CVE-2024-25830

F-logic DataCube3 v1.0 is vulnerable to Incorrect Access Control due to an improper directory access restriction. An unauthenticated, remote attacker can exploit this, by sending a URI that contains the path of the configuration file. A successful exploit could allow the attacker to extract the...

PT-2024-14241 · Unknown · Easy Paypal & Stripe Buy Now Button

Name of the Vulnerable Software and Affected Versions: Easy PayPal & Stripe Buy Now Button versions 1.8.1 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the Easy PayPal & Stripe Buy Now Button. This issue allows for malicious requests to be made on behalf of the user...

PT-2024-2053 · Ibm · Ibm Engineering Requirements Management Doors

Name of the Vulnerable Software and Affected Versions: IBM Engineering Requirements Management versions 9.7.2.7 Description: The issue exists due to insufficient protection of the web page structure, allowing a remote attacker to exploit it and potentially disclose protected information. This...

PT-2024-20244 · Likeshop · Likeshop

Name of the Vulnerable Software and Affected Versions: Likeshop versions prior to 2.5.7 Description: The issue allows attackers to run arbitrary SQL commands via the function DistributionMemberLogic::getFansLists. This enables attackers to potentially extract or modify sensitive data...

PT-2024-18421 · Unknown · Sourcecodester Online Job Portal

Name of the Vulnerable Software and Affected Versions: SourceCodester Online Job Portal version 1.0 Description: A problematic vulnerability was found in the Manage Walkin Page component, specifically in the file /Employer/ManageWalkin.php. The issue arises from the manipulation of the Job Title...

PT-2024-18428 · Sourcecodester · Sourcecodester Free/Open Source Inventory Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Free and Open Source Inventory Management System version 1.0 Description: A critical issue affects the processing of the file /app/ajax/search sales report.php, where the manipulation of the customer argument leads to SQL...

PT-2024-21152 · Unknown · Prestasalesmanager +1

Name of the Vulnerable Software and Affected Versions: PrestaShop module "Account Manager | Sales Representative & Dealers | CRM" prestasalesmanager versions up to 9.0 Description: A guest can download personal information without restriction by performing a path traversal attack in the affected...

PT-2024-2634 · Liblas · Liblas

Name of the Vulnerable Software and Affected Versions: libLAS version 1.8.1 Description: The issue is related to a memory leak vulnerability in the /libLAS/apps/ts2las.cpp component of the libLAS library, which is used for reading and writing geospatial data. This vulnerability can be exploited b...

PT-2024-15099 · Bestwebsoft · Error Log Viewer

Name of the Vulnerable Software and Affected Versions: The Error Log Viewer by BestWebSoft WordPress plugin versions prior to 1.1.3 Description: The issue allows users to read and download PHP logs without authorization, potentially exposing sensitive data. This is a Directory Listing issue...

PT-2024-21923 · Atheme · Atheme

Name of the Vulnerable Software and Affected Versions: Atheme version 7.2.12 Description: The issue is a memory leak vulnerability located in the /atheme/src/crypto-benchmark/main.c file. Recommendations: For Atheme version 7.2.12, consider restricting access to the vulnerable file...

PT-2024-15248 · WordPress · Login As User/Customer

Name of the Vulnerable Software and Affected Versions: Login as User or Customer WordPress plugin versions 3.8 and earlier Description: The issue allows users to log in as any other user on the site, potentially leading to complete administrator account takeover. It is crucial to keep WordPress...

PT-2024-21155 · Unknown · Ba Importer

Name of the Vulnerable Software and Affected Versions: Import/Update Bulk Product from any Csv/Excel File Pro ba importer versions up to 1.1.28 Description: A SQL injection issue exists in the affected module, allowing a guest to perform SQL injection. Recommendations: For versions up to 1.1.28,...

PT-2024-20455 · Vyper · Vyper

Name of the Vulnerable Software and Affected Versions: Vyper versions prior to 0.4.0 Description: The issue arises when using the built-in extract32b, start function in Vyper, a pythonic Smart Contract Language for the Ethereum virtual machine. If the start index provided has a side effect that...

PT-2024-5871 · Unknown +1 · Ruby On Rails +1

Name of the Vulnerable Software and Affected Versions: Ruby on Rails versions prior to 7.1.3.1 Ruby on Rails versions prior to 7.0.8.1 Description: There is a possible XSS vulnerability when using the translation helpers in Action Controller. Applications using translation methods like translate,...

PT-2024-19634 · Zkteco · Zkteco Zkbio Wdms

Name of the Vulnerable Software and Affected Versions: zkteco zkbio WDMS version 8.0.5 Description: An issue in the software allows an attacker to execute arbitrary code via the "/files/backup/" component. Recommendations: For zkteco zkbio WDMS version 8.0.5, consider restricting access to the...

PT-2024-18349 · Sourcecodester · Sourcecodester Simple Student Attendance System

Name of the Vulnerable Software and Affected Versions: SourceCodester Simple Student Attendance System version 1.0 Description: A vulnerability was found in the SourceCodester Simple Student Attendance System, which has been classified as problematic. This issue affects an unknown part of the fil...

PT-2024-18340 · Unknown · Codeastro House Rental Management System

Name of the Vulnerable Software and Affected Versions: CodeAstro House Rental Management System version 1.0 Description: A problematic issue was found in the User Registration Page component, allowing for cross-site scripting through the manipulation of the address argument with malicious input,...

PT-2024-1927

Name of the Vulnerable Software and Affected Versions Rack versions prior to 2.2.8.1 Rack versions prior to 3.0.9.1 Description The issue is related to a denial of service vulnerability in Rack's content type parsing, where carefully crafted content type headers can cause the media type parser to...

PT-2024-14104 · Snakeyaml +1 · Snakeyaml +1

Name of the Vulnerable Software and Affected Versions: Hertzbeat versions prior to 1.4.1 Description: Hertzbeat is a real-time monitoring system. At the interface of "/define/yml", SnakeYAML is used as a parser to parse yml content, but no security configuration is used, resulting in a YAML...

PT-2024-20571 · John Tendik · Jtrt Responsive Tables

Name of the Vulnerable Software and Affected Versions: JTRT Responsive Tables versions through 4.1.9 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability in John Tendik JTRT Responsive Tables. This type of vulnerability allows an attacker to trick a user into performing...