PT-2024-3458

Name of the Vulnerable Software and Affected Versions Apache OFBiz versions prior to 18.12.13 Description The issue is related to an improper limitation of a pathname to a restricted directory, also known as a path traversal vulnerability. This allows a remote attacker to execute arbitrary code b...

PT-2024-31821 · Dedecms · Dedecms

Name of the Vulnerable Software and Affected Versions: DedeCMS version 5.7 Description: A issue was found in the processing of the file /src/dede/tpl.php, which can lead to cross-site request forgery. The attack may be initiated remotely. Recommendations: For DedeCMS version 5.7, consider...

PT-2024-31839 · Dedecms · Dedecms

Name of the Vulnerable Software and Affected Versions: DedeCMS version 5.7 Description: A vulnerability was found in DedeCMS, affecting an unknown functionality of the file /src/dede/mytag edit.php. This issue leads to cross-site request forgery and can be launched remotely. Recommendations: For...

PT-2024-25477 · Mp-Spdz · Mp-Spdz

Name of the Vulnerable Software and Affected Versions: MP-SPDZ version 0.3.8 Description: A stack overflow was discovered in the function OTExtensionWithMatrix::extend in /OT/OTExtensionWithMatrix.cpp. This issue allows attackers to cause a Denial of Service DoS via a crafted message...

PT-2024-25131 · J2Eefast · J2Eefast

Name of the Vulnerable Software and Affected Versions: J2EEFAST version 2.7.0 Description: A SQL injection issue was discovered via the sql filter parameter in the authRoleList function. This allows for potential exploitation. No information is provided about the estimated number of affected...

PT-2024-31847 · Dedecms · Dedecms

Name of the Vulnerable Software and Affected Versions: DedeCMS version 5.7 Description: A vulnerability was found in DedeCMS, affecting unknown code of the file /src/dede/sys group edit.php. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The vendor was...

PT-2024-31849 · Dedecms · Dedecms

Name of the Vulnerable Software and Affected Versions: DedeCMS version 5.7 Description: A problematic issue has been found in DedeCMS, affecting the processing of the file /src/dede/sys multiserv.php. This leads to cross-site request forgery, which can be initiated remotely. The exploit has been...

PT-2024-20976 · Ruvaroa · Ruvaroa

Name of the Vulnerable Software and Affected Versions: RuvarOA versions 6.01 through 12.01 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the template id parameter at the "/SysManage/wf template child field list.aspx" API endpoint...

PT-2024-25136 · J2Eefast · J2Eefast

Name of the Vulnerable Software and Affected Versions: J2EEFAST version 2.7.0 Description: The issue is related to a SQL injection vulnerability. It occurs via the sql filter parameter in the getDeptList function. This allows for potential exploitation. Recommendations: For J2EEFAST version 2.7.0...

PT-2024-20969 · Ruvaroa · Ruvaroa

Name of the Vulnerable Software and Affected Versions: RuvarOA versions 6.01 through 12.01 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the email attach id parameter at the "/LHMail/AttachDown.aspx" API endpoint. Recommendations: For...

PT-2024-25515 · Logpoint · Logpoint

Name of the Vulnerable Software and Affected Versions: Logpoint versions prior to 7.4.0 Description: An issue was discovered that allows Local File Inclusion LFI when an arbitrary File Path is used within the File System Collector. The content of the file specified can be viewed in the incoming...

PT-2024-25123 · Roothub · Roothub

Name of the Vulnerable Software and Affected Versions: Roothub version 2.6 Description: A SQL injection issue was discovered in Roothub via the s parameter in the search function. This allows for potential exploitation. No information is provided about the estimated number of potentially affected...

PT-2024-25945 · Syracuse · Avantra Server

Name of the Vulnerable Software and Affected Versions: Avantra Server versions 24.0.0 through 24.0.6 Avantra Server versions 24.1.0 through 24.1.0 Description: The issue concerns the mishandling of dashboard security. If a user can create a dashboard with an auto-login user, data disclosure may...

PT-2024-25920 · Unknown · Rukovoditel

Name of the Vulnerable Software and Affected Versions: Rukovoditel versions prior to 3.5.3 Description: The issue allows for XSS via the user photo parameter to My Page. This can potentially lead to malicious script execution. Recommendations: For versions prior to 3.5.3, update to version 3.5.3 ...

PT-2024-25229

Name of the Vulnerable Software and Affected Versions kubevirt versions 1.2.0 and earlier Description The issue allows a local attacker to execute arbitrary code via a crafted command to get the token component. This can be done by sending a crafted command to the /kubevirt.io/kubevirt API...

PT-2024-22940 · WordPress · Svs Pricing Tables

Name of the Vulnerable Software and Affected Versions: SVS Pricing Tables plugin for WordPress versions up to, and including, 1.0.4 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the savePricingTable function. This allows...

PT-2024-21430 · WordPress · Barcode Scanner/Inventory Manager

Name of the Vulnerable Software and Affected Versions: The Barcode Scanner and Inventory manager. POS Point of Sale – scan barcodes & create orders with barcode reader. plugin for WordPress versions up to, and including, 1.5.4 Description: The issue is related to blind SQL Injection via the...

PT-2024-3206 · Mitel · Mitel 6900 Series +2

Name of the Vulnerable Software and Affected Versions: Mitel 6800 Series and 6900 Series SIP Phones versions through 6.3 SP3 HF4 Mitel 6900w Series SIP Phone versions through 6.3.3 Mitel 6970 Conference Unit versions through 5.1.1 SP8 Description: A buffer overflow attack can be conducted by an...

PT-2024-18481 · WordPress · Icon Widget

Name of the Vulnerable Software and Affected Versions: Icon Widget plugin for WordPress versions up to, and including, 1.3.0 Description: The issue is related to Stored Cross-Site Scripting via the plugin's shortcodes due to insufficient input sanitization and output escaping on user-supplied...

PT-2024-3701 · Glpi +2 · Glpi +2

Name of the Vulnerable Software and Affected Versions: GLPI versions prior to 10.0.15 Description: The issue concerns a SQL injection vulnerability that can be exploited by an authenticated user through the map search function. This vulnerability allows a remote attacker to disclose protected...