PT-2024-34106 · WordPress · Cm Wordpress Search/Replace Plugin

Name of the Vulnerable Software and Affected Versions: CM WordPress Search And Replace Plugin versions prior to 1.3.9 Description: The issue concerns the lack of CSRF checks in certain areas of the plugin, which could allow attackers to make logged-in users perform unwanted actions via CSRF...

PT-2024-34150 · WordPress · Sully

Name of the Vulnerable Software and Affected Versions: SULly WordPress plugin versions prior to 4.3.1 Description: The issue concerns a lack of CSRF checks in certain areas, potentially allowing attackers to trick logged-in users into performing unintended actions through CSRF attacks...

CVE-2024-40902

In the Linux kernel, the following vulnerability has been resolved: jfs: xattr: fix buffer overflow for invalid xattr When an xattr size is not what is expected, it is printed out to the kernel log in hex format as a form of debugging. But when that xattr size is bigger than the expected size,...

PT-2024-37236 · WordPress · User Feedback – Create Interactive Feedback Form

Name of the Vulnerable Software and Affected Versions: User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds plugin for WordPress versions up to, and including, 1.0.15 Description: The issue arises from insufficient input sanitization and output escaping, allowing...

PT-2024-28915 · Publiccms · Publiccms

Name of the Vulnerable Software and Affected Versions: Public CMS version 4.0.202302.e Description: The issue is related to an arbitrary file upload vulnerability in the /admin/cmsTemplate/savePlaceMetaData component. This allows attackers to execute arbitrary code by uploading a crafted file...

PT-2024-37329 · 10Web · Sliderby10Web Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: The Slider by 10Web WordPress plugin version 1.2.55 and earlier Description: The issue concerns the Slider by 10Web WordPress plugin, which does not properly sanitise and escape some of its Slide options. This could allow authenticated users...

CVE-2024-22018

A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used. This flaw arises from an inadequate permission model that fails to restrict file stats through the fs.lstat API. As a result, malicious actors can retrieve...

CVE-2024-22018

A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used. This flaw arises from an inadequate permission model that fails to restrict file stats through the fs.lstat API. As a result, malicious actors can retrieve...

CVE-2024-22018

A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-read flag is used. This flaw arises from an inadequate permission model that fails to restrict file stats through the fs.lstat API. As a result, malicious actors can retrieve...

CVE-2024-39900 OpenSearch Dashboards Reports does not properly restrict access to private tenant resources

OpenSearch Dashboards Reports allows ‘Report Owner’ export and share reports from OpenSearch Dashboards. An issue in the OpenSearch reporting plugin allows unintended access to private tenant resources like notebooks. The system did not properly check if the user was the resource author when...

CVE-2024-39900 OpenSearch Dashboards Reports does not properly restrict access to private tenant resources

OpenSearch Dashboards Reports allows ‘Report Owner’ export and share reports from OpenSearch Dashboards. An issue in the OpenSearch reporting plugin allows unintended access to private tenant resources like notebooks. The system did not properly check if the user was the resource author when...

CVE-2024-39901 OpenSearch Observability does not properly restrict access to private tenant resources

OpenSearch Observability is collection of plugins and applications that visualize data-driven events. An issue in the OpenSearch observability plugins allows unintended access to private tenant resources like notebooks. The system did not properly check if the user was the resource author when...

CVE-2024-39901 OpenSearch Observability does not properly restrict access to private tenant resources

OpenSearch Observability is collection of plugins and applications that visualize data-driven events. An issue in the OpenSearch observability plugins allows unintended access to private tenant resources like notebooks. The system did not properly check if the user was the resource author when...

Access Restriction Bypass

Overview Affected versions of this package are vulnerable to Access Restriction Bypass by embedding non-network imports in data URLs. Exploiting this vulnerability allows an attacker to execute arbitrary code, compromising system security. Remediation Upgrade nodejs to version 20.16.0 or higher...

PT-2024-7956 · Siemens · Sinema Remote Connect Server

Name of the Vulnerable Software and Affected Versions: SINEMA Remote Connect Server versions prior to V3.2 SP1 Description: The issue is related to improper authorization. It allows a remote attacker to gain unauthorized access to participant groups they should not have access to. The vulnerabili...

PT-2024-29014 · Netbox · Netbox

Name of the Vulnerable Software and Affected Versions: netbox version 4.0.3 Description: A cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter at "/dcim/power-outlets/add" endpoint. Recommendations: For...

PT-2024-27801 · Unknown · Itsourcecode Billing System

Name of the Vulnerable Software and Affected Versions: Itsourcecode Billing System version 1.0 Description: The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the username parameter in the "process.php" file. Recommendations: For Itsourcecode Billing System...

PT-2024-5133 · Zoom · Zoom Workplace Desktop App

Name of the Vulnerable Software and Affected Versions: Zoom Workplace Desktop App for macOS versions prior to 6.0.10 Description: The issue is related to an uncontrolled search path element in the installer, which may allow an authenticated user to conduct a denial of service via local access. Th...

PT-2024-8348 · Aveva · Aveva Reports For Operations

Name of the Vulnerable Software and Affected Versions: Dream Report versions affected versions not specified AVEVA Reports for Operations versions affected versions not specified Description: The issue is related to errors in processing relative path to directory, which could allow an attacker to...

PT-2024-25414 · Siemens · Simcenter Femap

Name of the Vulnerable Software and Affected Versions: Simcenter Femap versions prior to V2406 Description: A vulnerability has been identified in the affected applications, which contain an out of bounds read past the end of an allocated structure while parsing specially crafted BMP files. This...