PT-2024-22000 · Unknown · Eskooly Web Product

Name of the Vulnerable Software and Affected Versions: Eskooly Web Product version 3.0 Description: The issue allows a remote attacker to execute arbitrary code via the searchby parameter of the "allstudents.php" component and the id parameter of the "requestmanager.php" component. This enables t...

PT-2024-7332 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.10.0 Description: The issue is related to the ext4 file system in the Linux kernel, specifically with the function ext4 ioctl getlabel in the fs/ext4/ioctl.c module. It involves improper memory access beyond t...

PT-2024-28930 · Openai · Openai Chatgpt

Name of the Vulnerable Software and Affected Versions: OpenAI ChatGPT app versions prior to 2024-07-05 for macOS Description: The issue concerns the OpenAI ChatGPT app for macOS, which opts out of the sandbox and stores conversations in cleartext in a location accessible to other apps. This could...

PT-2024-27739 · 14Finger · 14Finger

Name of the Vulnerable Software and Affected Versions: 14Finger version 1.1 Description: The issue allows for arbitrary user deletion through the "/api/admin/user?id" API endpoint. This endpoint is used for administrative purposes, and the vulnerability could be exploited to delete users without...

PT-2024-28408 · Simpcms · Simpcms

Name of the Vulnerable Software and Affected Versions: SimpCMS version 0.1 Description: A cross-site scripting XSS vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title field at the "/admin.php" API endpoint. Recommendations: For...

PT-2024-28697 · Znc +2 · Znc +2

Name of the Vulnerable Software and Affected Versions: ZNC versions prior to 1.9.1 Description: The issue allows for remote code execution in the modtcl module of ZNC, which can be triggered through a prepared kick message. Recommendations: For versions prior to 1.9.1, update to version 1.9.1 or...

PT-2024-18807 · Samsung · Secure Folder

Name of the Vulnerable Software and Affected Versions: Secure Folder versions prior to SMR Jul-2024 Release 1 Description: The issue arises from improper handling of exceptional conditions, allowing physical attackers to bypass authentication under certain conditions. User interaction is required...

PT-2024-37205 · Delinea · Delinea Centrify Pas

Name of the Vulnerable Software and Affected Versions: Delinea Centrify PAS versions prior to 23.1-HF7 Description: The issue allows for a path traversal vulnerability, enabling the listing of arbitrary directories outside the root directory of the web application. This is due to the application...

PT-2024-5008 · NetGear · Netgear Wn604

Name of the Vulnerable Software and Affected Versions: Netgear WN604 versions up to 20240710 Description: A vulnerability was found in the Web Interface component of Netgear WN604, specifically in the /downloadFile.php file. The issue is related to insufficient protection of internal data. The...

PT-2024-20045 · Savignano · S/Notify

Name of the Vulnerable Software and Affected Versions: savignano S/Notify versions prior to 4.0.2 for Confluence Description: A Cross Site Request Forgery CSRF issue allows attackers to manipulate a user's S/MIME certificate or PGP key via malicious links or emails. Recommendations: For versions...

PT-2024-28308 · Airvertco · Airvertco Frappejs

Name of the Vulnerable Software and Affected Versions: airvertco frappejs version 0.0.11 Description: The issue is related to a prototype pollution vulnerability via the registerView function. This allows attackers to execute arbitrary code or cause a Denial of Service DoS by injecting arbitrary...

PT-2024-26988

Name of the Vulnerable Software and Affected Versions Flowise version 1.4.3 Description The issue concerns a lack of sanitization of the fileName body parameter in the "/api/v1/openai-assistants-file" endpoint, which is located in the index.ts file. This lack of sanitization leads to an arbitrary...

PT-2024-28319 · Amoyjs · Amoyjs

Name of the Vulnerable Software and Affected Versions: amoyjs amoy common version 1.0.10 Description: The issue is related to a prototype pollution vulnerability via the setValue function. This allows attackers to execute arbitrary code or cause a Denial of Service DoS by injecting arbitrary...

PT-2024-37617 · Mesbook · Mesbook

Name of the Vulnerable Software and Affected Versions: MESbook version 20221021.03 Description: The issue allows an unauthenticated remote attacker to register user accounts without authentication. This can be done by accessing the "/account/Register/" route and providing parameters such as...

PT-2024-22335

Name of the Vulnerable Software and Affected Versions N-central versions prior to 2024.2 Description The issue concerns an authentication bypass of the user interface. It was discovered through an internal source code review, and there have been no observed exploitations in the wild...

PT-2024-4821 · Ibm · Ibm Infosphere Information Server

Name of the Vulnerable Software and Affected Versions: IBM InfoSphere Information Server version 11.7 Description: The issue is related to stored cross-site scripting, allowing users to embed arbitrary JavaScript code in the Web UI, potentially altering the intended functionality and leading to...

PT-2024-28699 · Internet2 · Grouper For Web Services +1

Name of the Vulnerable Software and Affected Versions: Internet2 Grouper versions prior to 5.6 Grouper for Web Services versions prior to 4.13.1 Description: The issue allows authentication bypass when LDAP authentication is used in certain ways. This is related to the...

PT-2024-26342 · Ibm · Ibm Mq Console

Name of the Vulnerable Software and Affected Versions: IBM MQ Console versions 9.3 LTS and 9.3 CD Description: The issue allows a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks...

PT-2024-28389 · Unknown · Luci-App-Sms-Tool

Name of the Vulnerable Software and Affected Versions: luci-app-sms-tool version 1.9-6 Description: A command injection issue was found in luci-app-sms-tool via the score parameter. Recommendations: For luci-app-sms-tool version 1.9-6, avoid using the score parameter until a fix is available...

PT-2024-26340 · Ibm · Ibm Websphere Application Server

Name of the Vulnerable Software and Affected Versions: IBM WebSphere Application Server versions 8.5 through 9.0 Description: The issue allows a privileged user to embed arbitrary JavaScript code in the Web UI, potentially altering the intended functionality and leading to credentials disclosure...