PT-2024-37818 · WordPress · Ditty

Name of the Vulnerable Software and Affected Versions: The Ditty WordPress plugin versions prior to 3.1.46 Description: The issue is related to a previously fixed security problem that was re-introduced in version 3.1.39 of the plugin. No information is provided about the estimated number of...

PT-2024-8619 · Moodle +2 · Moodle +2

Name of the Vulnerable Software and Affected Versions: Moodle affected versions not specified Description: A flaw in Moodle allows hidden user profile fields to be visible in gradebook reports. This could result in users without the view hidden user fields capability having access to confidential...

PT-2024-6067

Name of the Vulnerable Software and Affected Versions runc versions 1.1.13 and earlier, as well as 1.2.0-rc2 and earlier Description The issue is related to a race condition that allows an attacker to create empty files or directories in arbitrary locations on the host filesystem. This can be...

PT-2024-5132 · Zoom · Zoom Workplace Apps +1

Name of the Vulnerable Software and Affected Versions: Zoom Workplace Apps and SDKs for Windows affected versions not specified Description: The issue is related to improper privilege management in the installer for some Zoom Workplace Apps and SDKs for Windows. This may allow an authenticated us...

CVE-2023-45197

The CVE-2023-45197 entry concerns Adminer and AdminerEvo where the file-upload plugin allows uploading a file with a table name of “..” to the Adminer directory root, enabling an attacker to guess the filename and execute it. Affected software: Adminer and AdminerEvo (Adminer is no longer support...

PT-2024-30673 · WordPress · Cb

Name of the Vulnerable Software and Affected Versions: CB legacy WordPress plugin versions 0.9.4.18 and earlier Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for example i...

PT-2024-27008 · Ip Com · Ipcom Ex2 Series

Name of the Vulnerable Software and Affected Versions: IPCOM EX2 Series versions V01L07NF0201 and earlier IPCOM VE2 Series versions V01L07NF0201 and earlier Description: The issue is related to the use of an uninitialized resource. If exploited, it may cause the system to reboot or suspend by...

PT-2024-31920

Name of the Vulnerable Software and Affected Versions ARForms - Premium WordPress Form Builder Plugin versions prior to 6.6 Description The issue allows unauthenticated users to modify uploaded files, enabling the upload of PHP code when an upload file input is included on a form. Recommendations...

PT-2024-4755 · Docker · Docker Desktop

Name of the Vulnerable Software and Affected Versions: Docker Desktop versions prior to 4.31.0 Description: The issue is related to a configuration flaw in the exec-path Docker daemon config option, allowing a user in the docker-users group to cause a Windows Denial-of-Service in Windows containe...

BELL-CVE-2024-26992

Bulletin has no description...

PT-2024-24205 · Typora · Typora

Name of the Vulnerable Software and Affected Versions: Typora versions 1.8.10 and earlier Description: An issue in Typora allows a local attacker to obtain sensitive information and execute arbitrary code via a crafted payload to the src component. Recommendations: For Typora versions 1.8.10 and...

PT-2024-24013 · Pencidesign · Pencidesign Soledad

Name of the Vulnerable Software and Affected Versions: PenciDesign Soledad versions through 8.4.2 Description: A Missing Authorization issue affects the software. Recommendations: For versions through 8.4.2, update to a version newer than 8.4.2 to resolve the issue...

BELL-CVE-2024-26758

Bulletin has no description...

CVE-2024-26711 iio: adc: ad4130: zero-initialize clock init data

In the Linux kernel, the following vulnerability has been resolved: iio: adc: ad4130: zero-initialize clock init data The clkinitdata struct does not have all its members initialized, causing issues when trying to expose the internal clock on the CLK pin. Fix this by zero-initializing the...

PT-2024-40684 · Hdf5 · Hdf5

Name of the Vulnerable Software and Affected Versions: HDF5 affected versions not specified Description: A crash issue was identified, characterized as an UNKNOWN READ. The crash state involves functions such as H5HG read, H5VL native blob get, and H5VL blob get. Recommendations: At the moment,...

PT-2024-22499 · Surveyjs · Surveyjs Survey Creator

Name of the Vulnerable Software and Affected Versions: SurveyJS Survey Creator versions 1.9.132 and earlier Description: The issue allows attackers to execute arbitrary code and obtain sensitive information via the title parameter in a form. This is a Cross Site Scripting XSS issue...

PT-2024-22548

Name of the Vulnerable Software and Affected Versions Unit4 Financials by Coda versions prior to 2023Q4 Description The issue is related to an incorrect access control authorization bypass, allowing an authenticated user to modify the password of any user of the application via a crafted request...

PT-2024-2032 · Cisco · Cisco Secure Client

Name of the Vulnerable Software and Affected Versions: Cisco Secure Client versions affected versions not specified Description: The issue is related to an uncontrolled search path element in the ISE Posture System Scan module. This could allow an authenticated, local attacker to elevate privileg...

BELL-CVE-2023-52467

Bulletin has no description...

Apache Ozone Authorization Problem Vulnerability (CNVD-2024-27493)

Apache Ozone is a software application. A scalable, redundant and distributed object store for Hadoop and cloud-native environments. An authorization issue vulnerability exists in Apache Ozone versions 1.2.0 through 1.3.0, which stems from the presence of an incorrect authentication vulnerability...