PT-2024-18172 · Nt Ware +1 · Uniflow Online +1

Name of the Vulnerable Software and Affected Versions: uniFLOW Online versions prior to and including 2024.1.0 Description: The registration process of uniFLOW Online apps can be compromised when email login is enabled on the tenant, particularly for those utilizing email login in combination wit...

CVE-2024-45509

In MISP through 2.4.196, app/Controller/BookmarksController.php does not properly restrict access to bookmarks data in the case where the user is not an org admin...

CVE-2024-45509

In MISP through 2.4.196, app/Controller/BookmarksController.php does not properly restrict access to bookmarks data in the case where the user is not an org admin...

CVE-2024-45509

In MISP through 2.4.196, app/Controller/BookmarksController.php does not properly restrict access to bookmarks data in the case where the user is not an org admin...

CVE-2024-45509

In MISP up to 2.4.196, there is an access control vulnerability in app/Controller/BookmarksController.php that allows non-org-admin users to access bookmarks data. Root cause: insufficient restriction for non-admin users in the BookmarksController. Impact: exposure of bookmarks data with confiden...

CVE-2024-45509

In MISP through 2.4.196, app/Controller/BookmarksController.php does not properly restrict access to bookmarks data in the case where the user is not an org admin...

PT-2024-37737 · Lightdash · Lightdash

Name of the Vulnerable Software and Affected Versions: Lightdash version 0.1024.6 Description: Multiple stored cross-site scripting XSS vulnerabilities in the markdown dashboard and dashboard comment functionality allow remote authenticated threat actors to inject malicious scripts into vulnerabl...

PT-2024-28661 · Ibm · Ibm Sterling Connect:Direct Web Services

Name of the Vulnerable Software and Affected Versions: IBM Sterling Connect:Direct Web Services versions 6.0 through 6.3 Description: The issue concerns the use of default credentials for potentially critical functionality in IBM Sterling Connect:Direct Web Services. This could pose a significant...

PT-2024-38091 · WordPress · Elementor Addon Elements

Name of the Vulnerable Software and Affected Versions: Elementor Addon Elements plugin for WordPress versions up to, and including, 1.13.6 Description: The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple widgets due to insufficient input...

PT-2024-31211 · Tpmecms · Tpmecms

Name of the Vulnerable Software and Affected Versions: TpMeCMS version 1.3.3.2 Description: The issue is related to Cross Site Scripting XSS in the /h.php/page?ref=addtabs endpoint, specifically via the Title, Images, and Content fields. This allows for potential malicious script injection...

PT-2024-21587 · WordPress · Betheme

Name of the Vulnerable Software and Affected Versions: Betheme theme for WordPress versions up to, and including, 27.5.6 Description: The issue is related to PHP Object Injection via deserialization of untrusted input of the mfn-page-items post meta value. This allows authenticated attackers with...

PT-2024-17996 · WordPress · Premium Portfolio Features For Phlox

Name of the Vulnerable Software and Affected Versions: Premium Portfolio Features for Phlox theme plugin for WordPress versions up to, and including, 2.3.3 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'aux recent portfolios grid' shortcode due to insufficient...

PT-2024-22971 · Sportsnet · Sportsnet

Name of the Vulnerable Software and Affected Versions: SportsNET version 4.0.1 Description: The issue concerns SQL injection vulnerabilities that could allow an attacker to retrieve, update, and delete all information in the database by sending a specially crafted SQL query to the...

PT-2024-30166 · Unknown · Kashipara Music Management System

Name of the Vulnerable Software and Affected Versions: Kashipara Music Management System version 1.0 Description: A Cross-Site Request Forgery CSRF issue was found in the system. This can be exploited through a crafted request to the "/music/ajax.php?action=save user" page. Recommendations: For...

PT-2024-30194

Name of the Vulnerable Software and Affected Versions Ruoyi versions 4.7.9 and earlier Description A cross-site scripting XSS issue was discovered in Ruoyi via the sql parameter of the createTable function at "/tool/gen/create". This allows for potential exploitation. Recommendations For versions...

PT-2024-38873 · Nafisulbari · Insurance Management System

Name of the Vulnerable Software and Affected Versions: nafisulbari/itsourcecode Insurance Management System version 1.0 Description: A vulnerability was found in the Insurance Management System, affecting some unknown functionality of the file addClient.php. The manipulation of the CLIENT ID...

PT-2024-38872 · Nafisulbari · Insurance Management System

Name of the Vulnerable Software and Affected Versions: nafisulbari/itsourcecode Insurance Management System version 1.0 Description: A vulnerability has been found in the Insurance Management System, affecting an unknown functionality of the file editClient.php. The manipulation of the AGENT ID...

PT-2024-28667 · Qbic · Qbic Cloud Cc-2L

Name of the Vulnerable Software and Affected Versions: QBiC CLOUD CC-2L versions 1.1.30 and earlier Safie One versions 1.8.2 and earlier Description: The issue is related to improper certificate validation, which may allow a network-adjacent unauthenticated attacker to obtain and/or alter...

PT-2024-28827 · Ptc · Ptc Thingworx

Name of the Vulnerable Software and Affected Versions: PTC ThingWorx version 9.5.0 Description: An Insecure Direct Object Reference IDOR in PTC ThingWorx allows attackers to view sensitive information, including personally identifiable information PII, regardless of access level. Recommendations:...

Access Restriction Bypass

Overview Shopify/tophat is a package for easily installing and testing mobile applications Affected versions of this package are vulnerable to Access Restriction Bypass in ArtifactProvider, which can be downgraded to HTTP via a malicious URL. An attacker can expose the TOPHATAPPTOKEN by directing...