PT-2024-39453

Name of the Vulnerable Software and Affected Versions Olgu Computer Systems e-Belediye versions prior to 2.0.642 Description The issue allows external control of file name or path due to incorrect permission assignment for critical resources, enabling manipulation of web input to file system call...

Missing Authentication For Critical Function

Mautic is vulnerable to Missing Authentication for Critical Function. The vulnerability is due to insufficient protection of the upgrade script, which could lead to exploitation if Mautic is installed in a specific, vulnerable configuration...

PT-2024-37209 · WordPress · Tweaker5

Name of the Vulnerable Software and Affected Versions: Tweaker5 theme for WordPress versions up to, and including, 1.2 Description: The issue is a Stored Cross-Site Scripting vulnerability due to insufficient input sanitization and output escaping. This allows authenticated attackers with...

CVE-2024-6979

CVE-2024-6979 affects Axis OS, where a broken access control could allow less-privileged operator- and/or viewer-accounts to gain higher privileges. The issue is described as requiring complex steps and social engineering to trigger administrator configurations, with exploitation risk considered ...

CVE-2024-6979

Amin Aliakbari, member of the AXIS OS Bug Bounty Program, has found a broken access control which would lead to less-privileged operator- and/or viewer accounts having more privileges than designed. The risk of exploitation is very low as it requires complex steps to execute, including knowing of...

PT-2024-9674 · Synology · Synology Router Manager

Name of the Vulnerable Software and Affected Versions: Synology Router Manager versions prior to 1.3.1-9346-10 Description: The issue is related to the DDNS Record component of Synology Router Manager, where improper neutralization of input during web page generation allows for Cross-site Scripti...

PT-2024-6328

Name of the Vulnerable Software and Affected Versions Zimbra Collaboration Suite versions prior to 8.8.15 Patch 46 Zimbra Collaboration Suite versions prior to 9.0.0 Patch 41 Zimbra Collaboration Suite versions prior to 10.0.9 Zimbra Collaboration Suite versions prior to 10.1.1 Description The...

Command Execution Vulnerability in Electronic Document Security Management System of Beijing Yisetong Technology Development Co., Ltd (CNVD-2024-38466)

Electronic document security management system is a controllable authorization of electronic document security sharing management system, using real-time dynamic encryption and decryption protection technology and real-time rights recovery mechanism, to provide all kinds of electronic documents...

PT-2025-15893

Name of the Vulnerable Software and Affected Versions Yii 2 versions prior to 2.0.52 Description The issue arises from the mishandling of behavior attachment, specifically when behaviors are defined by a class array key. This has been exploited in the wild, with approximately 13,000 vulnerable...

PT-2024-28839 · Tenda · Tenda Ax1806

Name of the Vulnerable Software and Affected Versions: Tenda AX1806 version 1.0.0.1 Description: A stack-based buffer overflow issue exists due to a vulnerability in the /goform/SetVirtualServerCfg endpoint, specifically within the sub 6320C function. This allows for potential exploitation...

The vulnerability of the WebSocket protocol in the Apache HTTP Server web server allows a attacker to induce a service failure.

The vulnerability of the WebSocket protocol in the Apache HTTP Server is related to the assignment of a null pointer. Exploiting this vulnerability could allow a malicious actor to cause a service failure...

The vulnerability of the Adobe Experience Manager (AEM) content and media data management system lies in the insufficient protection of the website structure, allowing attackers to execute arbitrary code.

The vulnerability of the Adobe Experience Manager AEM content and media data management system is related to insufficient protection of the website structure. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

PT-2024-33247 · Progress · Progress Whatsup Gold

Name of the Vulnerable Software and Affected Versions: Progress WhatsUp Gold versions prior to 2023.1.3 Description: The issue concerns an unauthenticated Remote Code Execution vulnerability in Progress WhatsUpGold. Specifically, the Apm.UI.Areas.APM.Controllers.CommunityController allows executi...

CVE-2024-4748

The CRUDDIY project is vulnerable to shell command injection via sending a crafted POST request to the application server. The exploitation risk is limited since CRUDDIY is meant to be launched locally. Nevertheless, a user with the project running on their computer might visit a website which...

CVE-2024-4748 RCE in Cruddiy

The CRUDDIY project is vulnerable to shell command injection via sending a crafted POST request to the application server. The exploitation risk is limited since CRUDDIY is meant to be launched locally. Nevertheless, a user with the project running on their computer might visit a website which...

CVE-2024-4748 RCE in Cruddiy

The CRUDDIY project is vulnerable to shell command injection via sending a crafted POST request to the application server. The exploitation risk is limited since CRUDDIY is meant to be launched locally. Nevertheless, a user with the project running on their computer might visit a website which...

The vulnerability of the NVIDIA Virtual GPU Manager driver, which allows a hacker to trigger a service failure.

The vulnerability of the NVIDIA Virtual GPU Manager driver relates to the assignment of the null pointer. Exploiting this vulnerability can allow an attacker to cause a service failure...

PT-2024-26522 · Unknown · Phpgurukul Men Salon Management System

Name of the Vulnerable Software and Affected Versions: phpgurukul Men Salon Management System version 2.0 Description: The issue concerns SQL Injection via the username parameter of the "/msms/admin/index.php" API endpoint. This allows for potential exploitation. Recommendations: For phpgurukul M...

Logic flaw vulnerability in KingH5Stream system of Beijing Asia Control Technology Development Co.

Beijing Asian Control Technology Development Co., Ltd. is a high-tech enterprise of industrial automation and informatization software platform. There is a logic flaw vulnerability in the KingH5Stream system of Beijing Asian Control Technology Development Co., Ltd. that can be exploited by an...

The vulnerability of the Glib library, related to uncontrolled resource consumption, allows a hacker to cause a service failure.

The vulnerability of the Glib library is related to uncontrolled resource consumption. Exploiting this vulnerability can allow an attacker to cause a service failure...