PYSEC-2024-203

DuckDB is a SQL database management system. In versions 1.0.0 and prior, content in filesystem is accessible for reading using sniffcsv, even with enableexternalaccess=false. This vulnerability provides an attacker with access to filesystem even when access is expected to be disabled and other...

PT-2024-5126 · Unknown · Cpci85 Central Processing/Communication +1

Name of the Vulnerable Software and Affected Versions: CPCI85 Central Processing/Communication versions prior to V5.40 SICORE Base system versions prior to V1.4.0 Description: A vulnerability has been identified that allows a remote authenticated user or an unauthenticated user with physical acce...

PT-2024-27863 · Unknown · Meks Smart Author Widget

Name of the Vulnerable Software and Affected Versions: Meks Smart Author Widget versions 1.1.4 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS attacks. Recommendations:...

CVE-2024-39678 WordPress Cooked Plugin - Cross-Site Request Forgery to Get Recipe IDs

Cooked is a recipe plugin for WordPress. The Cooked plugin is vulnerable to Cross-Site Request Forgery CSRF in versions up to, and including, 1.7.15.4 due to missing or incorrect nonce validation on the AJAX action handler. This vulnerability could allow an attacker to trick users into performing...

PYSEC-2024-190

Apache Airflow 2.4.0, and versions before 2.9.3, has a vulnerability that allows authenticated DAG authors to craft a docmd parameter in a way that could execute arbitrary code in the scheduler context, which should be forbidden according to the Airflow Security model. Users should upgrade to...

PT-2024-37116 · WordPress · Wp-Emember

Name of the Vulnerable Software and Affected Versions: wp-eMember WordPress plugin versions prior to 10.6.7 Description: The issue concerns a Reflected Cross-Site Scripting problem. It arises because the $ SERVER'REQUEST URI' parameter is not properly escaped before being outputted back in an...

PT-2024-35468 · Unknown · Wp-Affiliate-Platform

Name of the Vulnerable Software and Affected Versions: wp-affiliate-platform versions prior to 6.5.1 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back in the page. This cou...

PT-2024-30108 · WordPress · Svg Block

Name of the Vulnerable Software and Affected Versions: SVG Block WordPress plugin versions prior to 1.1.20 Description: The issue allows users with at least the author role to upload SVG files containing malicious JavaScript, enabling Stored XSS attacks due to the lack of sanitization of SVG file...

PT-2024-34409 · WordPress · Wp-Emember

Name of the Vulnerable Software and Affected Versions: wp-eMember WordPress plugin versions prior to 10.6.7 Description: The issue allows unauthenticated users to perform Stored Cross-Site Scripting attacks due to the lack of sanitization and escaping of certain fields during member registration...

PT-2024-23304 · WordPress · Maxbuttons

Name of the Vulnerable Software and Affected Versions: MaxButtons WordPress plugin versions prior to 9.7.8 Description: The issue allows users with a role as low as editor to perform Cross-Site Scripting attacks due to the plugin's failure to sanitise and escape some parameters. Recommendations:...

PT-2024-35470 · Unknown · Wp-Affiliate-Platform

Name of the Vulnerable Software and Affected Versions: wp-affiliate-platform versions prior to 6.5.1 Description: The issue concerns a lack of CSRF check when updating settings, which could allow attackers to make a logged-in user change them via a CSRF attack. Recommendations: For versions prior...

PT-2024-35465 · Unknown · Wp-Affiliate-Platform

Name of the Vulnerable Software and Affected Versions: wp-affiliate-platform versions prior to 6.5.1 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back in the page. This cou...

PT-2024-34135 · WordPress · Sully

Name of the Vulnerable Software and Affected Versions: SULly WordPress plugin versions prior to 4.3.1 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back in the page. This...

PT-2024-5309 · Juniper Networks · Junos Evolved

Name of the Vulnerable Software and Affected Versions: Junos OS Evolved versions 22.2R1-EVO through 22.4R2-EVO Description: The issue is related to an Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine PFE of Juniper Networks Junos OS Evolved on...

PT-2024-27605 · Vcita · Vcita Online Booking & Scheduling Calendar

Name of the Vulnerable Software and Affected Versions: vCita Online Booking & Scheduling Calendar for WordPress by vcita versions through 4.4.2 Description: The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as a Path Traversal vulnerability. This...

Installing Teams 2.x in an App Layering

Teams will not work properly in an image if it was installed in an App Layer using any version for App Layering prior to 2403.2...

PT-2024-6617

Name of the Vulnerable Software and Affected Versions: Botan versions prior to 2.19.5 Botan versions prior to 3.5.0 Description: A bug in the parsing of name constraint extensions in X.509 certificates meant that if the extension included both permitted subtrees and excluded subtrees, only the...

SUSE SLES12 Security Update : go1.21 (SUSE-SU-2024:2294-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:2294-1 advisory. Updated to version 1.21.12 bsc1212475: - CVE-2024-24791: Fixed a potential denial of service due to improper handling of HTTP 100-continue...

PT-2024-37620 · Mattermost · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost versions 9.5.x through 9.5.5 Mattermost versions 9.6.x through 9.6.2 Mattermost versions 9.7.x through 9.7.4 Mattermost version 9.8.0 Description: The issue allows an attacker to specify both a remoteId and the user ID when creatin...

PT-2024-37584 · Libbson +3 · Libbson +3

Name of the Vulnerable Software and Affected Versions: libbson versions prior to 1.27.1 Description: The issue is related to a potential buffer overflow in the bson string append function, which may lead to memory corruption of neighbouring heap memory. This occurs when the function attempts to...