PT-2024-01: OS Command Injection in PT Network Attack Discovery (PT NAD)

The vulnerability was identified in PT NAD affecting versions 12.0.x to 12.0.577. The vulnerability can be exploited by an attacker with network access to PT NAD to remotely execute OS commands as a superuser. Ability of exploitation depends on the configuration. Authorization is not required for...

CVE-2024-3080

creationtimestamp| type| source ---|---|--- 2024-06-16 16:57:36+00:00| seen| https://t.me/HackingInsights/2652 2024-06-17 14:11:30+00:00| seen| https://t.me/truesecator/5862 2024-06-17 17:01:54+00:00| seen| Telegram/WdjBp7gTBnVFtFqofM1fa2AktY3uosjlnVDlOTAP1sqRthE 2024-06-17 18:25:35+00:00|...

PT-2024-26: Improper Authorization leads to web administration interface access in UniPORT E-slip

The vulnerability was identified in UniPORT E-slip 1.4.0.0 and lower. The discovered vulnerability is caused by insufficient input data validation. It can be exploited by an attacker to gain access to the application administration web-interface. The vulnerability is unexploitable in versions...

PT-2024-21: OS Command Injection in Pandora FMS

The vulnerability was identified in Pandora FMS versions 700 to 776. The discovered vulnerability can be exploited by an attacker to inject commands into the operating system. The vulnerability is a part of the chain that leads to remote code execution PT-2024-20, CVE-2024-35305. Vulnerability...

CVE-2021-38146

creationtimestamp| type| source ---|---|--- 2024-06-07 17:11:41+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2021/CVE-2021-38146.yaml...

PT-2024-58: Insecure password storage in Yealink Meeting Server (YMS)

The vulnerability was identified in Yealink Meeting Server YMS, versions V26.0.0.67. The discovered vulnerability allows an attacker to obtain static key data, allowing user passwords to be decrypted. Vulnerability status: Confirmed by vendor Date of vulnerability remediation: 06.06.2024...

Security Advisory May 2024

Vulnerabilities have been discovered in the following Ivanti solutions and fixes are available now. Please review the knowledge base article for the associated solution for detailed information on how to remediate the weaknesses. Update October 1 : Ivanti has confirmed exploitation of...

CVE-2024-30163

creationtimestamp| type| source ---|---|--- 2024-05-19 15:31:55+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/10529 2025-05-28 07:25:12+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2024/CVE-2024-30163.yaml 2025-05-31...

CVE-2023-38301

An issue was discovered in a third-party component related to vendor.gsm.serial, shipped on devices from multiple device manufacturers. Various software builds for the BLU View 2, Boost Mobile Celero 5G, Sharp Rouvo V, Motorola Moto G Pure, Motorola Moto G Power, T-Mobile Revvl 6 Pro 5G, and...

CVE-2023-51409

creationtimestamp| type| source ---|---|--- 2024-04-14 01:04:19+00:00| seen| https://t.me/arpsyndicate/4670 2024-04-29 14:28:35+00:00| published-proof-of-concept| https://t.me/CNArsenal/2400 2025-05-21 18:35:27+00:00| confirmed|...

no-maam.at Cross Site Scripting vulnerability OBB-3915981

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

orrleecoagh.com Cross Site Scripting vulnerability OBB-3913639

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

h30store.com Cross Site Scripting vulnerability OBB-3905631

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

great-earth.net Cross Site Scripting vulnerability OBB-3885966

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2024-1603

CVE-2024-1603 affects paddlepaddle/paddle v2.6.0, enabling a read of arbitrary files via paddle.vision.ops.read_file. The issue arises from how the read_file interface handles input validation, per multiple sources in the connected documents. Impact is High for confidentiality, with no reported i...

SUSE CVE-2021-47129

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftct: skip expectations for confirmed conntrack nftctexpectobjeval calls nfctextadd for a confirmed conntrack entry. However, nfctextadd can only be called for !nfctisconfirmed. 1825.349056 WARNING: CPU: 0 PID: 1279 a...

CVE-2021-47129 netfilter: nft_ct: skip expectations for confirmed conntrack

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftct: skip expectations for confirmed conntrack nftctexpectobjeval calls nfctextadd for a confirmed conntrack entry. However, nfctextadd can only be called for !nfctisconfirmed. 1825.349056 WARNING: CPU: 0 PID: 1279 a...

CVE-2024-0801

creationtimestamp| type| source ---|---|--- 2024-03-13 20:23:06+00:00| seen| https://t.me/ctinow/207117 2024-03-13 20:27:46+00:00| seen| https://t.me/ctinow/207123 2024-05-14 18:10:04+00:00| published-proof-of-concept| https://t.me/truesecator/5733 2025-11-05 16:44:27+00:00| confirmed|...

CVE-2024-0815

CVE-2024-0815 affects paddlepaddle/paddle 2.6.0 and is caused by a command-injection in paddle.utils.download._wget_download (bypass filter). The vulnerability description in multiple sources confirms the issue is triggered via OS commands, enabling potential local exploitation. No explicit explo...

CVE-2024-0817

CVE-2024-0817 concerns PaddlePaddle 2.6.0's IrGraph.draw. Connected sources provide a concrete technical detail: the vulnerability arises from lack of proper input validation on user-supplied data (save_path and name parameters), which are directly incorporated into a subprocess call, enabling co...