PT-2024-18345 · Unknown · Code-Projects Library System

Name of the Vulnerable Software and Affected Versions: code-projects Library System version 1.0 Description: A critical issue was found in the code-projects Library System, affecting some unknown functionality of the file Source/librarian/user/student/lost-password.php. The manipulation of the...

PT-2024-21817 · Onnx · Onnx

Name of the Vulnerable Software and Affected Versions: onnx versions prior to 1.15.0 Description: The issue allows Directory Traversal as the external data field of the tensor proto can have a path to a file outside the model's current directory or user-provided directory. This vulnerability occu...

PT-2024-18348 · Sourcecodester · Sourcecodester Employee Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Employee Management System version 1.0 Description: A critical issue was found in the system, affecting some unknown functionality of the file /Account/login.php. The manipulation of the txtusername argument leads to sql...

PT-2024-15660

Name of the Vulnerable Software and Affected Versions M-Files Server versions prior to 24.2 excluding 23.2 SR7 and 23.8 SR5 Description The issue allows an anonymous user to cause a denial of service against other anonymous users. Recommendations For versions prior to 24.2, update to version 24.2...

PT-2024-28099 · Unknown · Notes Station 3

Name of the Vulnerable Software and Affected Versions: Notes Station 3 versions prior to 3.9.7 Description: An incorrect permission assignment for critical resource vulnerability has been reported. If exploited, the vulnerability could allow local authenticated attackers who have gained...

PT-2024-21791 · Veritas · Veritas Ediscovery Platform

Name of the Vulnerable Software and Affected Versions: Veritas eDiscovery Platform versions prior to 10.2.5 Description: A vulnerability was discovered that allows the application administrator to upload potentially malicious files to arbitrary locations on the server where the application is...

PT-2024-21295 · Xwiki · Xwiki Application Licensing

Name of the Vulnerable Software and Affected Versions: XWiki Application Licensing versions prior to 1.24.2 Description: The XWiki licensor application includes a public document Licenses.Code.LicenseJSON that exposes sensitive information, including the instance's id, first and last name, and...

CVE-2024-1570

Affected software: ProfilePress (WordPress plugin) ≤ 4.14.4. Vulnerability: Stored Cross-Site Scripting via the login-password shortcode caused by insufficient input sanitization and output escaping on user-supplied attributes. Impact: Authenticated attackers with contributor-level permissions (o...

PT-2024-19579 · Timo · Timo

Name of the Vulnerable Software and Affected Versions: Timo version 2.0.3 Description: The issue allows a remote attacker to execute arbitrary code via the filetype restrictions in the UploadController.java component. Recommendations: For Timo version 2.0.3, consider disabling the...

PT-2024-20937 · Mrcms · Mrcms

Name of the Vulnerable Software and Affected Versions: MRCMS version 3.1.2 Description: The issue allows attackers to run arbitrary system commands via the status parameter, potentially leading to unauthorized access and control. Recommendations: For MRCMS version 3.1.2, avoid using the status...

PT-2024-20541 · Unknown · Jumpserver

Name of the Vulnerable Software and Affected Versions: JumpServer versions prior to 3.10.0 Description: The issue affects JumpServer, an open source bastion host and operation and maintenance security audit system. Attackers can exploit this to construct malicious links, leading users to click on...

PT-2024-12738 · Unknown · Weston Embedded Uc-Tcp-Ip

Name of the Vulnerable Software and Affected Versions: Weston Embedded uC-TCP-IP version 3.06.01 Description: A double-free vulnerability exists in the IP header loopback parsing functionality. This can be triggered by a specially crafted set of network packets, leading to memory corruption and...

PT-2024-1978 · Unknown · Meshcentral

Name of the Vulnerable Software and Affected Versions: MeshCentral versions prior to 1.1.21 Description: The issue is a cross-site websocket hijacking CSWSH vulnerability within the "control.ashx" endpoint, which is the primary mechanism used to perform administrative actions on the server. This...

PT-2024-20775

Name of the Vulnerable Software and Affected Versions apache-airflow-providers-mongo versions prior to 4.0.0 Description The issue arises when SSL is enabled for the Mongo Hook, and the default settings include allow insecure, which causes certificates not to be validated. This behavior is...

PT-2024-13449 · Tenda · Tenda Ax12 +3

Name of the Vulnerable Software and Affected Versions: Tenda TX9 V1 version 22.03.02.54 Tenda AX3 V3 version 16.03.12.11 Tenda AX9 V1 version 22.03.01.46 Tenda AX12 V1 version 22.03.01.46 Description: An access control issue in /usr/sbin/httpd allows attackers to bypass authentication on any...

PT-2024-17728 · WordPress · Essential Addons For Elementor

Name of the Vulnerable Software and Affected Versions: The Essential Addons for Elementor plugin for WordPress versions up to, and including, 5.9.8 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping, specifically via the...

PT-2024-20903 · Unknown · Libiec61850

Name of the Vulnerable Software and Affected Versions: libiec61850 versions 1.4.0 Description: The issue allows a remote attacker to cause a denial of service via the mmsServer handleGetNameListRequest function to the mms getnamelist service component. Recommendations: For version 1.4.0, consider...

PT-2024-17471 · WordPress · Kali Forms

Name of the Vulnerable Software and Affected Versions: Kali Forms plugin for WordPress versions prior to 2.3.42 Description: The Kali Forms plugin for WordPress is affected by an issue that allows unauthorized access and modification of data via API due to an inconsistent capability check on...

PT-2024-13238 · Unknown · Weston Embedded Uc-Http

Name of the Vulnerable Software and Affected Versions: Weston Embedded uC-HTTP version 80d4004 Description: A heap-based buffer overflow vulnerability exists in the HTTP Server functionality. A specially crafted network packet can lead to arbitrary code execution. An attacker can send a malicious...

PT-2024-13932 · Camera · Camera

Name of the Vulnerable Software and Affected Versions: Camera affected versions not specified Description: A flaw has been discovered that allows for an unauthenticated Denial of Service DoS attack on the camera. By running a crafted URL, an attacker can prevent access to the web management page ...