PT-2024-13358 · Soot · Soot

Name of the Vulnerable Software and Affected Versions: Soot versions prior to 4.4.1 Description: The issue is related to an infinite loop in the retrieveActiveBody function under Java 8, allowing attackers to cause a Denial of Service DoS. Recommendations: For versions prior to 4.4.1, update to...

NextGen Healthcare Mirth Connect Under Attack - CISA Issues Urgent Warning

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Monday added a security flaw impacting NextGen Healthcare Mirth Connect to its Known Exploited Vulnerabilities KEV catalog, citing evidence of active exploitation. The flaw, tracked as CVE-2023-43208 CVSS score: N/A, concerns a cas...

CVE-2024-25595

Authentication Bypass by Spoofing vulnerability in WPMU DEV Defender Security allows Functionality Bypass.This issue affects Defender Security: from n/a through 4.4.1...

PT-2024-22957 · WordPress · Wp Front User Submit / Front Editor

Name of the Vulnerable Software and Affected Versions: WP Front User Submit / Front Editor plugin for WordPress versions up to, and including, 4.4.1 Description: The issue is related to Stored Cross-Site Scripting via form settings due to insufficient input sanitization and output escaping. This...

CraftBeerPi 安全漏洞

CraftBeerPi is an open source software solution for PiBrewing individual developers. A security vulnerability exists in CraftBeerPi versions 4.0.0.58 through 4.4.1.a1 that originates from the execution of arbitrary code without prior authentication...

CVE-2024-3262

Information exposure vulnerability in RT software affecting version 4.4.1. This vulnerability allows an attacker with local access to the device to retrieve sensitive information about the application, such as vulnerability tickets, because the application stores the information in the browser...

UBUNTU-CVE-2024-3262

Information exposure vulnerability in RT software affecting version 4.4.1. This vulnerability allows an attacker with local access to the device to retrieve sensitive information about the application, such as vulnerability tickets, because the application stores the information in the browser...

CVE-2024-3262

Information exposure vulnerability in RT software affecting version 4.4.1. This vulnerability allows an attacker with local access to the device to retrieve sensitive information about the application, such as vulnerability tickets, because the application stores the information in the browser...

CVE-2024-3262

CVE-2024-3262 is an information-exposure vulnerability in Request Tracker (RT) affecting RT 4.x. The issue arises because ticket/application data could be stored in a user’s browser cache, allowing a local attacker with access to the device to retrieve sensitive information even after session ter...

Best Practical Request Tracker 信息泄露漏洞

Best Practical Request Tracker is an event tracking system written in Perl. An information disclosure vulnerability exists in Best Practical Request Tracker version 4.4.1, which stems from the presence of an information disclosure vulnerability...

PT-2024-24728 · Rt +1 · Rt +1

Name of the Vulnerable Software and Affected Versions: RT software version 4.4.1 Description: The issue allows an attacker with local access to the device to retrieve sensitive information about the application, such as vulnerability tickets. This is because the application stores the information...

Request Tracker -- information exposure vulnerability

Request Tracker reports: CVE-2024-3262 describes previously viewed pages being stored in the browser cache, which is the typical default behavior of most browsers to enable the "back" button. Someone who gains access to a host computer could potentially view ticket data using the back button, eve...

CVE-2024-3262

Information exposure vulnerability in RT software affecting version 4.4.1. This vulnerability allows an attacker with local access to the device to retrieve sensitive information about the application, such as vulnerability tickets, because the application stores the information in the browser...

Security Bulletin: Due to use of PostgreSQL JDBC Driver (PgJDBC), IBM Cloud Pak for AIOps is vulnerable to SQL injection

Summary PostgreSQL JDBC Driver is used by IBM Cloud Pak for AIOps for connection configuration CVE-2024-1597. This bulletin identifies the steps to take to address the vulnerability. Vulnerability Details CVEID:CVE-2024-1597 DESCRIPTION: PostgreSQL JDBC Driver PgJDBC is vulnerable to SQL injectio...

CVE-2024-0957

The WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Customer Notes field in all versions up to, and including, 4.4.1 due to insufficient input sanitization and output escaping. This makes it...

Exploit for Deserialization of Untrusted Data in Nextgen Mirth_Connect

RCE vulnerability in Mirth Connect CVE-2023-37679 and CVE-202...

Security Bulletin: Multiple Vulnerabilities in CloudPak for AIOps

Summary Multiple vulnerabilities were addressed in IBM Cloud Pak for AIOps version 4.4.1 Vulnerability Details CVEID:CVE-2023-50447 DESCRIPTION: Pillow could allow a remote attacker to execute arbitrary code on the system, caused by improper neutralization of user supplied-input by the...

Mirth Connect 4.4.0 Remote Command Execution Exploit

A vulnerability exists within Mirth Connect due to its mishandling of deserialized data. This vulnerability can be leveraged by an attacker using a crafted HTTP request to execute OS commands within the context of the target application. The original vulnerability was identified by IHTeam and...

CVE-2023-7200

The EventON WordPress plugin before 4.4.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

PT-2024-15225 · WordPress · Eventon

Name of the Vulnerable Software and Affected Versions: EventON WordPress plugin versions prior to 4.4.1 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back in the page. This...