PT-2024-36545 · Oring · Oring Iap-420

Name of the Vulnerable Software and Affected Versions: ORing IAP-420 versions 2.01e and earlier Description: The issue is caused by a lack of input validation in the web interface of ORing IAP-420, allowing Cross-Site Scripting XSS. Recommendations: For versions 2.01e and earlier, update to a...

PT-2024-20701 · Ibm · Ibm Cognos Controller

Name of the Vulnerable Software and Affected Versions: IBM Cognos Controller versions 11.0.0 through 11.0.1 Description: The issue concerns a malicious file upload vulnerability due to the lack of validation of the type of file uploaded to Journal entry attachments. Attackers can exploit this...

PT-2024-35763 · Seecms · Seecms

Name of the Vulnerable Software and Affected Versions: Seecms version 4.8 Description: A SQL injection issue was discovered in the SEMCMS SeoAndTag.php page. This issue allows for potential SQL injection attacks. Recommendations: For Seecms version 4.8, consider restricting access to the SEMCMS...

PT-2024-17271 · Unknown · Phpgurukul User Registration & Login/User Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul User Registration & Login and User Management System version 1.0 Description: A critical issue affects some unknown functionality of the file /admin/index.php. The manipulation of the username argument leads to SQL injection. The...

OESA-2024-2383 rubygem-actionmailer security update

Email on Rails. Compose, deliver, and test emails using the familiar controller/view pattern. First-class support for multipart email and attachments. Security Fixes: Action Mailer is a framework for designing email service layers. Starting in version 3.0.0 and prior to versions 6.1.7.9, 7.0.8.5,...

Fedora 37 : libmodsecurity (2022-90453044f3)

The remote Fedora 37 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2022-90453044f3 advisory. Update to maintenance release 3.0.8 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has no...

PT-2024-31980 · Hathway · Hathway Skyworth Router Cm5100-511

Name of the Vulnerable Software and Affected Versions: Hathway Skyworth Router CM5100-511 version 4.1.1.24 Description: The issue concerns the storage of sensitive information about connected devices in plaintext. This affects devices connected via USB and Wifi. Recommendations: For version...

PT-2024-8069 · Microsoft · Windows Update Stack +1

Name of the Vulnerable Software and Affected Versions: Windows Update Stack versions prior to the fixed version Description: The issue is related to inadequate access control in the Windows Update Stack component of the Microsoft Windows operating system. This can be exploited to elevate...

CVE-2020-26309 GHSL-2020-303: Regular Expression Denial of Service (ReDoS) in nope-validator

Validate.js provides a declarative way of validating javascript objects. Versions 0.11.3 and prior contain one or more regular expressions that are vulnerable to Regular Expression Denial of Service ReDoS. As of time of publication, it is unknown if any patches are available...

CVE-2020-26309

CVE-2020-26309 concerns the Nope-validator (Validate.js) library. Versions 0.11.3 and earlier contain one or more regular expressions vulnerable to Regular Expression Denial of Service (ReDoS). Documented sources indicate this is a high-severity issue (CVSS-like: HIGH) with potential network expo...

CVE-2024-49359

ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.2.4 and all prior versions, the API endpoint http:///v21/file in ZimaOS is vulnerable to a directory traversal attack, allowing authenticated users to list the contents of any directory on...

PT-2024-35554

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.12.0-rc2-build3+ Description The issue is related to lock recursion in the Linux kernel, specifically in the afs wake up async call function. This function can incur lock recursion when called from AF RXRPC whi...

Security Advisory Ivanti Connect Secure and Policy Secure (CVE-2024-37404)

Summary Ivanti has released updates for Ivanti Connect Secure and Policy Secure which addresses a critical vulnerability. Successful exploitation could allow a remote authenticated attacker to achieve remote code execution. We are not aware of any customers being exploited by this vulnerability a...

Security Advisory Ivanti Endpoint Manager Mobile (EPMM) (CVE-2024-7612) 

Summary: Ivanti has released updates for Ivanti EPMM which addresses a high severity vulnerability. Successful exploitation could lead to an authenticated attacker accessing or modifying configuration files. We are not aware of any customers being exploited by these vulnerabilities at the time of...

PT-2024-7244 · D Link · D-Link Dir-605L

Name of the Vulnerable Software and Affected Versions: D-Link DIR-605L version 2.13B01 BETA Description: The issue is related to a buffer overflow vulnerability in the formSetWanPPPoE function of the /goform/formSetWanPPPoE file. This vulnerability can be exploited by sending a specially crafted...

PT-2024-12944 · Victure · Victure Pc420

Name of the Vulnerable Software and Affected Versions: Victure PC420 version 1.1.39 Description: The issue concerns a hardcoded root password stored in plaintext. Recommendations: For Victure PC420 version 1.1.39, consider changing the hardcoded root password to a unique and secure password as a...

PT-2024-7673 · Intel · Intel Raid Web Console

Name of the Vulnerable Software and Affected Versions: IntelR RAID Web Console software all versions Description: The issue is related to improper access control in the IntelR RAID Web Console software, which may allow an authenticated user to potentially enable denial of service via adjacent...

PT-2024-31886 · Tenda · Tenda Fh451

Name of the Vulnerable Software and Affected Versions: Tenda FH451 version 1.0.0.9 Description: The issue is a stack overflow vulnerability located in the RouteStatic function. This vulnerability enables remote code execution. Recommendations: For Tenda FH451 version 1.0.0.9, consider disabling t...

PT-2024-30191 · Unknown · Esafenet Cdg

Name of the Vulnerable Software and Affected Versions: ESAFENET CDG versions 5.6 and earlier Description: A SQL Injection flaw exists in ESAFENET CDG, allowing an attacker to execute arbitrary code via the id parameter of the "data.jsp" page. Recommendations: For ESAFENET CDG versions 5.6 and...

PT-2024-30184 · Exiftags +1 · Exiftags +1

Name of the Vulnerable Software and Affected Versions: exiftags version 1.01 Description: A Buffer Overflow vulnerability in exiftags allows a local attacker to execute arbitrary code via the paresetag function. This issue enables local code execution. Recommendations: For exiftags version 1.01, ...