Sweet-CMS security vulnerability

Sweet-CMS is a high-performance backend management system built on a powerful technology stack of Gin, GORM, Redis, Casbin, Viper, etc. by master-nan individual developers. A security vulnerability exists in Sweet-CMS 5f441e022b8876f07cde709c77b5be6d2f262e3f and prior versions, which stems from...

ZOHO ManageEngine Exchange Reporter Plus has a SQL injection vulnerability

ZOHO ManageEngine Exchange Reporter Plus is a Web-based Exchange Server reporting software from ZOHO, Inc. A SQL injection vulnerability exists in ZOHO ManageEngine Exchange Reporter Plus versions prior to 5715, which stems from susceptibility to SQL injection attacks...

CVE-2024-38303

Dell PowerEdge Platform, 14G Intel BIOS versions prior to 2.22.x, contains an Improper Input Validation vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Information disclosure...

WordPress plugin SKT Blocks – Gutenberg-based Page Builder: Cross-site scripting vulnerability

WordPress and WordPress plugin are products of the WordPress Foundation, a blogging platform developed in PHP. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in WordPress plugin SKT Blocks - Gutenbe...

Dell PowerEdge Platform: Input validation error vulnerability

Dell PowerEdge Platform is a server platform from Dell USA. An input validation error vulnerability exists in Dell PowerEdge Platform version 2.22.x and prior versions, which stems from the inclusion of an incorrect input validation vulnerability...

PT-2024-37295 · WordPress · Wp Accessibility Helper

Name of the Vulnerable Software and Affected Versions: WP Accessibility Helper plugin versions prior to 0.6.2.8 Description: The issue allows authenticated attackers with Subscriber-level access and above to edit or delete contrast settings due to a missing capability check on the save contrast...

PT-2024-31406 · Unknown · Hwameistor

Name of the Vulnerable Software and Affected Versions: Hwameistor versions prior to 0.14.6 Description: Hwameistor is a high-availability local storage system for cloud-native stateful workloads. This ClusterRole has excessive permissions, allowing a malicious user who can access the worker node...

OpenText NetIQ Access Manager cross-site scripting vulnerability

OpenText NetIQ Access Manager is a comprehensive mobile and web access management tool from OpenText Canada. A cross-site scripting vulnerability exists in OpenText NetIQ Access Manager versions 5.0.4.1 and prior to 5.1, which stems from improper input validation and could lead to cross-site...

Linux Bluetooth Kernel Heap Buffer Overflow DoS

The vulnerability of the hcireqsyncComplete function in the Linux operating system’s Bluetooth kernel relates to the lack of releasing the previous synchronization request state before assigning a reference to the new one. Exploiting this vulnerability can allow an attacker to cause a service...

PT-2024-38060

Name of the Vulnerable Software and Affected Versions Brain Low-Code versions prior to 2.1.0 Description The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This vulnerability affects the Hibernate component in Brain...

cpanminus security vulnerabilities

cpanminus is a script by Tatsuhiko Miyagawa, an individual developer, that is used to fetch, unpack, build, and install modules from CPAN without performing any other actions. A security vulnerability exists in cpanminus version 1.7047 and prior versions, which originates from downloading code ov...

CVE-2024-38859 XSS in view page with SLA column

XSS in the view page with the SLA column configured in Checkmk versions prior to 2.3.0p14, 2.2.0p33, 2.1.0p47 and 2.0.0 EOL allowed malicious users to execute arbitrary scripts by injecting HTML elements into the SLA column title. These scripts could be executed when the view page was cloned by...

PT-2024-38847 · Atisolutions · Atisolutions Ciges

Name of the Vulnerable Software and Affected Versions: ATISolutions CIGES versions prior to 2.15.5 Description: The issue is a SQL injection vulnerability that allows a remote attacker to send a specially crafted SQL query to the "/modules/ajaxServiciosCentro.php" endpoint in the idCentro paramet...

PT-2024-6340

Name of the Vulnerable Software and Affected Versions libexpat versions prior to 2.6.3 Description An issue was discovered in libexpat that is related to an integer overflow in the dtdCopy function in the xmlparse.c file. This issue can occur on 32-bit platforms and may allow a remote attacker to...

FORT Validator security vulnerability

FORT Validator is a NICMx open source RPKI dependency and RTR server. A security vulnerability exists in FORT Validator versions prior to 1.6.3, which stems from dereferencing a pointer without first cleaning it up...

TikTok security vulnerabilities

Bytedance TikTok Jieyin International Version is an application for creating and sharing short videos by Chinese company Bytedance. A security vulnerability exists in TikTok versions prior to 34.5.5 that stems from allowing traversal of the Lynxview JavaScript interface via deep links...

PT-2024-31496

Name of the Vulnerable Software and Affected Versions Fort versions prior to 1.6.3 Description An issue was discovered in Fort where a malicious RPKI repository that descends from a trusted Trust Anchor can serve an ROA or a Manifest containing a null eContent field via rsync or RRDP. Fort...

SonicWALL SonicOS Access Control Vulnerability

SonicWALL SonicOS is a suite of operating systems from SonicWALL, Inc. designed for SonicWall firewall appliances. An access control error vulnerability exists in SonicWALL SonicOS version 7.0.1-5035 and prior versions, which originates from allowing unauthorized access to resources and can cause...

Adobe Experience Manager security vulnerabilities

Adobe Experience Manager AEM is a set of content management solutions that can be used to build websites, mobile applications and forms from the American company Odobie Adobe. The program supports mobile content management, marketing and sales campaign management and multi-site management. A...

CVE-2024-39576

Dell Power Manager DPM, versions 3.15.0 and prior, contains an Incorrect Privilege Assignment vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution and Elevation of privileges...