PT-2024-35219 · Zij Kart · Zij Kart

Name of the Vulnerable Software and Affected Versions: ZIJ KART versions n/a through 1.1 Description: The issue affects ZIJ KART due to an improper control of filename for include/require statement in PHP program, also known as 'PHP Remote File Inclusion' vulnerability. This allows PHP Local File...

PT-2024-39617

Name of the Vulnerable Software and Affected Versions SCP-Firmware versions 2.11.0 through 2.15.0 Description The issue arises from the transport message handler function not properly handling errors, which could allow an Application Processor AP to cause a buffer overflow in System Control...

PT-2024-19130 · Amd · Amd Ryzen Ai Software Npu Driver

Name of the Vulnerable Software and Affected Versions: AMD Ryzen AI Software NPU Driver affected versions not specified Description: The issue is related to improper input validation in the NPU driver, which could allow an attacker to supply a specially crafted pointer, potentially leading to...

PT-2024-34493 · Unknown · Netadmin Iam System

Name of the Vulnerable Software and Affected Versions: NetAdmin IAM system version 4.0.30319 Description: The issue concerns a Cross Site Scripting XSS vulnerability. It affects the "/BalloonSave.ashx" endpoint, where a malicious payload can be injected into the Content field. Recommendations: Fo...

WordPress Share Buttons – Social Media Plugin <= 1.0.2 is vulnerable to SQL Injection

Software Share Buttons – Social Media Type Plugin Vulnerable versions = 1.0.2 Fixed in N/A OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-51845 Patch priority Low CVSS severity Low 8.5 Developer Claim ownership PSID c8254280abdb Credits LVT-tholv2k Required privilege...

CVE-2024-51746

A flaw was found in the Gitsign sigstore package. When Gitsign's credential cache is used, it may select the wrong Rekor entry to use during online verification when the log returns multiple entries. This may lead to the incorrect entry being used to pass verification successfully...

CVE-2024-50132

In the Linux kernel, the following vulnerability has been resolved: tracing/probes: Fix MAXTRACEARGS limit handling When creating a traceprobe we would set nrargs prior to truncating the arguments to MAXTRACEARGS. However, we would only initialize arguments up to the limit. This caused invalid...

PT-2024-25076 · Qualcomm · Snapdragon +16

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: There is a memory corruption issue when handling the request to update SIM PB records. This issue occurs while processing the update SIM PB records...

PT-2024-27402 · Unknown · Hercules Core

Name of the Vulnerable Software and Affected Versions: Hercules Core versions n/a through 6.5 Description: The issue is related to a Missing Authorization vulnerability, which allows the exploitation of incorrectly configured Access Control Security Levels. Recommendations: For versions n/a throu...

PT-2024-33616 · Unknown · Chatplusjp

Name of the Vulnerable Software and Affected Versions: chatplusjp versions n/a through 1.02 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, which allows Reflected XSS. This means that an attacker can inject malicious scripts into a website,...

PT-2024-34181 · Unknown · Namaste! Lms

Name of the Vulnerable Software and Affected Versions: Namaste! LMS versions n/a through 2.6.3 Description: The issue is related to Deserialization of Untrusted Data, which allows Object Injection. This can potentially lead to security breaches by injecting malicious objects into the system...

PT-2024-34270 · Scottcart · Scottcart

Name of the Vulnerable Software and Affected Versions: ScottCart versions n/a through 1.1 Description: The issue is related to improper control of generation of code, also known as 'Code Injection'. This allows for code injection in ScottCart. Recommendations: For versions n/a through 1.1, consid...

PT-2024-10795 · Unknown · Commonregexjs

Name of the Vulnerable Software and Affected Versions: CommonRegexJS versions all available versions Description: The issue concerns Regular Expression Denial of Service ReDoS due to vulnerable regular expressions in CommonRegexJS. No known patches are available as of the time of publication...

PT-2024-33388 · Michael Tran · Table Of Contents Plus

Name of the Vulnerable Software and Affected Versions: Table of Contents Plus versions n/a through 2408 Description: A Cross-Site Request Forgery CSRF issue is found in Michael Tran's Table of Contents Plus, allowing malicious activities. This issue enables Cross Site Request Forgery...

PT-2024-6889 · Adobe · Animate

Name of the Vulnerable Software and Affected Versions: Adobe Animate versions 23.0.7, 24.0.4 and earlier Description: The issue is related to a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user...

PT-2024-18590 · Unknown · Wlan Driver

Name of the Vulnerable Software and Affected Versions: WLAN driver affected versions not specified Description: The issue is related to a possible out of bounds read in the wlan driver due to improper input validation. This could lead to remote information disclosure with System execution...

PT-2024-30882 · Mark Steadman · Podiant

Name of the Vulnerable Software and Affected Versions: Podiant versions n/a through 1.1 Description: The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as a 'Path Traversal' vulnerability, in Mark Steadman Podiant. This vulnerability allows PHP Loca...

PT-2024-30928 · Unknown · Jennifer Hall Filmix

Name of the Vulnerable Software and Affected Versions: Jennifer Hall Filmix versions n/a through 1.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Reflected XSS. Recommendations: For Jennif...

CVE-2024-8443

A heap-based buffer overflow vulnerability was found in the libopensc OpenPGP driver. A crafted USB device or smart card with malicious responses to the APDUs during the card enrollment process using the pkcs15-init tool may lead to out-of-bound rights, possibly resulting in arbitrary code...

CVE-2024-45618

A vulnerability was found in pkcs15-init in OpenSC. An attacker could use a crafted USB Device or Smart Card, which would present the system with a specially crafted response to APDUs. Insufficient or missing checking of return values of functions leads to unexpected work with variables that have...