CVE-2024-9953 Potential DoS Vulnerability in CERT VINCE Software Before Version 3.0.8

A potential denial-of-service DoS vulnerability exists in CERT VINCE software versions prior to 3.0.8. An authenticated administrative user can inject an arbitrary pickle object into a user’s profile, which may lead to a DoS condition when the profile is accessed. While the Django server restrict...

PT-2024-33240 · Unknown · Automatic Systems Maintenance Slimlane

Name of the Vulnerable Software and Affected Versions: Automatic Systems Maintenance SlimLane version 29565 d74ecce0c1081d50546db573a499941b10799fb7 Description: The issue allows a remote attacker to escalate privileges via the FtpConfig.php page. This can grant unauthorized access, potentially...

PT-2024-7156 · Splunk · Splunk Cloud Platform +1

Name of the Vulnerable Software and Affected Versions: Splunk Enterprise versions prior to 9.3.1 Splunk Enterprise version 9.2.0 through 9.2.3 Splunk Cloud Platform versions prior to 9.2.2403.103 Splunk Cloud Platform versions 9.1.2312.200 through 9.1.2312.110 Splunk Cloud Platform version...

PT-2024-33239 · Unknown · Automatic Systems Maintenance Slimlane

Name of the Vulnerable Software and Affected Versions: Automatic Systems Maintenance SlimLane 29565 d74ecce0c1081d50546db573a499941b10799fb7 Description: A Cross Site Scripting XSS vulnerability allows a remote attacker to escalate privileges via the FtpConfig.php component. This issue enables an...

PT-2024-33057 · Wavelog · Wavelog

Name of the Vulnerable Software and Affected Versions: Wavelog version 1.8.5 Description: The issue is an SQL injection vulnerability in the Activated gridmap model.php file. This vulnerability can be exploited through the band, sat, propagation, or mode variables. Recommendations: For Wavelog...

PT-2024-39920 · Unknown · Code-Projects Blood Bank System

Name of the Vulnerable Software and Affected Versions: code-projects Blood Bank System version 1.0 Description: A critical issue was found in the reset.php file, where the manipulation of the useremail argument leads to sql injection. This allows for remote attacks. The exploit has been disclosed...

PT-2024-33237 · Taskmatic · Taskmatic

Name of the Vulnerable Software and Affected Versions: taskmatic version 1.0 Description: The issue allows a remote attacker to execute arbitrary code via the admin id parameter of the "/update-employee.php" API endpoint. Recommendations: For taskmatic version 1.0, consider disabling the...

PT-2024-39863 · Sourcecodester · Sourcecodester Online Veterinary Appointment System

Name of the Vulnerable Software and Affected Versions: SourceCodester Online Veterinary Appointment System version 1.0 Description: A critical vulnerability has been found in the system, allowing for SQL injection through the manipulation of the id argument in an unknown function of the file...

PT-2024-39484 · Unknown · Seur Plugin

Name of the Vulnerable Software and Affected Versions: SEUR plugin versions prior to 2.5.11 Description: The SEUR plugin is vulnerable to time-based SQL injection through the use of the id order parameter of the "/modules/seur/ajax/saveCodFee.php" endpoint. This issue affects versions prior to...

PT-2024-32706 · Unknown · Eventprime

Name of the Vulnerable Software and Affected Versions: EventPrime versions through 4.0.4.5 Description: The issue is related to a URL Redirection to Untrusted Site, also known as an 'Open Redirect' vulnerability. This vulnerability allows an attacker to redirect users to untrusted sites...

PT-2024-39854 · Sourcecodester · Sourcecodester Online Eyewear Shop

Name of the Vulnerable Software and Affected Versions: SourceCodester Online Eyewear Shop version 1.0 Description: A critical issue has been identified, affecting the delete product function in the /classes/Master.php?f=delete product file. The manipulation of the id argument leads to SQL...

PT-2024-39704 · WordPress · Linkz.Ai

Name of the Vulnerable Software and Affected Versions: Linkz.ai plugin for WordPress versions up to, and including, 1.1.8 Description: The issue allows unauthorized modification of data due to a missing capability check on the ajax linkz function. This makes it possible for authenticated attacker...

GO-2024-3162 Vault SSH Secrets Engine Configuration Did Not Restrict Valid Principals By Default in github.com/hashicorp/vault

Vault SSH Secrets Engine Configuration Did Not Restrict Valid Principals By Default in github.com/hashicorp/vault...

PT-2024-10171 · Unknown · License Center

Name of the Vulnerable Software and Affected Versions: License Center versions prior to 1.9.43 Description: A command injection vulnerability has been reported to affect License Center. If exploited, the vulnerability could allow remote attackers to execute arbitrary commands. This issue is relat...

PT-2024-6717

Name of the Vulnerable Software and Affected Versions: Palo Alto Networks Expedition affected versions not specified Description: The issue is related to an SQL injection vulnerability in Palo Alto Networks Expedition. This vulnerability allows an unauthenticated attacker to reveal Expedition...

PT-2024-38899 · Fortra · Robot Schedule Enterprise Agent

Name of the Vulnerable Software and Affected Versions: Fortra's Robot Schedule Enterprise Agent versions prior to 3.05 Description: The issue concerns the writing of FTP username and password information to the agent log file when detailed logging is enabled. This affects the security of the syst...

PT-2024-39674 · WordPress · Userplus

Name of the Vulnerable Software and Affected Versions: UserPlus plugin for WordPress versions prior to 2.1 Description: The UserPlus plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on multiple functions. This makes it...

PT-2024-7443 · Jetbrains · Jetbrains Teamcity +1

Name of the Vulnerable Software and Affected Versions: JetBrains TeamCity versions prior to 2024.07.3 Description: The issue concerns a stored XSS vulnerability in JetBrains TeamCity. This vulnerability exists due to insufficient protection of the web page structure, allowing a remote attacker to...

PT-2024-8639 · Ivanti · Ivanti Avalanche

Name of the Vulnerable Software and Affected Versions: Ivanti Avalanche versions prior to 6.4.6 Description: The issue is related to an infinite loop in Ivanti Avalanche, which can be exploited by a remote unauthenticated attacker to cause a denial of service. This is due to a condition where the...

PT-2024-6963 · Adobe · Commerce +1

Name of the Vulnerable Software and Affected Versions: Adobe Commerce versions 2.4.7-p2 through 2.4.4-p10 and earlier Magento Open Source versions 2.4.7-p2 through 2.4.4-p10 and earlier Description: The issue is related to a reflected Cross-Site Scripting XSS vulnerability. If an attacker convinc...