PT-2024-26987 · WordPress · Newsletter Popup

Name of the Vulnerable Software and Affected Versions: The Newsletter Popup WordPress plugin versions prior to 1.3 Description: The issue concerns a lack of CSRF check when deleting a subscriber, which could allow attackers to make logged-in admins perform such an action via a CSRF attack...

PT-2024-27588 · WordPress · Sp Project & Document Manager

Name of the Vulnerable Software and Affected Versions: SP Project & Document Manager WordPress plugin versions 4.71 and earlier Description: The issue is related to missing validation in the upload function of the plugin, allowing a user to manipulate the user id variable to make it appear that a...

CVE-2024-34717 Anonymous PrestaShop customer can download other customers' invoices

PrestaShop is an open source e-commerce web application. In PrestaShop 8.1.5, any invoice can be downloaded from front-office in anonymous mode, by supplying a random securekey parameter in the url. This issue is patched in version 8.1.6. No known workarounds are available...

PT-2024-3773 · Siemens · Simcenter Femap

Name of the Vulnerable Software and Affected Versions: Simcenter Femap versions prior to V2406 Description: A vulnerability has been identified that allows an attacker to execute code in the context of the current process by exploiting an out of bounds read past the end of an allocated structure...

PT-2024-25523 · Linqi · Linqi

Name of the Vulnerable Software and Affected Versions: linqi versions prior to 1.4.0.1 Description: An issue was discovered in the software, specifically an LDAP injection. Recommendations: For versions prior to 1.4.0.1, update to version 1.4.0.1 or later to resolve the issue...

PT-2024-24554 · WordPress · Ultimate Blocks

Name of the Vulnerable Software and Affected Versions: The Ultimate Blocks WordPress plugin versions prior to 3.1.7 Description: The issue allows users with the contributor role and above to perform Stored Cross-Site Scripting attacks due to the lack of validation and escaping of some block optio...

Important: flatpak

Issue Overview: Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. in versions before 1.10.9, 1.12.9, 1.14.6, and 1.15.8, a malicious or compromised Flatpak app could execute arbitrary code outside its sandbox. Normally, the --command argument of...

PT-2024-6609

Name of the Vulnerable Software and Affected Versions: Botan versions prior to 3.5.0 Botan versions prior to 2.19.5 Description: The issue is related to the processing of X.509 certificates in the Botan C++ cryptography library. Checking name constraints in these certificates is quadratic in the...

SUSE-SU-2024:1574-1 Security update for go1.21

This update for go1.21 fixes the following issues: Update to go1.21.10: - CVE-2024-24787: cmd/go: arbitrary code execution during build on darwin bsc1224017 - net/http: TestRequestLimit/h2 becomes significantly more expensive and slower after x/[email protected]...

PT-2024-25685 · Frappe · Frappe

Name of the Vulnerable Software and Affected Versions: Frappe versions prior to 14.74.0 Frappe versions prior to 15.26.0 Description: The login page of Frappe accepts a redirect argument, allowing redirects to untrusted external URLs. This behavior can be exploited by malicious actors for phishin...

PT-2024-24323 · Unknown · Sonic Shopfloor.Guide

Name of the Vulnerable Software and Affected Versions: Sonic Shopfloor.guide versions prior to 3.1.3 Description: A SQL injection issue in unit.php allows remote attackers to execute arbitrary SQL commands via the level2 parameter. This enables attackers to manipulate database queries, potentiall...

PT-2024-28063

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.9.0-rc6+ Description A vulnerability in the Linux kernel has been resolved, specifically in the bnxt re module. The issue is related to undefined behavior when the bnxt qplib alloc init hwq function is called...

PT-2024-18778 · Samsung · Samsung Notes

Name of the Vulnerable Software and Affected Versions: Samsung Notes versions prior to 4.4.15 Description: The issue is related to improper input validation, allowing local attackers to delete files with Samsung Notes privilege under certain conditions. Recommendations: For versions prior to...

PT-2024-15908 · WordPress · Fancy Product Designer

Name of the Vulnerable Software and Affected Versions: The Fancy Product Designer WordPress plugin versions prior to 6.1.81 Description: The issue is related to the lack of sanitization and escaping of some settings in the plugin, which could allow high-privilege users, such as admins, to perform...

PT-2024-40989 · Skopeo · Skopeo

Name of the Vulnerable Software and Affected Versions: skopeo versions 1.13.0 through 1.14.1 Description: This update for skopeo fixes several issues, including updates to various modules and dependencies, such as github.com/containers/common, github.com/containers/image/v5, and golang.org/x/term...

PT-2024-25851 · Unknown · Addonmaster Post Grid Master

Name of the Vulnerable Software and Affected Versions: AddonMaster Post Grid Master versions 3.4.8 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Stored XSS attacks. Recommendations:...

PT-2024-4392 · Gradio · Gradio

Name of the Vulnerable Software and Affected Versions: Gradio versions prior to 4.20 Description: The issue is related to insufficient protection of sensitive data in Gradio, a Python package for creating applications for machine learning models. This can allow a remote attacker to gain access to...

PT-2024-26962 · WordPress · Responsive Contact Form Builder & Lead Generation Plugin

Name of the Vulnerable Software and Affected Versions: The Responsive Contact Form Builder & Lead Generation Plugin WordPress plugin versions 1.8.9 and earlier Description: The issue concerns the lack of sanitization and escaping of some settings in the plugin, which could allow high-privilege...

PT-2024-25678 · Unknown · Pterodactyl

Name of the Vulnerable Software and Affected Versions: Pterodactyl versions prior to 1.11.6 Description: Importing a malicious egg or gaining access to a wings instance could lead to cross-site scripting XSS on the panel, potentially allowing an attacker to gain an administrator account. The...

Important: javapackages-bootstrap

Issue Overview: Plexis Archiver is a collection of Plexus components to create archives or extract archives to a directory with a unified Archiver/UnArchiver API. Prior to version 4.8.0, using AbstractUnArchiver for extracting an archive might lead to an arbitrary file creation and possibly remot...