PT-2024-29431 · Cadclick · Cadclick

Name of the Vulnerable Software and Affected Versions: CADClick versions 1.11.0 and earlier Description: A reflected cross-site scripting XSS vulnerability is present in "Artikel.aspx" in CADClick, allowing remote attackers to inject arbitrary web script or HTML via the searchindex parameter. Thi...

PT-2024-38592 · Microchip · Timeprovider 4100

Name of the Vulnerable Software and Affected Versions: Microchip TimeProvider 4100 versions 1.0 through 2.4.6 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks. The...

PT-2024-7434 · Draytek · Draytek Vigor310

Name of the Vulnerable Software and Affected Versions: DrayTek Vigor310 versions through 4.3.2.6 Description: The issue is related to a buffer overflow vulnerability in the web interface of DrayTek Vigor routers, caused by improper handling of input data. This can be exploited by a remote attacke...

PT-2024-6594 · Draytek · Draytek Vigor 3910

Name of the Vulnerable Software and Affected Versions: DrayTek Vigor3910 devices through 4.3.2.6 Description: The issue is a stack-based overflow when processing query string parameters because GetCGI mishandles extraneous ampersand characters and long key-value pairs. This can be exploited by...

PT-2024-7961 · Librenms · Librenms

Name of the Vulnerable Software and Affected Versions: LibreNMS versions prior to 24.9.0 Description: A Stored Cross-Site Scripting XSS vulnerability in the "Device Dependencies" feature allows authenticated users to inject arbitrary JavaScript through the hostname parameter. This can lead to the...

PT-2024-24233 · Flatpress · Flatpress

Name of the Vulnerable Software and Affected Versions: Flatpress version 1.3 Description: The issue allows a remote attacker to execute arbitrary code via a crafted payload to the file name parameter. This enables the attacker to perform Cross Site Scripting attacks. Recommendations: For Flatpres...

PT-2024-31860 · Pagekit · Pagekit

Name of the Vulnerable Software and Affected Versions: Pagekit version 1.0.18 Description: The issue is related to Cross Site Scripting XSS in the "index.php/admin/site/widget" endpoint. This means an attacker could potentially inject malicious scripts into the website, affecting users who visit...

PT-2024-22579 · Infinera · Infinera Hit 7300

Name of the Vulnerable Software and Affected Versions: Infinera hiT 7300 version 5.60.50 Description: An issue was discovered in the @CT desktop management application, where sensitive information is stored in cleartext in the application's memory. This allows guest OS administrators to obtain...

PT-2024-39480 · Unknown · Octopus Server

Name of the Vulnerable Software and Affected Versions: Octopus Server versions 2024.1.0 through 2024.1.13038 Octopus Server versions 2024.2.0 through 2024.2.9482 Octopus Server versions 2024.3.0 through 2024.3.12766 Description: This issue is related to an SQL Injection vulnerability due to...

PT-2024-31945 · Pix Link · Pix-Link Lv-Wr22

Name of the Vulnerable Software and Affected Versions: PIX-LINK LV-WR22 version RE3002-P1-01 V117.0 Description: The issue concerns Improper Access Control, where the TELNET service is enabled with weak credentials for a root-level account, and these credentials cannot be changed. Recommendations...

PT-2024-39554 · Sourcecodester · Sourcecodester Online Railway Reservation System

Name of the Vulnerable Software and Affected Versions: SourceCodester Online Railway Reservation System version 1.0 Description: A problematic issue has been found in the system, affecting an unknown part of the file at the "/?page=reserve" endpoint. The manipulation of the First Name, Middle Nam...

PT-2024-39555 · Sourcecodester · Sourcecodester Online Railway Reservation System

Name of the Vulnerable Software and Affected Versions: SourceCodester Online Railway Reservation System version 1.0 Description: A problematic issue was found in the Message Us Form component, specifically in the contact us.php file. The manipulation of the fullname, email, or message arguments...

PT-2024-39356 · WordPress · Osm – Openstreetmap

Name of the Vulnerable Software and Affected Versions: OSM – OpenStreetMap plugin for WordPress versions up to, and including, 6.1.0 Description: The issue is related to Stored Cross-Site Scripting via the plugin's osm map and osm map v3 shortcodes due to insufficient input sanitization and outpu...

PT-2024-9621 · Gstreamer +7 · Gstreamer +7

Name of the Vulnerable Software and Affected Versions: GStreamer versions prior to 1.24.10 Description: A vulnerability has been discovered in the qtdemux merge sample table function within qtdemux.c, which is part of the GStreamer library. This issue is related to an out-of-bounds OOB read in...

CVE-2024-9155 Insufficient Authorization On Unlinked Channel Files

Mattermost versions 9.10.x = 9.10.1, 9.9.x = 9.9.2, 9.5.x = 9.5.8 fail to limit access to channels files that have not been linked to a post which allows an attacker to view them in channels that they are a member of...

PT-2024-31959 · Vonets · Vap11G-300

Name of the Vulnerable Software and Affected Versions: VONETS VAP11G-300 version 3.3.23.6.9 Description: A command injection issue was discovered via the SystemCommand object. This allows for the execution of arbitrary commands. Recommendations: For version 3.3.23.6.9, consider disabling the...

PT-2024-13336 · Ibm · Ibm Cloud Pak For Multicloud Management

Name of the Vulnerable Software and Affected Versions: IBM Cloud Pak for Multicloud Management versions 2.3 through 2.3 FP8 Description: The issue concerns the storage of user credentials in log files in plain clear text, which can be accessed by a privileged user. This results in the exposure of...

PT-2024-9623 · Gstreamer +10 · Gstreamer +10

Name of the Vulnerable Software and Affected Versions: GStreamer versions prior to 1.24.10 Description: An out-of-bounds write issue was identified in the convert to s334 1a function in isomp4/qtdemux.c. This issue arises due to a discrepancy between the size of memory allocated to the storage...

PT-2024-39268 · WordPress · Bulk Noindex & Nofollow Toolkit

Name of the Vulnerable Software and Affected Versions: The Bulk NoIndex & NoFollow Toolkit plugin for WordPress versions up to, and including, 2.15 Description: The issue is related to Reflected Cross-Site Scripting due to the use of remove query arg without appropriate escaping on the URL. This...

PT-2024-39218 · WordPress · Beam Me Up Scotty – Back To Top Button

Name of the Vulnerable Software and Affected Versions: Beam me up Scotty – Back to Top Button plugin for WordPress versions up to, and including, 1.0.21 Description: The issue is related to Reflected Cross-Site Scripting due to the use of add query arg without proper escaping on the URL. This...