PT-2024-18807 · Samsung · Secure Folder

Name of the Vulnerable Software and Affected Versions: Secure Folder versions prior to SMR Jul-2024 Release 1 Description: The issue arises from improper handling of exceptional conditions, allowing physical attackers to bypass authentication under certain conditions. User interaction is required...

PT-2024-37205 · Delinea · Delinea Centrify Pas

Name of the Vulnerable Software and Affected Versions: Delinea Centrify PAS versions prior to 23.1-HF7 Description: The issue allows for a path traversal vulnerability, enabling the listing of arbitrary directories outside the root directory of the web application. This is due to the application...

PT-2024-26988

Name of the Vulnerable Software and Affected Versions Flowise version 1.4.3 Description The issue concerns a lack of sanitization of the fileName body parameter in the "/api/v1/openai-assistants-file" endpoint, which is located in the index.ts file. This lack of sanitization leads to an arbitrary...

PT-2024-37617 · Mesbook · Mesbook

Name of the Vulnerable Software and Affected Versions: MESbook version 20221021.03 Description: The issue allows an unauthenticated remote attacker to register user accounts without authentication. This can be done by accessing the "/account/Register/" route and providing parameters such as...

PT-2024-22335

Name of the Vulnerable Software and Affected Versions N-central versions prior to 2024.2 Description The issue concerns an authentication bypass of the user interface. It was discovered through an internal source code review, and there have been no observed exploitations in the wild...

PT-2024-28308 · Airvertco · Airvertco Frappejs

Name of the Vulnerable Software and Affected Versions: airvertco frappejs version 0.0.11 Description: The issue is related to a prototype pollution vulnerability via the registerView function. This allows attackers to execute arbitrary code or cause a Denial of Service DoS by injecting arbitrary...

PT-2024-28319 · Amoyjs · Amoyjs

Name of the Vulnerable Software and Affected Versions: amoyjs amoy common version 1.0.10 Description: The issue is related to a prototype pollution vulnerability via the setValue function. This allows attackers to execute arbitrary code or cause a Denial of Service DoS by injecting arbitrary...

PT-2024-20045 · Savignano · S/Notify

Name of the Vulnerable Software and Affected Versions: savignano S/Notify versions prior to 4.0.2 for Confluence Description: A Cross Site Request Forgery CSRF issue allows attackers to manipulate a user's S/MIME certificate or PGP key via malicious links or emails. Recommendations: For versions...

PT-2024-28429

Name of the Vulnerable Software and Affected Versions Weblate versions prior to 5.6.2 Description Weblate is a web-based localization tool that did not correctly validate filenames when restoring project backups. This may allow unauthorized access to files on the server using a crafted ZIP file...

PT-2024-4821 · Ibm · Ibm Infosphere Information Server

Name of the Vulnerable Software and Affected Versions: IBM InfoSphere Information Server version 11.7 Description: The issue is related to stored cross-site scripting, allowing users to embed arbitrary JavaScript code in the Web UI, potentially altering the intended functionality and leading to...

PT-2024-28699 · Internet2 · Grouper For Web Services +1

Name of the Vulnerable Software and Affected Versions: Internet2 Grouper versions prior to 5.6 Grouper for Web Services versions prior to 4.13.1 Description: The issue allows authentication bypass when LDAP authentication is used in certain ways. This is related to the...

PT-2024-26342 · Ibm · Ibm Mq Console

Name of the Vulnerable Software and Affected Versions: IBM MQ Console versions 9.3 LTS and 9.3 CD Description: The issue allows a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks...

PT-2024-28389 · Unknown · Luci-App-Sms-Tool

Name of the Vulnerable Software and Affected Versions: luci-app-sms-tool version 1.9-6 Description: A command injection issue was found in luci-app-sms-tool via the score parameter. Recommendations: For luci-app-sms-tool version 1.9-6, avoid using the score parameter until a fix is available...

PT-2024-26340 · Ibm · Ibm Websphere Application Server

Name of the Vulnerable Software and Affected Versions: IBM WebSphere Application Server versions 8.5 through 9.0 Description: The issue allows a privileged user to embed arbitrary JavaScript code in the Web UI, potentially altering the intended functionality and leading to credentials disclosure...

PT-2024-27766 · Pingcap · Tidb

Name of the Vulnerable Software and Affected Versions: PingCAP TiDB versions prior to 8.2.0 Description: A nil pointer dereference in PingCAP TiDB allows attackers to crash the application via expression.inferCollation. Recommendations: For versions prior to 8.2.0, update to version 8.2.0 or late...

PT-2024-28271 · H3C · H3C Magic R230

Name of the Vulnerable Software and Affected Versions: H3C Magic R230 version V100R002 Description: The issue allows attackers to execute arbitrary commands due to the udpserver opening port 9034. Recommendations: For H3C Magic R230 version V100R002, consider restricting access to port 9034 as a...

PT-2024-5610 · Dell · Dell Inventory Collector

Name of the Vulnerable Software and Affected Versions: Dell Inventory Collector versions prior to 12.3.0.6 Description: The issue is related to incorrect restriction of a directory path with limited access. Exploitation of this issue may allow an attacker to execute arbitrary code. A local...

PT-2024-28266 · Wavlink · Wavlink Wn551K1

Name of the Vulnerable Software and Affected Versions: WAVLINK WN551K1 version not specified Description: The issue allows attackers to obtain sensitive router information through the 'live mfg.shtml' endpoint. Recommendations: For WAVLINK WN551K1, restrict access to the 'live mfg.shtml' endpoint...

PT-2024-28267 · Wavlink · Wavlink Wn551K1

Name of the Vulnerable Software and Affected Versions: WAVLINK WN551K1 affected versions not specified Description: A command injection issue was found, which can be exploited through the start hour parameter of the "/cgi-bin/nightled.cgi" API endpoint. Recommendations: As a temporary workaround,...

PT-2024-6224

Name of the Vulnerable Software and Affected Versions Django versions 4.2 through 4.2.13 Django versions 5.0 through 5.0.6 Description The issue allows remote attackers to enumerate users via a timing attack involving login requests for users with an unusable password. This is due to the...