CVE-2024-45014 s390/boot: Avoid possible physmem_info segment corruption

In the Linux kernel, the following vulnerability has been resolved: s390/boot: Avoid possible physmeminfo segment corruption When physical memory for the kernel image is allocated it does not consider extra memory required for offsetting the image start to match it with the lower 20 bits of KASLR...

PT-2024-39189 · Sourcecodester · Sourcecodester Best House Rental Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Best House Rental Management System version 1.0 Description: A critical vulnerability has been found in the system. The issue affects the function delete user/save user of the file /admin class.php. The manipulation of the...

PT-2024-6146 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 8.14 through 17.1.7 GitLab CE/EE versions 17.2 through 17.2.5 GitLab CE/EE versions 17.3 through 17.3.2 Description: An issue was discovered in GitLab CE/EE that allows an attacker to trigger a pipeline as an arbitrary...

PT-2024-6660 · Ivanti · Ivanti Workspace Control

Name of the Vulnerable Software and Affected Versions: Ivanti Workspace Control versions 10.18.0.0 and below Description: The issue is related to an incorrectly implemented authentication scheme in the management console of Ivanti Workspace Control, which is vulnerable to a spoofing attack. This...

PT-2024-30545 · Mguard · Mguard

Name of the Vulnerable Software and Affected Versions: mGuard devices affected versions not specified Description: A low privileged remote attacker can trigger the execution of arbitrary OS commands as root due to improper neutralization of special elements in the variable PROXY HTTP PORT. This...

PT-2024-9884

Name of the Vulnerable Software and Affected Versions: Nix versions 2.24 through 2.24.5 Nix version 2.24 prior to 2.24.6 Description: A bug in Nix allows a substituter or malicious user to craft a NAR that, when unpacked by Nix, causes Nix to write to arbitrary file system locations to which the...

PT-2024-5985

Name of the Vulnerable Software and Affected Versions Ivanti Endpoint Manager versions prior to 2022 SU6 or the 2024 September update Description The vulnerability is related to the deserialization of untrusted data in the agent portal of Ivanti Endpoint Manager, allowing a remote unauthenticated...

PT-2024-9671 · Synology · Synology Router Manager

Name of the Vulnerable Software and Affected Versions: Synology Router Manager SRM versions prior to 1.3.1-9346-10 Description: The issue is related to improper neutralization of input during web page generation, also known as 'Cross-site Scripting'. This allows remote authenticated users with...

PT-2024-37963 · WordPress · Truebooker

Name of the Vulnerable Software and Affected Versions: The TrueBooker WordPress plugin versions prior to 1.0.3 Description: The issue is related to the lack of a CSRF check when updating settings in the plugin. This could allow attackers to make a logged-in admin change settings via a CSRF attack...

PT-2024-39074 · Lmxcms · Lmxcms

Name of the Vulnerable Software and Affected Versions: lmxcms versions up to 1.4 Description: A critical issue was found in the function formatData of the file /admin.php?m=Acquisi&a=testcj&lid=1, which is part of the SQL Command Execution Module. The manipulation of the argument data leads to co...

PT-2024-39092 · Sourcecodester · Sourcecodester Clinics Patient Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Clinics Patient Management System version 2.0 Description: A problem was found in the processing of the file /users.php, where the manipulation of the message argument leads to cross-site scripting. The attack may be initiated...

CVE-2024-45098

IBM Aspera Faspex 5.0.0 through 5.0.9 could allow a user to bypass intended access restrictions and conduct resource modification...

CVE-2024-45098

IBM Aspera Faspex 5.0.0–5.0.9 contains a security bypass that can allow a user to bypass intended access restrictions and modify resources. The issue is addressed in Faspex 5.0.10. Affected product: IBM Aspera Faspex (versions 5.0.0–5.0.9). Root cause indicated: bypass of access controls leading ...

PT-2024-30191 · Unknown · Esafenet Cdg

Name of the Vulnerable Software and Affected Versions: ESAFENET CDG versions 5.6 and earlier Description: A SQL Injection flaw exists in ESAFENET CDG, allowing an attacker to execute arbitrary code via the id parameter of the "data.jsp" page. Recommendations: For ESAFENET CDG versions 5.6 and...

PT-2024-39039 · Unknown · Job Portal

Name of the Vulnerable Software and Affected Versions: Job Portal versions affected versions not specified Description: A Cross-Site Scripting XSS vulnerability is present, where user-controlled input is not sufficiently encrypted. This could allow an attacker to retrieve the session details of a...

PT-2024-5903

Name of the Vulnerable Software and Affected Versions Veeam Backup & Replication versions prior to 12.2.0.334 Description Veeam Backup & Replication is affected by a critical deserialization of untrusted data vulnerability that allows for unauthenticated remote code execution RCE. This flaw,...

PT-2024-5912

Name of the Vulnerable Software and Affected Versions Aardvark-dns versions 1.12.0 through 1.12.1 Description A flaw was found in Aardvark-dns, which is vulnerable to a Denial of Service attack due to the serial processing of TCP DNS queries. An attacker can exploit this flaw by keeping a TCP...

PT-2025-11579

Name of the Vulnerable Software and Affected Versions libbson versions prior to 1.27.5 MongoDB Server v8.0 versions prior to 8.0.1 MongoDB Server v7.0 versions prior to 7.0.16 Description The various bson append functions in the MongoDB C driver library may be susceptible to buffer overflow when...

PT-2024-6520 · D Link · D-Link Dns-320

Name of the Vulnerable Software and Affected Versions: D-Link DNS-320 version 2.02b01 Description: The issue is related to the disclosure of information in the /cgi-bin/discovery.cgi file of the Web Management Interface component in the D-Link DNS-320 router's firmware. This can be exploited...

PT-2024-38580 · WordPress · Sensei Lms

Name of the Vulnerable Software and Affected Versions: The Sensei LMS WordPress plugin versions prior to 4.24.2 Description: The issue concerns the Sensei LMS WordPress plugin, where some of its REST API routes are not properly protected, allowing unauthenticated attackers to leak email templates...