PT-2024-30000 · Unknown · Glossarizer

Name of the Vulnerable Software and Affected Versions: Glossarizer versions 1.5.2 and earlier Description: The issue arises from the improper conversion of text into HTML, potentially leading to stored XSS attacks. Although the application itself escapes special characters, the underlying library...

PT-2024-16414 · Tongda Oa · Tongda Oa

Name of the Vulnerable Software and Affected Versions: Tongda OA 2017 up to 11.10 Description: A critical issue has been found in Tongda OA, affecting some unknown processing of the file /pda/reportshop/record detail.php. The manipulation of the repid argument leads to SQL injection. The attack m...

PT-2024-16396 · Tongda Oa · Tongda Oa

Name of the Vulnerable Software and Affected Versions: Tongda OA 2017 up to 11.7 Description: A problematic issue has been found in Tongda OA, affecting some unknown processing of the file /inc/package static resources.php. This leads to resource consumption and can be initiated remotely. The iss...

PT-2024-34580 · Draytek · Draytek Vigor3900

Name of the Vulnerable Software and Affected Versions: DrayTek Vigor3900 version 1.5.1.3 Description: The issue allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doSSLTunnel function. Recommendations: For DrayTek Vigor3900 version...

PT-2024-9704 · Draytek · Draytek Vigor3900

Name of the Vulnerable Software and Affected Versions: Draytek Vigor3900 version 1.5.1.3 Description: The issue is related to the ldap search dn function in the mainfunction.cgi script of the Draytek Vigor3900 web interface. It allows attackers to inject malicious commands and execute arbitrary...

PT-2024-33194

Name of the Vulnerable Software and Affected Versions SAS Studio version 9.4 Description The issue concerns an unrestricted file upload in the /SASStudio/SASStudio/sasexec/sessionID/InternalPath endpoint, allowing a remote attacker to upload malicious files. This is disputed by the vendor as file...

PT-2024-34628 · Ethereum +1 · Ethereum +1

Name of the Vulnerable Software and Affected Versions: Ethereum version 1.12.2 WaterToken smart contract affected versions not specified Description: An issue in the WaterToken smart contract, which can be run on the Ethereum blockchain, allows remote attackers to have an unspecified impact. The...

PT-2024-16323 · Safenet · Esafenet Cdg

Name of the Vulnerable Software and Affected Versions: ESAFENET CDG version 5 Description: A critical issue has been found in the getOneFileDirectory function of the /com/esafenet/servlet/fileManagement/FileDirectoryService.java file. The manipulation of the directoryId argument leads to SQL...

PT-2024-32023 · Unknown · Phpgurukul Vehicle Record Management System

Name of the Vulnerable Software and Affected Versions: phpgurukul Vehicle Record Management System version 1.0 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the searchinputdata parameter at the "/index.php" API endpoint. Recommendation...

PT-2024-16245 · WordPress · Download Monitor

Name of the Vulnerable Software and Affected Versions: Download Monitor plugin for WordPress versions up to, and including, 5.0.13 Description: The issue is related to a missing capability check on the ajax search users function, allowing authenticated attackers with Subscriber-level access and...

PT-2024-22620 · Levelone · Levelone Wbr-6012

Name of the Vulnerable Software and Affected Versions: LevelOne WBR-6012 affected versions not specified Description: A security issue exists due to hard-coded credentials in the web services of the affected device. This allows attackers to gain unauthorized access within the first 30 seconds aft...

PT-2024-16296 · Delta Electronics · Infrasuite Device Master

Name of the Vulnerable Software and Affected Versions: Delta Electronics InfraSuite Device Master versions prior to 1.0.12 Description: The issue is a deserialization vulnerability that targets the Device-Gateway, allowing deserialization of arbitrary .NET objects prior to authentication. This...

PT-2024-16329 · Unknown · Codezips Online Institute Management System

Name of the Vulnerable Software and Affected Versions: Codezips Online Institute Management System version 1.0 Description: A critical issue has been found in the system, affecting the processing of the file /login.php. The manipulation of the email argument leads to sql injection. The attack can...

PT-2024-16306

Name of the Vulnerable Software and Affected Versions LinZhaoguan pb-cms versions up to 2.0.1 Description A problematic issue has been found in the Edit Article Handler component, affecting the processing of the file "/adminarticle/edit?id=2". This leads to cross-site scripting, and the attack ca...

PT-2024-16096 · WordPress · Newsletters

Name of the Vulnerable Software and Affected Versions: Newsletters plugin for WordPress versions up to, and including, 4.9.9.4 Description: The issue is related to Stored Cross-Site Scripting via the plugin's newsletters video shortcode due to insufficient input sanitization and output escaping o...

PT-2024-9758 · Mattermost +1 · Mattermost +1

Name of the Vulnerable Software and Affected Versions: Mattermost versions 9.5.x through 9.5.9 Mattermost versions 9.10.x through 9.10.2 Mattermost versions 9.11.x through 9.11.1 Description: The issue is related to the lack of authorization procedure in the Mattermost application, which allows a...

CVE-2024-44265

The issue was addressed by restricting options offered on a locked device. This issue is fixed in macOS Sequoia 15.1, macOS Sonoma 14.7.1, macOS Ventura 13.7.1. An attacker with physical access can input Game Controller events to apps running on a locked device...

PT-2024-34213 · Unknown · Church Admin

Name of the Vulnerable Software and Affected Versions: Church Admin versions prior to 5.0.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Reflected XSS. Recommendations: For versions prior ...

PT-2024-9811 · NetGear · Netgear R8500

Name of the Vulnerable Software and Affected Versions: Netgear R8500 version 1.0.2.160 Description: The issue is related to a stack overflow in the ipv6 tunnel function when handling the ipv6 static ip parameter. This can be exploited by a remote attacker to cause a Denial of Service DoS using a...

PT-2024-34223 · Yith · Yith Woocommerce Product Add-Ons

Name of the Vulnerable Software and Affected Versions: YITH WooCommerce Product Add-Ons versions prior to 4.14.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Reflected XSS. Recommendations...