctl configure --all doesn't configure ssh bsc1225402 - update to 4.5.2 with following changes: Reorder dnsmasq config to put iPX...

SUSE-SU-2024:1815-1 Security Beta update for SUSE Manager Client Tools

This update fixes the following issues: grafana: - Packaging improvements: Changed deprecated disabled service mode to manual Drop golang-packaging macros Drop explicit mod=vendor as it is enabled automatically - Update to version 9.5.18: SECURITY CVE-2024-1313: Require same organisation when...

PT-2024-19517 · Tcpdf +1 · Tcpdf +1

Name of the Vulnerable Software and Affected Versions: TCPDF versions 6.6.5 and earlier Description: The issue arises when parsing an untrusted SVG file, leading to a ReDoS Regular Expression Denial of Service condition. This occurs due to the inefficient handling of regular expressions within th...

PT-2024-31574 · WordPress · Kkprogressbar2 Free

Name of the Vulnerable Software and Affected Versions: KKProgressbar2 Free WordPress plugin versions 1.1.4.2 and earlier Description: The issue allows admin users to perform SQL injection attacks due to the lack of sanitization and escaping of a parameter before using it in a SQL statement...

PT-2024-4134 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions 13.2.4 through 16.10.5 GitLab versions 16.11 through 16.11.2 GitLab versions 17.0 through 17.0.0 Description: An authorization issue exists where an authenticated attacker could utilize a crafted naming convention to bypass...

OPENSUSE-SU-2024:0135-1 Security update for gitui

This update for gitui fixes the following issues: - update to version 0.26.2: respect configuration for remote when fetching also applies to pulling add : character to sign-off trailer to comply with Conventional Commits standard support overriding builddate for reproducible builds - update...

PT-2024-24042 · Unknown · A-Blog Cms

Name of the Vulnerable Software and Affected Versions: a-blog cms versions 3.0.x through 3.0.31 a-blog cms versions 3.1.x through 3.1.11 Description: A code injection issue exists, allowing a user with administrator or higher privilege who can log in to the product to execute an arbitrary command...

PT-2024-4023 · Ivanti · Ivanti Secure Access Client For Linux

Name of the Vulnerable Software and Affected Versions: Ivanti Secure Access Client for Linux versions prior to 22.7R1 Description: A local privilege escalation issue allows a low-privileged user to execute code as root. The vulnerability is related to a buffer overflow in memory, which can be...

PT-2024-3780 · Winrar · Winrar

Name of the Vulnerable Software and Affected Versions: WinRAR versions prior to 7.00 Description: The issue is related to errors in processing input data, which can be exploited by a remote attacker to cause a denial of service or spoof the screen output. This can be achieved through the use of...

PT-2024-13728 · Zoho · Zoho Manageengine Adaudit Plus

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine ADAudit Plus versions below 7271 Description: The issue allows SQL injection while getting file server details. Recommendations: For Zoho ManageEngine ADAudit Plus versions below 7271, update to version 7271 or later to...

PT-2024-13725 · Zoho · Zoho Manageengine Adaudit Plus

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine ADAudit Plus versions below 7271 Description: The issue allows SQL injection while adding file shares. There is no information provided about the estimated number of potentially affected devices worldwide or real-world...

PT-2024-60: Path Traversal leads to Remote Code Execution (RCE) in VideoMost Server

The vulnerability was identified in VideoMost Server, versions before 9.0.0.1757. The discovered vulnerability can be exploited by an attacker to remotely execute arbitrary code. Vulnerability status: Confirmed by vendor Date of vulnerability remediation: 20.05.2024 Recommendations: Update to...

PT-2024-30180 · Mintplex · Anything-Llm

Name of the Vulnerable Software and Affected Versions: mintplex-labs/anything-llm versions prior to 1.0.0 Description: A denial of service DoS condition can be triggered through the modification of a user's id attribute to a value of 0. This can render a chosen account completely inaccessible,...

PT-2024-12931 · WordPress · Wpvivid Backup/Migration

Name of the Vulnerable Software and Affected Versions: WPvivid Backup and Migration versions 0.9.90 and earlier Description: The issue is related to improper privilege management, allowing privilege escalation. This can be exploited, potentially leading to unauthorized access or control...

PT-2024-11680 · Wpmu Dev · Wpmu Dev Defender Security

Name of the Vulnerable Software and Affected Versions: WPMU DEV Defender Security versions n/a through 3.3.2 Description: The issue affects the storage of sensitive information, allowing access to screen temporary files that may contain sensitive data. This is a result of insecure storage practic...