PT-2024-22723 · Ninja Team · Ninjateam Database For Contact Form 7

Name of the Vulnerable Software and Affected Versions: NinjaTeam Database for Contact Form 7 versions 3.0.6 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for Stored XSS. This means that an attacker can inject malicious...

PT-2024-19187 · Elspec · Elspec G5 Digital Fault Recorder

Name of the Vulnerable Software and Affected Versions: Elspec G5 digital fault recorder versions 1.1.4.15 and before Description: The issue concerns weak permissions of the SQLite database file. Recommendations: For Elspec G5 digital fault recorder versions 1.1.4.15 and before, consider restricti...

PT-2024-19195 · Elspec · Elspec G5 Digital Fault Recorder

Name of the Vulnerable Software and Affected Versions: Elspec G5 digital fault recorder versions 1.1.4.15 and before Description: An issue was discovered where cleartext passwords and hashes are exposed through log files. Recommendations: For Elspec G5 digital fault recorder versions 1.1.4.15 and...

PT-2024-22478 · Freeimage +1 · Freeimage +1

Name of the Vulnerable Software and Affected Versions: FreeImage version 3.19.0 Description: The issue allows a local attacker to cause a denial of service DoS via the opj j2k read mct function when reading images in J2K format. Recommendations: For FreeImage version 3.19.0, consider disabling th...

PT-2024-21353 · Meta4 · Meta4 Hr

Name of the Vulnerable Software and Affected Versions: Meta4 HR versions 819.001.022 and earlier Description: A Cross-Site Scripting issue has been identified. The endpoint "/sitetest/english/dumpenv.jsp" is vulnerable to an XSS attack via the lang query. For example, the URL...

PT-2024-22757

Name of the Vulnerable Software and Affected Versions Restrict User Access – Membership Plugin with Force versions n/a through 2.5 Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Reflected XSS...

PT-2024-19189 · Elspec · Elspec G5 Digital Fault Recorder

Name of the Vulnerable Software and Affected Versions: Elspec G5 digital fault recorder versions 1.1.4.15 and before Description: An issue was discovered in the system logs download mechanism, allowing directory traversal to occur. This could potentially expose system logs. If local network acces...

PT-2024-12882 · Unknown · Openclinic Ga

Name of the Vulnerable Software and Affected Versions: OpenClinic GA version 5.247.01 Description: An issue was discovered in OpenClinic GA, allowing an attacker to perform a directory path traversal via the Page parameter in a GET request to the "main.do" endpoint. Recommendations: For OpenClini...

PT-2024-19196 · Elspec · Elspec G5 Digital Fault Recorder

Name of the Vulnerable Software and Affected Versions: Elspec G5 digital fault recorder versions 1.1.4.15 and before Description: An issue was discovered in the Elspec G5 digital fault recorder where the shadow file is world readable. Recommendations: For Elspec G5 digital fault recorder versions...

PT-2024-22440 · Shenzhen Libituo Technology Co. · Lbt-T300-Mini1

Name of the Vulnerable Software and Affected Versions: Shenzhen Libituo Technology Co., Ltd LBT-T300-mini1 version 1.2.9 Description: A buffer overflow issue was discovered via the lan ipaddr parameters at the "/apply.cgi" API endpoint. Recommendations: For version 1.2.9, consider restricting...

VulnCheck KEV: CVE-2024-29138

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Joachim Jensen Restrict User Access – Membership Plugin with Force restrict-user-access.This issue affects Restrict User Access – Membership Plugin with Force: from n/a through = 2.5...

PT-2024-2494 · Tenda · Tenda Ac7

Name of the Vulnerable Software and Affected Versions: Tenda AC7 version 15.03.06.44 Description: A critical issue was found in the saveParentControlInfo function of the /goform/saveParentControlInfo file, which is related to a stack-based buffer overflow. This can be exploited remotely by...

PT-2024-12880 · Unknown · Openclinic Ga

Name of the Vulnerable Software and Affected Versions: OpenClinic GA version 5.247.01 Description: A Reflected Cross-Site Scripting XSS issue has been discovered. The message parameter in the login.jsp is vulnerable. Recommendations: For OpenClinic GA version 5.247.01, avoid using the message...

WordPress Restrict User Access – Membership Plugin with Force Plugin <= 2.5 is vulnerable to Cross Site Scripting (XSS)

Software Restrict User Access – Membership Plugin with Force Type Plugin Vulnerable versions = 2.5 Fixed in 2.6 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-29138 Patch priority Medium CVSS severity Medium 7.1 Developer DEV Institute PSID 211a6e23f622 Credits...

PT-2024-15328 · Axis Communications · Axis Os

Name of the Vulnerable Software and Affected Versions: AXIS OS versions prior to the patched version Description: The VAPIX APIs, specifically the "mediaclip.cgi" and "playclip.cgi" endpoints, were found to be vulnerable to file globbing, which could lead to a resource exhaustion attack. This iss...

PT-2024-11747 · Siklu · Siklu Tg Terragraph

Name of the Vulnerable Software and Affected Versions: Siklu TG Terragraph devices versions prior to 2.1.1 Description: The issue allows attackers to discover valid, randomly generated credentials via the GetCredentials endpoint. This can potentially lead to unauthorized access. Recommendations:...

CVE-2024-27085 Denial of service through invites in Discourse

Discourse is an open source platform for community discussion. In affected versions users that are allowed to invite others can inject arbitrarily large data in parameters used in the invite route. The problem has been patched in the latest version of Discourse. Users are advised to upgrade. User...

PT-2024-40186 · Python · Python

Name of the Vulnerable Software and Affected Versions: Python versions prior to 0.4. Description: The issue affects users who do not want tracebacks included in their logs when errors occur in their code. If a user's code inadvertently includes sensitive information in a traceback and a malicious...

PT-2024-13998 · Sirv · Sirv

Name of the Vulnerable Software and Affected Versions: Sirv versions through 7.1.2 Description: The issue is related to a Missing Authorization vulnerability in Sirv. This vulnerability affects Sirv from version n/a through 7.1.2. Recommendations: For versions through 7.1.2, update to a version...

PT-2024-22389 · Gpac +2 · Gpac +2

Name of the Vulnerable Software and Affected Versions: gpac version 2.3-DEV-rev921-g422b78ecf-master Description: The issue is related to an out of boundary read vulnerability via the gf dash setup period function in the media tools/dash client.c file at line 6374. This vulnerability can allow a...