CVE-2024-50585 Reflected Cross-Site Scripting

Users who click on a malicious link or visit a website under the control of an attacker can be infected with arbitrary JavaScript which is running in the context of the "Numerix License Server Administration System Login" nlslogin.jsp page. The vulnerability can be triggered by sending a speciall...

PT-2024-17616 · Dromara · Dromara Ujcms

Name of the Vulnerable Software and Affected Versions: Dromara UJCMS versions up to 9.6.3 Description: A problematic vulnerability has been found in Dromara UJCMS, affecting an unknown part of the file /users/id of the component User ID Handler. The manipulation leads to authorization bypass. It ...

PT-2024-9581 · Gitlab · Gitlab Ce/Ee

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 16.1 through 17.4.6 GitLab CE/EE versions 17.5 through 17.5.4 GitLab CE/EE versions 17.6 through 17.6.2 Description: An issue was discovered in GitLab CE/EE where the injection of Network Error Logging NEL headers in the...

PT-2024-10371

Name of the Vulnerable Software and Affected Versions GStreamer versions prior to 1.24.10 Description GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in the extract cc from data function within qtdemux.c. In the FOURCC c708 case,...

PT-2024-34457 · Silicon · Z-Wave Series 700/800

Name of the Vulnerable Software and Affected Versions: Silicon Labs SiLabs Z-Wave Series 700 and 800 version 7.21.1 Description: The issue is related to insecure permissions in the affected software, allowing attackers to disrupt communications between the controller and the device by repeatedly...

CVE-2024-45493

Summary: CVE-2024-45493 affects MSA FieldServer Gateway versions 5.0.0–6.5.2; a bypass allows an attacker to authenticate with an internal user account from the network, if password known. The issue is fixed in version 7.0.0. Affected product: MSA FieldServer Gateway (FieldServer Gateway) — Field...

PT-2024-34547 · Jepaas · Jepaas

Name of the Vulnerable Software and Affected Versions: JEPAAS version 7.2.8 Description: The issue allows a remote user to submit a specially crafted query via the /je/rbac/rbac/loadLoginCount API endpoint in the dateVal parameter. This could enable an attacker to retrieve all the information...

PT-2024-34455 · Silicon · Z-Wave Series 700/800

Name of the Vulnerable Software and Affected Versions: Silicon Labs SiLabs Z-Wave Series 700 and 800 version 7.21.1 Description: The issue concerns insecure permissions in the software, allowing attackers to create a fake node by supplying crafted packets. Recommendations: For Silicon Labs SiLabs...

PT-2024-34456 · Silicon · Z-Wave Series 700 +1

Name of the Vulnerable Software and Affected Versions: Silicon Labs SiLabs Z-Wave Series 700 and 800 version 7.21.1 Description: The issue is related to insecure permissions in the Silicon Labs SiLabs Z-Wave Series 700 and 800, which allows attackers to cause a Denial of Service DoS by repeatedly...

PT-2024-9717 · Adobe · Experience Manager

Name of the Vulnerable Software and Affected Versions: Adobe Experience Manager versions 6.5.21 and earlier Description: The issue is related to a stored Cross-Site Scripting XSS vulnerability that could be exploited by an attacker to inject malicious scripts into vulnerable form fields. This cou...

PT-2024-10373

Name of the Vulnerable Software and Affected Versions GStreamer versions prior to 1.24.10 Description A null pointer dereference has been discovered in the id3v2 read synch uint function, located in id3v2.c. If id3v2 read synch uint is called with a null work-hdr.frame data, the pointer guint8 da...

PT-2024-11617 · Unknown · Flipkart-Clone-Php

Name of the Vulnerable Software and Affected Versions: Flipkart-Clone-PHP version 1.0 Description: The issue allows attackers to execute arbitrary code through a SQL Injection vulnerability in the product title parameter in the entry.php file. Recommendations: For Flipkart-Clone-PHP version 1.0,...

PT-2024-9297 · Tp Link · Tp-Link Vn020 F3V

Name of the Vulnerable Software and Affected Versions: TP-Link VN020 F3vT version TT V6.2.1021 Description: A critical issue affects the Incomplete SOAP Request Handler component, specifically the processing of the file /control/WANIPConnection. This can lead to denial of service when exploited...

PT-2024-36082 · Unknown · Paloma Widget

Name of the Vulnerable Software and Affected Versions: Paloma Widget versions 1.14 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the Paloma Widget, allowing unauthorized requests. This can lead to malicious actions being performed on behalf of the user. Recommendations:...

DRUPAL-CONTRIB-2024-068

Module to restrict access from anonymous and regular users to configured pre-defined pages. The module does not adequately handle protecting certain types of URLs...

PT-2024-36396

Name of the Vulnerable Software and Affected Versions socat versions prior to 1.8.0.2 Description The issue is related to the readline.sh file in socat, which relies on the /tmp/$USER/stderr2 file. This can lead to an arbitrary file overwrite via a predictable /tmp directory. Recommendations For...

PT-2024-17473 · Dedecms · Dedecms

Name of the Vulnerable Software and Affected Versions: DedeCMS version 5.7.116 Description: A problematic vulnerability was found in DedeCMS, affecting an unknown functionality of the file /member/uploads add.php of the component SWF File Handler. The manipulation of the mediatype argument leads ...

Pages Restriction Access - Critical - Access bypass - SA-CONTRIB-2024-068

Module to restrict access from anonymous and regular users to configured pre-defined pages. The module does not adequately handle protecting certain types of URLs...

PT-2024-20701 · Ibm · Ibm Cognos Controller

Name of the Vulnerable Software and Affected Versions: IBM Cognos Controller versions 11.0.0 through 11.0.1 Description: The issue concerns a malicious file upload vulnerability due to the lack of validation of the type of file uploaded to Journal entry attachments. Attackers can exploit this...

PT-2024-35763 · Seecms · Seecms

Name of the Vulnerable Software and Affected Versions: Seecms version 4.8 Description: A SQL injection issue was discovered in the SEMCMS SeoAndTag.php page. This issue allows for potential SQL injection attacks. Recommendations: For Seecms version 4.8, consider restricting access to the SEMCMS...