PT-2024-1642 · Splunk · Splunk Add-On Builder

Name of the Vulnerable Software and Affected Versions: Splunk Add-on Builder versions prior to 4.1.4 Description: The issue is related to improper handling of log output, allowing a remote attacker to write arbitrary information to internal log files. This can lead to the exposure of sensitive...

PT-2024-1408 · Honeywell · Honeywell Experion Controledge Virtualuoc +1

Name of the Vulnerable Software and Affected Versions: Honeywell Experion ControlEdge VirtualUOC and ControlEdge UOC affected versions not specified Description: The issue is related to the use of dangerous methods or functions in the Configuration Handler component of the Honeywell Experion...

PT-2024-40900 · Crateio · Cratedb

Name of the Vulnerable Software and Affected Versions: CrateDB version 5.5.1 Description: The issue concerns an authentication bypass in the Admin UI component. It can be exploited by setting the X-Real-IP request header to a specific value, allowing access to the Admin UI using the default user...

PT-2024-12033 · WordPress · Userpro

Name of the Vulnerable Software and Affected Versions: UserPro plugin for WordPress versions up to, and including, 5.1.5 Description: The issue is related to Stored Cross-Site Scripting via the 'userpro' shortcode due to insufficient input sanitization and output escaping on user-supplied...

PT-2024-20363 · Totolink · Totolink A3300R

Name of the Vulnerable Software and Affected Versions: TOTOLINK A3300R version 17.0.0cu.557 B20221024 Description: The issue is related to a command injection vulnerability. This vulnerability can be exploited via the port or enable parameters in the setRemoteCfg function. Recommendations: For...

PT-2024-19485 · Lightcms · Lightcms

Name of the Vulnerable Software and Affected Versions: LightCMS version 2.0 Description: The issue is related to Cross Site Scripting XSS in the Content Management - Articles field. Recommendations: For version 2.0, update to a newer version that contains a fix for this issue, if available. If no...

PT-2024-13247 · Opentext · Opentext Appbuilder

Name of the Vulnerable Software and Affected Versions: OpenText AppBuilder versions 21.2 through 23.2 Description: The issue is related to improper input validation in the OpenText AppBuilder's Scheduler functionality, which allows authenticated users to inject arbitrary operating system commands...

PT-2024-20288 · Sourcecodester · Sourcecodester Product Inventory With Export To Excel

Name of the Vulnerable Software and Affected Versions: Sourcecodester Product Inventory with Export to Excel version 1.0 Description: The issue concerns cross-site scripting XSS attacks. Specifically, the Product Name and Product Code in the 'Add Product' section are vulnerable to such attacks...

PT-2024-14951 · WordPress · Custom User Css

Name of the Vulnerable Software and Affected Versions: Custom User CSS WordPress plugin versions 0.2 and earlier Description: The issue is related to the lack of a CSRF check when updating settings, which could allow attackers to make a logged-in admin change them via a CSRF attack. This could...

PT-2024-20290 · Unknown · Sourcecodester Login System With Email Verification

Name of the Vulnerable Software and Affected Versions: Sourcecodester Login System with Email Verification version 1.0 Description: The issue allows SQL Injection via the user parameter. This could potentially be exploited to extract or modify sensitive data. There is no information provided abou...

PT-2024-1399 · D Link · D-Link Dir-816 A2

Name of the Vulnerable Software and Affected Versions: D-Link DIR-816 A2 version 1.10CNB04 Description: A critical vulnerability has been found in the Web Interface component of the D-Link DIR-816 A2, specifically in the /goform/setDeviceSettings file. The manipulation of the statuscheckpppoeuser...

PT-2024-20159 · Cups Easy · Cups Easy

Name of the Vulnerable Software and Affected Versions: Cups Easy Purchase & Inventory version 1.0 Description: A vulnerability has been reported in Cups Easy Purchase & Inventory whereby user-controlled inputs are not sufficiently encoded, resulting in a Cross-Site Scripting XSS vulnerability via...

PT-2024-1831 · Vitalpbx · Vitalpbx

Name of the Vulnerable Software and Affected Versions: VitalPBX versions 3.2.4 through 3.2.5 Description: The issue is related to insufficient protection of service data when processing a script from the /var/lib/vitalpbx directory, allowing an attacker to execute arbitrary code via a crafted...

PT-2024-13165 · Line · Ailand Clinic Mini-App

Name of the Vulnerable Software and Affected Versions: Ailand clinic mini-app on Line version 13.6.1 Description: An issue in the Ailand clinic mini-app on Line allows attackers to send crafted malicious notifications via leakage of the channel access token. This leakage enables attackers to...

CVE-2024-23206

An access issue was addressed with improved access restrictions. This issue is fixed in Safari 17.3, iOS 16.7.5 and iPadOS 16.7.5, iOS 17.3 and iPadOS 17.3, macOS Sonoma 14.3, tvOS 17.3, watchOS 10.3. A maliciously crafted webpage may be able to fingerprint the user...

Design/Logic Flaw

An access issue was addressed with improved access restrictions. This issue is fixed in watchOS 10.3, tvOS 17.3, iOS 17.3 and iPadOS 17.3, macOS Sonoma 14.3, iOS 16.7.5 and iPadOS 16.7.5, Safari 17.3. A maliciously crafted webpage may be able to fingerprint the user...

PT-2024-14072 · Webkul · Webkul Bundle Product

Name of the Vulnerable Software and Affected Versions: Webkul Bundle Product version 6.0.1 Description: A SQL injection issue allows a remote attacker to execute arbitrary code via the id product parameters in the UpdateProductQuantity function. Recommendations: For Webkul Bundle Product version...

PT-2024-19447 · Beetl-Bbs · Beetl-Bbs

Name of the Vulnerable Software and Affected Versions: beetl-bbs version 2.0 Description: The issue is related to a Cross Site Scripting XSS flaw that allows attackers to execute arbitrary code. This is achieved by exploiting the keyword parameter in the "/index" API endpoint. Recommendations: Fo...

PT-2024-19602 · Dedecms · Dedecms

Name of the Vulnerable Software and Affected Versions: DedeCMS version 5.7.112 Description: The issue is related to a File Upload vulnerability. This vulnerability can be exploited via the "uploads/dede/module upload.php" endpoint. Recommendations: For DedeCMS version 5.7.112, consider restrictin...

PT-2024-15221 · WordPress · Eventon-Rsvp

Name of the Vulnerable Software and Affected Versions: EventON-RSVP WordPress plugin versions prior to 2.9.5 Description: The issue is related to a Reflected Cross-Site Scripting problem, where some parameters are not properly sanitized and escaped before being outputted back in the page. This...