CVE-2024-6327

In Progress® Telerik® Report Server versions prior to 2024 Q2 10.1.24.709, a remote code execution attack is possible through an insecure deserialization vulnerability...

Progress Software Telerik Report Server 安全漏洞

Progress Software Telerik Report Server is an enterprise-class report management and distribution solution from Progress Software, USA. A security vulnerability exists in Progress Software Telerik Report Server versions prior to 10.1.24.709 that originates from a possible remote code execution...

PT-2024-10282 · Veritas · Veritas Enterprise Vault

Name of the Vulnerable Software and Affected Versions: Veritas Enterprise Vault versions prior to 15.2 Description: An issue in the server allows remote attackers to execute arbitrary code because untrusted data, received on a .NET Remoting TCP port, is deserialized. This is related to shortcomin...

PT-2024-5211 · Telerik · Telerik Report Server

Name of the Vulnerable Software and Affected Versions: In Progress Telerik Report Server versions prior to 2024 Q2 10.1.24.709 Description: The issue is related to an insecure deserialization vulnerability in the Telerik Report Server, which can be exploited to allow a remote attacker to execute...

WordPress Plugin WP ULike 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

PT-2024-6167 · Unknown +2 · Soft Serve +2

Name of the Vulnerable Software and Affected Versions: Soft Serve versions prior to 0.7.5 Description: The issue is related to Soft Serve passing all environment variables given by the client to git subprocesses, including variables that control program execution, such as LD PRELOAD. This can be...

WordPress plugin Hide My WP Ghost 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exist...

PT-2024-7563 · Google +4 · Google Chrome +4

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 130.0.6723.58 Microsoft Edge affected versions not specified Description: The issue is related to a use after free vulnerability in the Dawn component, which can be exploited by a remote attacker using a crafte...

CVE-2024-6806

The NI VeriStand Gateway is missing authorization checks when an actor attempts to access Project resources. These missing checks may result in remote code execution. This affects NI VeriStand 2024 Q2 and prior versions...

WordPress Community Events plugin < 1.5 - Event Deletion via CSRF vulnerability

Event Deletion via CSRF vulnerability discovered by Bob Matyas in WordPress Plugin Community Events versions 1.5...

PT-2024-37868 · National Instruments · Ni Veristand

Name of the Vulnerable Software and Affected Versions: NI VeriStand versions prior to 2024 Q2 Description: A deserialization of untrusted data issue exists in the NI VeriStand Waveform Streaming Server, potentially leading to remote code execution. Successful exploitation requires an attacker to...

PT-2024-25911 · Softwarex · Softwarex

Name of the Vulnerable Software and Affected Versions: SoftwareX versions prior to 2.1.4 Description: The issue allows a regular user to view everyone's user flink information, including executeSQL and config, after successfully logging in. This is achieved by manually making a request using the...

PT-2024-28040 · Unknown +1 · Syncope Console +2

Name of the Vulnerable Software and Affected Versions: Syncope versions prior to 3.0.8 Description: The issue allows HTML tags to be added to any text field when editing a user, group, or object in the Syncope Console, potentially leading to exploits. The same vulnerability is found in the Syncop...

PT-2024-27295 · Unitedthemes · Shortcodes

Name of the Vulnerable Software and Affected Versions: Shortcodes by United Themes versions prior to 5.0.5 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Reflected XSS. Recommendations: For...

PT-2024-37476 · WordPress · Pz Frontend Manager

Name of the Vulnerable Software and Affected Versions: PZ Frontend Manager WordPress plugin versions prior to 1.0.6 Description: The issue concerns a lack of CSRF checks in certain areas, potentially allowing attackers to trick logged-in users into performing unintended actions through CSRF...

PT-2024-37509

Name of the Vulnerable Software and Affected Versions: parisneo/lollms versions prior to 9.5.1 Description: A path traversal issue exists in the apply settings function. The sanitize path function does not adequately secure the discussion db name parameter, allowing attackers to manipulate the pa...

PT-2024-27867 · Codoc · Codoc

Name of the Vulnerable Software and Affected Versions: codoc versions 0.9.51.12 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS or Stored XSS. This allows for the storage of malicious scripts in t...

SolarWinds Access Rights Manager Deserialization Vulnerability

SolarWinds Access Rights Manager is a lightweight review management system from SolarWinds. A deserialization vulnerability exists in versions of SolarWinds Access Rights Manager prior to 2024.3, which arises from unsafe deserialization processing of serialized data received by the application fr...

PT-2024-36733 · Unknown · Apinizer Management Console

Name of the Vulnerable Software and Affected Versions: Apinizer Management Console versions prior to 2024.05.1 Description: The issue is related to an Incorrect Permission Assignment for Critical Resource, which allows accessing functionality not properly constrained by ACLs. Recommendations: For...

PT-2024-28958 · Vodozemac · Vodozemac

Name of the Vulnerable Software and Affected Versions: vodozemac versions prior to 0.7.0 Description: The issue is related to the use of a non-constant time base64 implementation in vodozemac for importing key material for Megolm group sessions and PkDecryption Ed25519 secret keys. This flaw migh...