PT-2024-32416 · Gotenna · Gotenna Pro App +2

Name of the Vulnerable Software and Affected Versions: goTenna Pro App versions affected versions not specified goTenna Pro X goTenna Pro X2 Description: The goTenna Pro App uses a weak password for sharing encryption keys via the key broadcast method. If the broadcasted encryption key is capture...

PT-2024-31868 · Scheduler · Scheduler

Name of the Vulnerable Software and Affected Versions: scheduleR version 0.0.18 Description: A host header injection vulnerability allows attackers to obtain the password reset token via user interaction with a crafted password reset link. This enables attackers to arbitrarily reset other users'...

PT-2024-32082 · Unknown · Becn Datagerry

Name of the Vulnerable Software and Affected Versions: BECN DATAGERRY version 2.2 Description: The issue allows attackers to execute arbitrary commands via crafted web requests due to incorrect access control. Recommendations: For BECN DATAGERRY version 2.2, consider restricting access to the web...

PT-2024-38932 · Opw Fuel Management Systems · Sitesentinel

Name of the Vulnerable Software and Affected Versions: OPW Fuel Management Systems SiteSentinel versions prior to 17Q2.1 Description: The issue allows an attacker to bypass authentication to the server and obtain full admin privileges. This could enable remote attacks. Recommendations: For OPW Fu...

PT-2024-38454 · Unknown +1 · Contact Form 7 +1

Name of the Vulnerable Software and Affected Versions: Contact Form to Any API plugin for WordPress versions 1.2.2 and earlier Description: The issue is related to Stored Cross-Site Scripting via Contact Form 7 form fields due to insufficient input sanitization and output escaping. This allows...

PT-2024-39011 · Themehunk · Easy Mega Menu Plugin

Name of the Vulnerable Software and Affected Versions: Easy Mega Menu Plugin for WordPress – ThemeHunk plugin versions up to, and including, 1.0.9 Description: The issue arises from a missing capability check on several functions hooked via AJAX, allowing authenticated attackers with...

PT-2024-39318 · WordPress · Anwp Football Leagues

Name of the Vulnerable Software and Affected Versions: AnWP Football Leagues plugin for WordPress versions up to, and including, 0.16.7 Description: The issue is related to Stored Cross-Site Scripting via SVG File uploads due to insufficient input sanitization and output escaping. This allows...

PT-2024-39418 · Unknown · Blood Bank System

Name of the Vulnerable Software and Affected Versions: Blood Bank System version 1.0 Description: A problematic issue was found in the Blood Bank System, affecting unknown parts of the bbms.php file. The manipulation of the fullname, age, bloodgroup, city, phno, and gender arguments as part of a...

PT-2024-29872

Name of the Vulnerable Software and Affected Versions Apache HertzBeat incubating versions prior to 1.6.0 Description The software is susceptible to a remote code execution issue stemming from a malicious XML deserialization flaw within the SnakeYaml component. This issue can only be exploited by...

PT-2024-39417 · Sourcecodester · Sourcecodester Employee Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Employee Management System version 1.0 Description: A problematic vulnerability has been found in the SourceCodester Employee Management System. This issue affects an unknown part of the file /Admin/add-admin.php. The...

PT-2024-32094 · Enms · Enms

Name of the Vulnerable Software and Affected Versions: eNMS versions up to 4.7.1 Description: The issue is a Directory Traversal vulnerability, which occurs via the download/folder path. Recommendations: For versions up to 4.7.1, consider restricting access to the download/folder path as a...

PT-2024-31910 · Semcms · Semcms

Name of the Vulnerable Software and Affected Versions: SEMCMS version 4.8 Description: The issue is related to an SQL Injection vulnerability. This vulnerability exists through the SEMCMS Main.php file. Recommendations: For SEMCMS version 4.8, as a temporary workaround, consider restricting acces...

PT-2024-12138 · Dragonfly · Dragonfly

Name of the Vulnerable Software and Affected Versions: Dragonfly versions prior to 2.0.9 Description: The issue concerns Dragonfly, an open-source P2P-based file distribution and image acceleration system. It uses JWT to verify users, but the secret key for JWT is hardcoded, leading to...

CVE-2024-46792

In the Linux kernel, the following vulnerability has been resolved: riscv: misaligned: Restrict user access to kernel memory rawcopyto,fromuser do not call accessok, so this code allowed userspace to access any virtual memory address...

CVE-2024-46792 riscv: misaligned: Restrict user access to kernel memory

In the Linux kernel, the following vulnerability has been resolved: riscv: misaligned: Restrict user access to kernel memory rawcopyto,fromuser do not call accessok, so this code allowed userspace to access any virtual memory address...

PT-2024-37078 · Unknown · Yordam Library Automation System

Name of the Vulnerable Software and Affected Versions: Yordam Library Automation System versions prior to 20.1 Description: The issue affects the Yordam Library Automation System, allowing interface manipulation due to improper restriction of excessive authentication attempts. This can lead to...

PT-2024-32037 · Draytek · Draytek Vigor 3910

Name of the Vulnerable Software and Affected Versions: Draytek Vigor 3910 version 4.3.2.6 Description: A buffer overflow was discovered in the pb parameter at the "v2x00.cgi" endpoint, allowing attackers to cause a Denial of Service DoS via a crafted input. Recommendations: For Draytek Vigor 3910...

PT-2024-39291 · WordPress · Peprodev Woocommerce Receipt Uploader

Name of the Vulnerable Software and Affected Versions: PeproDev WooCommerce Receipt Uploader plugin for WordPress versions up to, and including, 2.6.9 Description: The issue is related to Reflected Cross-Site Scripting due to the use of add query arg without appropriate escaping on the URL. This...

PT-2024-32045 · Draytek · Draytek Vigor 3910

Name of the Vulnerable Software and Affected Versions: Draytek Vigor 3910 version 4.3.2.6 Description: A buffer overflow issue was discovered in the sProfileName parameter at the "fextobj.cgi" API endpoint. This issue allows attackers to cause a Denial of Service DoS via a crafted input...

PT-2024-30259 · Rws · Rws Multitrans

Name of the Vulnerable Software and Affected Versions: RWS MultiTrans versions 7.0.23324.2 and earlier Description: The issue allows attackers to alter the HTML-layout and possibly execute a phishing attack via a crafted payload injected into a sent e-mail. Recommendations: For RWS MultiTrans...