PT-2024-11899 · Unknown · Weitong Mall

Name of the Vulnerable Software and Affected Versions: Weitong Mall version 1.0.0 Description: A critical issue was found in Weitong Mall. The vulnerability affects an unknown functionality of the file platform-shopsrcmainresourcescomplatformdaoOrderDao.xml. The manipulation of the argument...

PT-2024-2679 · Mediawiki +1 · Watchanalytics Extension +2

Name of the Vulnerable Software and Affected Versions: MediaWiki versions prior to 1.40.2 WatchAnalytics extension in MediaWiki affected versions not specified Description: An issue in the WatchAnalytics extension allows for XSS to occur via the Special:PageStatistics page parameter. This can...

PT-2024-1138 · Apache · Apache Solr

Name of the Vulnerable Software and Affected Versions: Apache Solr versions 9.0.0 through 9.3.0 Description: The Solr Metrics API publishes all unprotected environment variables available to each Apache Solr instance. Users are able to specify which environment variables to hide, however, the...

PT-2024-14335 · Verydows · Verydows

Name of the Vulnerable Software and Affected Versions: Verydows version 2.0 Description: The issue is related to a Cross-Site Request Forgery CSRF in the /protected/controller/backend/role controller component. This allows for unauthorized actions to be performed on behalf of a user without their...

PT-2024-11900 · Apollo · Apollo

Name of the Vulnerable Software and Affected Versions: Apollo versions 2.0.0 through 2.0.1 Description: A vulnerability was found in the Configuration Center component, affecting some unknown functionality of the file /users. This issue leads to improper authorization and can be exploited remotel...

PT-2024-10342 · Fortinet · Forticlientems

Name of the Vulnerable Software and Affected Versions: FortiClientEMS versions 7.2.0 through 7.2.4 FortiClientEMS versions prior to 7.0.10 Description: The issue is related to an improper restriction of excessive authentication attempts, which may allow an unauthenticated attacker to perform a...

PT-2024-14940 · WordPress · Export Wp Page To Static Html/Css

Name of the Vulnerable Software and Affected Versions: Export WP Page to Static HTML/CSS plugin for WordPress versions up to, and including, 2.1.9 Description: The issue is related to a missing capability check on multiple AJAX actions, allowing authenticated attackers with subscriber-level acces...

PT-2024-13762 · WordPress · Wcfm Marketplace

Name of the Vulnerable Software and Affected Versions: WCFM Marketplace plugin for WordPress versions up to, and including, 3.6.2 Description: The issue is related to Stored Cross-Site Scripting via the 'wcfm stores' shortcode due to insufficient input sanitization and output escaping on...

PT-2024-15007 · WordPress · Import/Export Users/Customers Plugin For Wordpress

Name of the Vulnerable Software and Affected Versions: Export and Import Users and Customers plugin for WordPress versions up to, and including, 2.4.8 Description: The issue is related to insufficient file type validation on the upload import file function, allowing authenticated attackers with...

PT-2024-1552

Name of the Vulnerable Software and Affected Versions Vinchin Backup & Recovery version 7.2 Description The issue is related to an authenticated remote code execution RCE vulnerability via the deleteUpdateAPK function. This vulnerability can be exploited by sending specially crafted POST requests...

PT-2024-14051 · Buffalo · Buffalo Ls210D

Name of the Vulnerable Software and Affected Versions: Buffalo LS210D version 1.78-0.03 Description: The issue allows a remote attacker to execute arbitrary code via the Firmware Update Script at "/etc/init.d/update notifications.sh". Recommendations: For Buffalo LS210D version 1.78-0.03, as a...

PT-2024-1446 · Unknown · Rapid Scada

Name of the Vulnerable Software and Affected Versions: Rapid SCADA versions prior to 5.8.4 Description: The issue is related to shortcomings in the error reporting mechanism of the SCADA system. It allows a remote attacker to gain unauthorized access to protected information by sending a speciall...

CVE-2023-51127

FLIR AX8 thermal sensor cameras up to and including 1.46.16 are vulnerable to Directory Traversal due to improper access restriction. This vulnerability allows an unauthenticated, remote attacker to obtain arbitrary sensitive file contents by uploading a specially crafted symbolic link file. NOTE...

Directory traversal

FLIR AX8 thermal sensor cameras up to and including 1.46.16 are vulnerable to Directory Traversal due to improper access restriction. This vulnerability allows an unauthenticated, remote attacker to obtain arbitrary sensitive file contents by uploading a specially crafted symbolic link file...

CVE-2023-51127

FLIR AX8 thermal sensor cameras up to and including 1.46.16 are vulnerable to Directory Traversal due to improper access restriction. This vulnerability allows an unauthenticated, remote attacker to obtain arbitrary sensitive file contents by uploading a specially crafted symbolic link file. NOTE...

PT-2024-1149 · Microsoft · Windows +1

Name of the Vulnerable Software and Affected Versions: Remote Desktop Client versions prior to 1.2.5105 Description: The issue is related to errors in synchronization when using a shared resource in the Remote Desktop Protocol RDP of the Windows operating system. This can allow a remote attacker ...

PT-2024-14888 · WordPress · Essential Real Estate

Name of the Vulnerable Software and Affected Versions: The Essential Real Estate WordPress plugin versions prior to 4.4.0 Description: The issue arises from the plugin not applying proper capability checks on its AJAX actions. This allows attackers with a subscriber account to conduct Stored XSS...

PT-2024-14387 · Flycms · Flycms

Name of the Vulnerable Software and Affected Versions: FlyCms version 1.0 Description: The issue is related to Cross-Site Request Forgery CSRF via the component system/site/webconfig updagte. This allows for unauthorized actions to be performed on behalf of a user. Recommendations: For FlyCms...

PT-2024-1580 · Totolink · Totolink N350Rt

Name of the Vulnerable Software and Affected Versions: Totolink N350RT version 9.3.5u.6139 B202012 Description: The issue is related to a stack-based buffer overflow in the loginAuth function of the /cgi-bin/cstecgi.cgi file. This can be exploited by manipulating the http host argument, allowing ...

PT-2024-1554 · Sap · Sap Marketing

Name of the Vulnerable Software and Affected Versions: SAP Marketing Contacts App version 160 Description: The issue is related to a URL redirection vulnerability in the Contacts App component of the SAP Marketing system, which can be exploited by a remote attacker to conduct a phishing attack...