PT-2024-5838 · Calibre · Calibre

Name of the Vulnerable Software and Affected Versions: Calibre versions prior to 7.14.0 Description: The issue is related to path traversal in the software, allowing unauthenticated attackers to achieve arbitrary file read. This is due to incorrect restriction of the directory path name with...

PT-2024-6476

Name of the Vulnerable Software and Affected Versions Apache Tomcat Connectors versions 1.2.9-beta through 1.2.49 Description The issue allows local users to view and modify shared memory containing mod jk configuration, which may lead to information disclosure and/or denial of service. This issu...

PT-2024-5829 · Mailcow · Mailcow

Name of the Vulnerable Software and Affected Versions: mailcow: dockerized versions prior to 2024-07 Description: The issue is related to the Relay Hosts configuration, where an authenticated admin user can inject a JavaScript payload. This payload is executed when the configuration page is viewe...

PT-2024-34418 · WordPress · Wp-Emember

Name of the Vulnerable Software and Affected Versions: wp-eMember WordPress plugin versions prior to 10.7.0 Description: The issue concerns a lack of CSRF check in some areas and missing sanitization as well as escaping. This could allow attackers to make logged-in admins add Stored XSS payloads...

PT-2024-25533 · Cosy+ · Cosy+

Name of the Vulnerable Software and Affected Versions: Cosy+ versions 21.x below 21.2s10 Cosy+ versions 22.x below 22.1s3 Description: The issue is related to code injection due to improper parameter blacklisting. This can be exploited with local network access. The estimated number of potentiall...

PT-2024-29437 · Feripro · Feripro

Name of the Vulnerable Software and Affected Versions: Feripro versions prior to 2.2.4 Description: The issue concerns a Cross Site Scripting XSS vulnerability. It can be exploited via the "/admin/programm//zuordnung/veranstaltungen/" endpoint through the school input field. Recommendations: For...

PT-2024-38303 · Sourcecodester · Sourcecodester Simple Realtime Quiz System

Name of the Vulnerable Software and Affected Versions: SourceCodester Simple Realtime Quiz System version 1.0 Description: A critical issue affects some unknown functionality of the file /quiz board.php. The manipulation of the quiz argument leads to SQL injection. The attack can be launched...

PT-2024-38253 · Sourcecodester · Sourcecodester Establishment Billing Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Establishment Billing Management System version 1.0 Description: A critical issue has been found in the system, affecting an unknown functionality of the file /manage billing.php. The manipulation of the id argument leads to SQ...

PT-2024-28857 · Beego · Beego

Name of the Vulnerable Software and Affected Versions: beego versions 2.2.0 and earlier Description: An issue in beego allows a remote attacker to escalate privileges via the sendMail function located in the beego/core/logs/smtp.go file. Recommendations: For beego versions 2.2.0 and earlier,...

PT-2024-38245 · Langflow · Langflow

Name of the Vulnerable Software and Affected Versions: Langflow versions prior to 1.0.13 Description: The issue allows a remote and low privileged attacker to gain super admin privileges by performing a mass assignment request on the "/api/v1/users" endpoint. Recommendations: For Langflow version...

PT-2024-37806

Name of the Vulnerable Software and Affected Versions Mikafon MA7 versions 3.0 through 3.0 Description The issue is related to an SQL Injection vulnerability, which is caused by the improper neutralization of special elements used in an SQL command. This allows for SQL Injection, potentially...

PT-2024-8654 · Wowza · Wowza Streaming Engine

Name of the Vulnerable Software and Affected Versions: Wowza Streaming Engine versions prior to 4.9.1 Description: The issue is related to a path traversal vulnerability in the Manager component of Wowza Streaming Engine. This vulnerability allows an administrator user to delete any directory on...

PT-2024-27998 · Unknown · Matrix Tafnit

Name of the Vulnerable Software and Affected Versions: Matrix Tafnit version 8 Description: The issue concerns files or directories being accessible to external parties, which is classified as CWE-552. Recommendations: For Matrix Tafnit version 8, consider restricting access to sensitive files an...

PT-2024-38184 · Sourcecodester · Sourcecodester Lot Reservation Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Lot Reservation Management System version 1.0 Description: A critical issue was found in the system, affecting some unknown functionality of the file /lot details.php. The manipulation of the id argument leads to SQL injection...

PT-2024-5666 · Tenda · Tenda I22

Name of the Vulnerable Software and Affected Versions: Tenda i22 version 1.0.0.34687 Description: A critical issue was found in the formApPortalPhoneAuth function of the /goform/apPortalPhoneAuth file. The manipulation of the data argument leads to a buffer overflow. This can be exploited remotel...

CVE-2024-40783

The issue was addressed with improved restriction of data container access. This issue is fixed in macOS Monterey 12.7.6, macOS Sonoma 14.6, macOS Ventura 13.6.8. A malicious application may be able to bypass Privacy preferences...

CVE-2024-40822

This issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 16.7.9 and iPadOS 16.7.9, iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, watchOS 10.6. An attacker with physical access to a device may be able to access contacts from the lock screen...

CVE-2023-42925

CVE-2023-42925 affects Apple platforms (iOS, iPadOS, macOS Sonoma) and concerns an app potentially accessing Notes attachments due to insufficient restriction of data container access. The issue is addressed in iOS 17, iPadOS 17, and macOS Sonoma 14. Connected sources confirm the vulnerability de...

Magento LTS vulnerable to stored Cross-site Scripting (XSS) in admin system configs

Impact This XSS vulnerability is about the system configs design/header/welcome design/header/logosrc design/header/logosrcsmall design/header/logoalt They are intended to enable admins to set a text in the two cases, and to define an image url for the other two cases. But because of previously...

PT-2024-29474 · Unknown · Neuq Board

Name of the Vulnerable Software and Affected Versions: NEUQ board version 1.0 Description: A Buffer Overflow issue in the password.h component allows a remote attacker to cause a denial of service. Recommendations: For NEUQ board version 1.0, consider restricting access to the password.h componen...