PT-2024-30563 · Lf Edge · Lf Edge Ekuiper

Name of the Vulnerable Software and Affected Versions: LF Edge eKuiper versions prior to 1.14.2 Description: A SQL Injection vulnerability exists in the sqlKvStore of LF Edge eKuiper, allowing the execution of malicious SQL queries via the Get method. This issue affects various handlers, includin...

Rakuten Ichiba 安全漏洞

Rakuten Ichiba is an online shopping APP from Rakuten, a Japanese company. A security vulnerability exists in Rakuten Ichiba that stems from a failure to properly restrict access to features that use custom URL schemes, increasing the risk of users being subject to phishing attacks...

PT-2024-38690 · Zzcms · Zzcms

Name of the Vulnerable Software and Affected Versions: ZZCMS version 2023 Description: A critical vulnerability was found in ZZCMS 2023, affecting unknown code in the file /I/list.php. The manipulation of the skin argument leads to path traversal. This issue can be exploited remotely. The exploit...

PT-2024-8634 · Moodle +2 · Moodle +2

Name of the Vulnerable Software and Affected Versions: Moodle versions prior to 4.4.2 Description: A flaw was found in Moodle where sensitive secrets and keys are not excluded from the export of site administration presets, potentially leading to unintentional leakage if shared with a third party...

PT-2024-30476 · Unknown · Wp Socio Wp Telegram Widget/Join Link

Name of the Vulnerable Software and Affected Versions: WP Socio WP Telegram Widget and Join Link versions 2.1.27 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS...

Security Bulletin: The IBM QRadar SIEM Amazon Web Services protocol is vulnerable to access restriction bypass and sensitive information exposure (CVE-2020-8908, CVE-2023-2976)

Summary Google Guava is used by IBM QRadar SIEM Amazon Web Services protocol, and it has known vulnerabilities. The issues have been addressed in an update. Vulnerability Details CVEID:CVE-2020-8908 DESCRIPTION: Guava could allow a remote authenticated attacker to bypass security restrictions,...

PT-2024-7655 · Hashicorp +1 · Hashicorp Vault +2

Name of the Vulnerable Software and Affected Versions: JetBrains TeamCity versions prior to 2024.07.1 Description: The issue exists due to inadequate protection of the web page structure in the HashiCorp Vault plugin of the JetBrains TeamCity CI/CD system. Exploitation of this issue may allow a...

PT-2024-30102 · Huizhi · Huizhi

Name of the Vulnerable Software and Affected Versions: Huizhi enterprise resource management system versions 1.0 and earlier Description: The issue allows a local attacker to obtain sensitive information via the "/nssys/common/filehandle.aspx" component. A local attacker can exploit this to gain...

PT-2024-38052 · WordPress · Elementskit Pro

Name of the Vulnerable Software and Affected Versions: ElementsKit Pro plugin for WordPress versions up to, and including, 3.6.6 Description: The issue allows authenticated attackers with Contributor-level permissions and above to extract sensitive data, including private, future, and draft posts...

PT-2024-5858

Name of the Vulnerable Software and Affected Versions NGINX Open Source and NGINX Plus versions prior to 1.26.2 NGINX Open Source and NGINX Plus versions prior to 1.27.1 Description The issue is related to a buffer overread vulnerability in the ngx http mp4 module, which might allow an attacker t...

PT-2024-5695 · Microsoft · Kernel Streaming Wow Thunk Service Driver +1

Name of the Vulnerable Software and Affected Versions: Windows Kernel Streaming WOW Thunk Service Driver versions prior to the fixed version Description: The issue is related to a buffer overflow in the dynamic memory of the Kernel Streaming WOW Thunk Service Driver, which can be exploited to...

PT-2024-29624 · Unknown · Sinec Traffic Analyzer

Name of the Vulnerable Software and Affected Versions: SINEC Traffic Analyzer versions prior to V2.0 Description: A vulnerability has been identified in the SINEC Traffic Analyzer where the affected application does not properly enforce restrictions on excessive authentication attempts. This coul...

PT-2024-7652 · Intel · Intel Cip

Name of the Vulnerable Software and Affected Versions: IntelR CIP software versions prior to 2.4.10717 Description: The issue is related to improper access control in IntelR CIP software, which may allow an authenticated user to potentially enable denial of service via local access. This is also...

PT-2024-30316 · WordPress · Woocommerce Product Table Lite

Name of the Vulnerable Software and Affected Versions: WooCommerce Product Table Lite versions 3.5.1 and earlier Description: The issue is related to an Improper Control of Generation of Code 'Code Injection' vulnerability in WooCommerce Product Table Lite, allowing Code Injection. Recommendation...

PT-2024-6010 · Adobe · Commerce

Name of the Vulnerable Software and Affected Versions: Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier Description: The issue is related to an Unrestricted Upload of File with Dangerous Type, which could result in arbitrary code execution by an attacker. An attacker cou...

PT-2024-27836 · Themesphere · Themesphere Smartmag

Name of the Vulnerable Software and Affected Versions: ThemeSphere SmartMag versions prior to 9.3.0 Description: The issue is related to Exposure of Sensitive Information to an Unauthorized Actor and Missing Authorization vulnerability. It allows excavation and accessing functionality not properl...

PT-2024-38479 · WordPress · Opal Membership

Name of the Vulnerable Software and Affected Versions: Opal Membership plugin for WordPress versions up to and including 1.2.4 Description: The issue allows authenticated attackers with subscriber-level access and above to view private notes that should be restricted to administrators. This is...

PT-2024-38472 · Sourcecodester · Sourcecodester Kortex Lite Advocate Office Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Kortex Lite Advocate Office Management System version 1.0 Description: A critical issue has been found in the processing of the file delete register.php, where the manipulation of the case register id argument leads to SQL...

CVE-2024-7540

oFono AT CMGL Command Uninitialized Variable Information Disclosure Vulnerability. This vulnerability allows local attackers to disclose sensitive information on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this...

PT-2024-25606 · Paypal · Paypal

Name of the Vulnerable Software and Affected Versions: PayPal, Credit Card and Debit Card Payment version 1.0 Description: The issue allows an attacker to exploit a SQL injection vulnerability by sending a specially crafted query to the server. This can lead to the retrieval of all information...