PT-2024-20720 · Ibm · Ibm Jazz Reporting Service

Name of the Vulnerable Software and Affected Versions: IBM Jazz Reporting Service version 7.0.3 Description: The issue concerns the storage of user credentials in plain clear text, which can be accessed by an admin user. Recommendations: For IBM Jazz Reporting Service version 7.0.3, consider...

PT-2024-4310 · Ibm · Db2 Connect Server +1

Name of the Vulnerable Software and Affected Versions: IBM Db2 for Linux, UNIX and Windows includes DB2 Connect Server versions 10.5, 11.1, and 11.5 Description: The issue is related to the management of database systems, specifically IBM DB2 and IBM DB2 Connect Server, which are vulnerable to...

PT-2024-26939 · Apache · Apache Submarine Server Core

Name of the Vulnerable Software and Affected Versions: Apache Submarine Server Core affected versions not specified Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This affects products that are no long...

PT-2024-13747 · Unknown · Vektah Gqlparser

Name of the Vulnerable Software and Affected Versions: vektah gqlparser version 2.5.10 Description: An issue in the vektah gqlparser open-source-library allows a remote attacker to cause a denial of service via a crafted script to the parserDirectives function. This issue can be exploited to...

PT-2024-5957 · Adobe · Experience Manager

Name of the Vulnerable Software and Affected Versions: Adobe Experience Manager versions 6.5.20 and earlier Description: The issue is related to a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious...

PT-2024-5956 · Adobe · Experience Manager

Name of the Vulnerable Software and Affected Versions: Adobe Experience Manager versions 6.5.20 and earlier Description: The issue is related to a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious...

CVE-2023-40389

The issue was addressed with improved restriction of data container access. This issue is fixed in macOS Ventura 13.6.5, macOS Monterey 12.7.4. An app may be able to access sensitive user data...

PT-2024-17525

Name of the Vulnerable Software and Affected Versions Eurosoft Przychodnia versions prior to 20240417.001 Description The issue is related to the use of a hard-coded password for the patients' database, allowing an attacker to retrieve sensitive data. This password is uniform across all Eurosoft...

PT-2024-27051

Name of the Vulnerable Software and Affected Versions: nukeviet versions 4.5 and earlier nukeviet-egov versions 1.2.02 and earlier Description: The issue allows for arbitrary code execution via the "/admin/extensions/upload.php" component. Recommendations: For nukeviet versions 4.5 and earlier,...

PT-2024-5802

Name of the Vulnerable Software and Affected Versions FreeIPA versions prior to 4.12.2 Description A vulnerability was found in FreeIPA where a Kerberos TGS-REQ is encrypted using the client's session key. However, the ticket it contains is encrypted using the target principal key directly. For...

PT-2024-4353 · Google · Google Updator +1

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 1.3.36.351 Description: The issue is related to an inappropriate implementation in Google Updator, which allows a local attacker to perform privilege escalation via a malicious file. The severity of this issue ...

PT-2024-31921 · WordPress · Arforms

Name of the Vulnerable Software and Affected Versions: ARForms - Premium WordPress Form Builder Plugin version prior to 6.6 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This is possible because some settings are not properly...

CVE-2024-3234 Path Traversal in gaizhenbiao/chuanhuchatgpt

The gaizhenbiao/chuanhuchatgpt application is vulnerable to a path traversal attack due to its use of an outdated gradio component. The application is designed to restrict user access to resources within the webassets folder. However, the outdated version of gradio it employs is susceptible to pa...

CVE-2024-3234 Path Traversal in gaizhenbiao/chuanhuchatgpt

The gaizhenbiao/chuanhuchatgpt application is vulnerable to a path traversal attack due to its use of an outdated gradio component. The application is designed to restrict user access to resources within the webassets folder. However, the outdated version of gradio it employs is susceptible to pa...

CVE-2024-3234 Path Traversal in gaizhenbiao/chuanhuchatgpt

The gaizhenbiao/chuanhuchatgpt application is vulnerable to a path traversal attack due to its use of an outdated gradio component. The application is designed to restrict user access to resources within the webassets folder. However, the outdated version of gradio it employs is susceptible to pa...

PT-2024-26781 · WordPress · The Quiz/Survey Master

Name of the Vulnerable Software and Affected Versions: The Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress versions up to, and including, 9.0.1 Description: The issue is related to SQL Injection via the question id parameter due to insufficient escaping on the user-suppli...

PT-2024-30411

Name of the Vulnerable Software and Affected Versions gradio-app/gradio version 4.21.0 Description A Server-Side Request Forgery SSRF vulnerability exists, specifically within the "/queue/join" endpoint and the save url to cache function. The vulnerability arises when the path value, obtained fro...

PT-2024-18388 · Autogpt · Autogpt

Name of the Vulnerable Software and Affected Versions: AutoGPT versions v0.5.0 through v5.1.0 Description: The issue arises from the application's method of validating shell commands against an allowlist or denylist, where it only checks the first word of the command. This allows an attacker to...

PT-2024-8587 · Ivanti · Ivanti Endpoint Manager

Name of the Vulnerable Software and Affected Versions: Ivanti Endpoint Manager versions prior to 2024 November Security Update Ivanti Endpoint Manager versions prior to 2022 SU6 November Security Update Description: The issue is related to SQL injection in Ivanti Endpoint Manager, which allows a...

PT-2024-3954

Name of the Vulnerable Software and Affected Versions Fortinet FortiWebManager versions 6.0.2, 6.2.3 through 6.2.4, 6.3.0, 7.0.0 through 7.0.4, and 7.2.0 Description The issue is related to an improper authorization in the HTTP Request Handler component of Fortinet FortiWebManager, which can be...