PT-2024-10358 · Drupal · Migrate Tools

Name of the Vulnerable Software and Affected Versions: Migrate Tools versions 0.0.0 through 6.0.2 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability in the Migrate Tools module of the Drupal CMS system. This vulnerability can be exploited by a remote attacker to...

CVE-2023-6996

The Display custom fields in the frontend – Post and User Profile Fields plugin for WordPress is vulnerable to Code Injection via the plugin's vgdisplaydata shortcode in all versions up to, and including, 1.2.1 due to insufficient input validation and restriction on access to that shortcode. This...

PT-2024-15878 · WordPress · Instant Images – One Click Image Uploads

Name of the Vulnerable Software and Affected Versions: The Instant Images – One Click Image Uploads from Unsplash, Openverse, Pixabay and Pexels plugin for WordPress versions prior to 6.1.1 Description: The issue allows unauthorized arbitrary options update due to an insufficient check that...

PT-2024-20329 · Unknown · Mediaserver

Name of the Vulnerable Software and Affected Versions: media-server version 1.0.0 Description: The issue is related to a Use-After-Free UAF vulnerability. This vulnerability occurs when the sip subscribe remove function is used. The UAF vulnerability is a type of memory corruption bug that can...

PT-2024-15091 · WordPress · Generatepress Premium

Name of the Vulnerable Software and Affected Versions: GeneratePress Premium plugin for WordPress versions up to, and including, 2.3.2 Description: The issue is related to Stored Cross-Site Scripting via the plugin's custom meta output due to insufficient input sanitization and output escaping on...

PT-2024-15182 · WordPress · Maxbuttons

Name of the Vulnerable Software and Affected Versions: MaxButtons plugin for WordPress versions up to, and including 9.7.6 Description: The MaxButtons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes due to insufficient input sanitization and output...

PT-2024-38477 · Sourcecodester · Sourcecodester Clinics Patient Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Clinics Patient Management System version 1.0 Description: A vulnerability was found in the User Page component, specifically in the file users.php, which can lead to cross-site request forgery. The attack can be initiated...

PT-2024-15509 · WordPress · Views For Wpforms

Name of the Vulnerable Software and Affected Versions: The Views for WPForms – Display & Edit WPForms Entries on your site frontend plugin for WordPress versions up to, and including, 3.2.2 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validatio...

CVE-2023-32967

CVE-2023-32967 is an incorrect authorization vulnerability affecting several QNAP OS versions (excluding QTS 5.x and QuTS Hero). It could allow an authenticated user to bypass access restrictions over the network. Fixed in QuTScloud r5.1.5.2651+ and QTS 4.5.4.2627 build 20231225+. Guidance: upgra...

Code injection

IBM PowerSC 1.3, 2.0, and 2.1 fails to properly restrict access to a URL or resource, which may allow a remote attacker to obtain unauthorized access to application functionality and/or resources. IBM X-Force ID: 275115...

CVE-2023-50935 IBM PowerSC forced browsing

IBM PowerSC 1.3, 2.0, and 2.1 fails to properly restrict access to a URL or resource, which may allow a remote attacker to obtain unauthorized access to application functionality and/or resources. IBM X-Force ID: 275115...

CVE-2023-50935

CVE-2023-50935 affects IBM PowerSC 1.3, 2.0, and 2.1. The Red Hat/IBM bulletin confirms a forced-browsing-style issue where access to a URL/resource isn’t properly restricted, potentially allowing remote unauthorized access to application functionality and resources. Affected filesets include pow...

PT-2024-5767 · Trend Micro · Trend Micro Vpn Proxy One Pro +1

Name of the Vulnerable Software and Affected Versions: Trend Micro VPN versions 5.8.1012 and below Trend Micro VPN Proxy One Pro affected versions not specified Description: The issue is related to incorrect link resolution before accessing a file in the DEP Manager component of Trend Micro VPN...

PT-2024-20111 · Ledgersmb +3 · Ledgersmb +3

Name of the Vulnerable Software and Affected Versions: LedgerSMB versions prior to 1.10.30 LedgerSMB versions prior to 1.11.9 Description: LedgerSMB is a free web-based double-entry accounting system. When a LedgerSMB database administrator has an active session in "/setup.pl", an attacker can...

PT-2024-6574 · Cyberpower · Cyberpower Powerpanel Enterprise

Name of the Vulnerable Software and Affected Versions: CyberPower PowerPanel Enterprise versions prior to 2.8.3 Description: A sql injection vulnerability exists in the query ptask lean function within MCUDBHelper, allowing an unauthenticated remote attacker to leak sensitive information. The...

PT-2024-14174 · WordPress · Wp Booking Calendar

Name of the Vulnerable Software and Affected Versions: WP Booking Calendar versions prior to 9.7.4 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can inject...

PT-2024-14128 · Glpi +2 · Glpi +2

Name of the Vulnerable Software and Affected Versions: GLPI versions prior to 10.0.12 Description: The issue is related to LDAP injection when authentication is made against a LDAP server. This can be exploited by a remote attacker to perform LDAP injection using the authentication form. The...

PT-2024-15670 · Devolutions · Devolutions Remote Desktop Manager

Name of the Vulnerable Software and Affected Versions: Devolutions Remote Desktop Manager versions 2023.3.36 and earlier Description: A cross-site scripting XSS issue exists in the entry overview tab, allowing an attacker with access to a data source to inject a malicious script via a specially...

PT-2024-19308 · Luděk Melichar · Better Anchor Links

Name of the Vulnerable Software and Affected Versions: Luděk Melichar Better Anchor Links versions 1.7.5 and earlier Description: A Cross-Site Request Forgery CSRF issue in Luděk Melichar Better Anchor Links allows for Cross-Site Scripting XSS. Recommendations: For versions 1.7.5 and earlier,...

Mitsubishi Electric MELSEC WS Series Ethernet Interface Module

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 5.9 ATTENTION : Exploitable remotely Vendor : Mitsubishi Electric Equipment : MELSEC WS Series Vulnerability : Authentication Bypass by Capture-replay 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an unauthorized attacker to...