PT-2024-34634 · Froala · Froala Wysiwyg Editor

Name of the Vulnerable Software and Affected Versions: Froala WYSIWYG editor versions 4.3.0 and earlier Description: The issue is related to inconsistent parsing of the tag, which allows for cross-site scripting XSS in the Froala WYSIWYG editor. Recommendations: For versions 4.3.0 and earlier,...

CVE-2024-43223

Missing Authorization vulnerability in EventPrime Events EventPrime allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EventPrime: from n/a through 4.0.3.2...

PT-2024-30437 · WordPress · Icegram Collect

Name of the Vulnerable Software and Affected Versions: Icegram Collect plugin versions 1.3.14 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploitation of incorrectly configured access control security levels. Recommendations: For Icegram...

PT-2024-30469 · Fonts · Fonts

Name of the Vulnerable Software and Affected Versions: Fonts versions through 3.7.7 Description: The issue is related to a Missing Authorization vulnerability in the Fonts Plugin, which allows exploitation of incorrectly configured access control security levels. Recommendations: For versions...

PT-2024-27540 · Automattic · Newspack Blocks

Name of the Vulnerable Software and Affected Versions: Automattic Newspack Blocks versions n/a through 3.0.8 Description: The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as a 'Path Traversal' vulnerability. This vulnerability allows Path Traversa...

WordPress plugin FormCraft 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

PT-2024-30846 · Geek Code · Geek Code Lab Login As Users

Name of the Vulnerable Software and Affected Versions: Geek Code Lab Login As Users versions 1.4.3 and earlier Description: The issue is related to a Missing Authorization vulnerability, which allows exploiting incorrectly configured access control security levels. This can lead to unauthorized...

PT-2024-34581 · Draytek · Draytek Vigor3900

Name of the Vulnerable Software and Affected Versions: DrayTek Vigor3900 version 1.5.1.3 Description: The issue allows attackers to inject malicious commands into "mainfunction.cgi" and execute arbitrary commands by calling the setup cacertificate function. This enables attackers to potentially...

PT-2024-27668 · Talkatone · Talkatone

Name of the Vulnerable Software and Affected Versions: Talkatone com.talkatone.android application version 8.4.6 Description: The issue allows any installed application to place phone calls without user interaction by sending a crafted intent via the...

ABB Cylon Aspect 3.08.01 (jsonProxy.php) Unauthenticated Credentials Disclosure

Summary ASPECT is an award-winning scalable building energy management and control solution designed to allow users seamless access to their building data through standard building protocols including smart devices. Description The ABB BMS/BAS controller allows an unauthenticated attacker to...

ABB Cylon Aspect 3.08.01 (jsonProxy.php) Unauthenticated Reflected XSS

Summary ASPECT is an award-winning scalable building energy management and control solution designed to allow users seamless access to their building data through standard building protocols including smart devices. Description The ABB BMS/BAS controller suffers from an unauthenticated reflected...

PT-2024-33077 · Unknown · Jeecg-Boot

Name of the Vulnerable Software and Affected Versions: JeecgBoot version 3.7.1 Description: A SQL injection vulnerability was discovered in JeecgBoot via the component /onlDragDatasetHead/getTotalData. This issue allows for potential SQL injection attacks. The estimated number of potentially...

PT-2024-34579 · Draytek · Draytek Vigor3900

Name of the Vulnerable Software and Affected Versions: DrayTek Vigor3900 version 1.5.1.3 Description: The issue allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doCertificate function. Recommendations: For DrayTek Vigor3900 version...

AZL-51909 CVE-2024-50613 affecting package libsndfile 1.2.2-4

libsndfile through 1.2.2 has a reachable assertion, that may lead to application exit, in mpegl3encode.c mpegl3encoderclose...

PT-2024-33119 · Ax2 Pro · Ax2 Pro

Name of the Vulnerable Software and Affected Versions: AX2 Pro home router version DI 7003G-19.12.24A1V16.03.29.50 Description: A command execution issue exists, allowing an attacker to construct a malicious payload and execute commands. This can lead to obtaining shell access to the router's fil...

ABB Cylon Aspect 3.08.01 logCriticalLookup.php Unauthenticated Log Disclosure

ABB Cylon Aspect 3.08.01 logCriticalLookup.php Unauthenticated Log Disclosure Vendor: ABB Ltd. Product web page: https://www.global.abb Affected version: NEXUS Series, MATRIX-2 Series, ASPECT-Enterprise, ASPECT-Studio Firmware: =3.08.01 Summary: ASPECT is an award-winning scalable building energy...

PT-2024-39597 · Wpzest · The Easy Menu Manager | Wpzest

Name of the Vulnerable Software and Affected Versions: The Easy Menu Manager | WPZest plugin for WordPress versions up to, and including, 1.0.1 Description: The issue is related to Stored Cross-Site Scripting via SVG File uploads due to insufficient input sanitization and output escaping. This...

PT-2024-10574

Name of the Vulnerable Software and Affected Versions MainWP Dashboard – The Private WordPress Manager for Multiple Website Maintenance plugin for WordPress versions up to, and including, 3.1.2 Description The issue is related to Stored Cross-Site Scripting, which occurs due to insufficient input...

CVE-2024-21285

Vulnerability in the Oracle Banking Liquidity Management product of Oracle Financial Services Applications component: Reports. The supported version that is affected is 14.5.0.12.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

CVE-2024-21234

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Core. Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic...