CVE-2024-28200

The N-central server is vulnerable to an authentication bypass of the user interface. This vulnerability is present in all deployments of N-central prior to 2024.2. This vulnerability was discovered through internal N-central source code review and N-able has not observed any exploitation in the...

CVE-2024-6376

MongoDB Compass may be susceptible to code injection due to insufficient sandbox protection settings with the usage of ejson shell parser in Compass' connection handling. This issue affects MongoDB Compass versions prior to version 1.42.2...

PT-2024-4827 · Jetbrains · Teamcity

Name of the Vulnerable Software and Affected Versions: JetBrains TeamCity versions prior to 2024.03.3 Description: The issue is related to insufficient protection of registration data in the continuous integration and delivery CI/CD system, allowing a remote attacker to gain unauthorized access t...

Machform Security Vulnerabilities

Machform is an online questionnaire program. A security vulnerability exists in Machform version 19 and prior versions that stems from the presence of an unauthenticated stored cross-site scripting vulnerability...

PT-2024-37406 · 10Web · The Form Maker

Name of the Vulnerable Software and Affected Versions: The Form Maker by 10Web WordPress plugin versions prior to 1.15.26 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This is possible because some settings are not properly...

PT-2024-22335

Name of the Vulnerable Software and Affected Versions N-central versions prior to 2024.2 Description The issue concerns an authentication bypass of the user interface. It was discovered through an internal source code review, and there have been no observed exploitations in the wild...

WordPress plugin Advanced File Manager security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in the...

PT-2024-10742

Name of the Vulnerable Software and Affected Versions: Gin-Gonic CORS middleware versions prior to 1.6.0 Description: The issue arises from the mishandling of a wildcard at the end of an origin string by the parseWildcardRules function in Gin-Gonic CORS middleware. This results in unintended...

PT-2024-28055 · Nptd-Rs · Nptd-Rs

Name of the Vulnerable Software and Affected Versions: nptd-rs versions prior to 1.1.3 Description: The issue is related to a missing limit for accepted NTS-KE connections in nptd-rs, a tool for synchronizing computer clocks that implements the NTP and NTS protocols. This allows an unauthenticate...

NLTK Security Vulnerabilities

NLTK is a natural language toolkit. It is used to support research and development in natural language processing. A security vulnerability exists in NLTK version 3.8.1 and prior versions, which stems from a vulnerability that could lead to remote code execution if the integrated packet download...

Astra Linux – Vulnerability in Chromium

The use of after-free in Dawn, prior to version 126.0.6478.114, allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: High...

CVE-2024-37141

Dell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 contain an open redirect vulnerability. A remote low privileged attacker could potentially exploit this vulnerability, leading to information disclosure...

CVE-2024-37138

Dell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 on DDMC contain a relative path traversal vulnerability. A remote high privileged attacker could potentially exploit this vulnerability, leading to the application sending over an unauthorized file to the manag...

SoftEther VPN Security Vulnerability

SoftEther VPN is an open source, cross-platform, multi-protocol VPN Virtual Private Network application. A security vulnerability exists prior to SoftEther VPN version 5.02.5185 that stems from the fact that when L2TP is enabled on a device to deploy SoftEtherVPN, two response packets larger than...

Django REST framework security vulnerability

Django REST framework is Django REST framework open source a powerful and flexible toolkit for building Web APIs. A security vulnerability exists in the Django REST framework prior to version 3.15.2, which stems from a cross-site scripting vulnerability in breaklongheaders...

Adobe Experience Manager Cross-Site Scripting Vulnerability

Adobe Experience Manager AEM is a set of content management solutions that can be used to build websites, mobile applications and forms from the American company Audobee Adobe. The solution supports mobile content management, marketing and sales campaign management, and multi-site management. A...

PT-2024-33971 · Ipswitch · Whatsup Gold

Name of the Vulnerable Software and Affected Versions: WhatsUp Gold versions prior to 2023.1.3 Description: A Server Side Request Forgery issue exists in the GetASPReport feature, allowing any authenticated user to retrieve ASP reports from an HTML form. Recommendations: For versions prior to...

AZL-42904 CVE-2024-6104 affecting package keda for versions less than 2.14.0-2

go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file. This could lead to go-retryablehttp writing sensitive HTTP basic auth credentials to its log file. This vulnerability, CVE-2024-6104, was fixed in go-retryablehttp 0.7.7...

PT-2024-27302 · Unknown · Wishlist Member

Name of the Vulnerable Software and Affected Versions: WishList Member X versions prior to 3.26.7 Description: The issue is related to Improper Privilege Management, allowing Privilege Escalation in the Membership Software. Recommendations: For versions prior to 3.26.7, update to version 3.26.7 o...

AZL-42925 CVE-2024-39331 affecting package emacs for versions less than 29.4-1

In Emacs before 29.4, org-link-expand-abbrev in lisp/ol.el expands a %... link abbrev even when it specifies an unsafe function, such as shell-command-to-string. This affects Org Mode before 9.7.5...