PT-2024-19557

Name of the Vulnerable Software and Affected Versions Hitron Systems DVR LGUVR-8H versions 1.02 through 4.02 Description The issue is related to improper input validation, which can allow an attacker to cause a network attack if the default admin ID and password are used. Recommendations For...

PT-2024-20040

Name of the Vulnerable Software and Affected Versions LlamaHub aka llama-hub versions prior to 0.0.67 Description The OpenAPI and ChatGPT plugin loaders in LlamaHub allow attackers to execute arbitrary code because safe load is not used for YAML. This issue enables attackers to execute arbitrary...

PT-2024-15806 · European Chemicals Agency · Iuclid

Name of the Vulnerable Software and Affected Versions: European Chemicals Agency IUCLID version 7.10.3 Description: A critical vulnerability was found in the European Chemicals Agency IUCLID, affecting an unknown function of the file iuclid6.exe of the component Desktop Installer. The manipulatio...

CVE-2024-23331

Vite is a frontend tooling framework for javascript. The Vite dev server option server.fs.deny can be bypassed on case-insensitive file systems using case-augmented versions of filenames. Notably this affects servers hosted on Windows. This bypass is similar to CVE-2023-34092 -- with surface area...

CVE-2024-23331 Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem

Vite is a frontend tooling framework for javascript. The Vite dev server option server.fs.deny can be bypassed on case-insensitive file systems using case-augmented versions of filenames. Notably this affects servers hosted on Windows. This bypass is similar to CVE-2023-34092 -- with surface area...

CVE-2022-45083

Deserialization of Untrusted Data vulnerability in ProfilePress Membership Team Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress.This issue affects Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User...

CVE-2022-45083

Deserialization of Untrusted Data vulnerability in ProfilePress Membership Team Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress.This issue affects Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User...

Deserialization of untrusted data

Deserialization of Untrusted Data vulnerability in ProfilePress Membership Team Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress.This issue affects Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User...

CVE-2022-45083 WordPress ProfilePress Plugin <= 4.3.2 is vulnerable to PHP Object Injection

Deserialization of Untrusted Data vulnerability in ProfilePress Membership Team Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress.This issue affects Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User...

PT-2024-14326

Name of the Vulnerable Software and Affected Versions YonBIP version 3 23.05 Description An arbitrary file upload vulnerability in the doAction method of nccloud.web.arcp.taskmonitor.action.ArcpUploadAction allows attackers to execute arbitrary code via uploading a crafted file. Recommendations F...

CVE-2022-45083: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in ProfilePress Membership Team Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress.This issue affects Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User...

PT-2024-15796 · Unknown · Hecheng Leadshop

Name of the Vulnerable Software and Affected Versions: Hecheng Leadshop versions up to 1.4.20 Description: A critical issue was found in Hecheng Leadshop, affecting an unknown function of the file /web/leadshop.php. The manipulation of the install argument leads to deserialization. It is possible...

PT-2024-15786 · Foru Cms · Foru Cms

Name of the Vulnerable Software and Affected Versions: ForU CMS versions up to 2020-06-23 Description: A critical issue has been found in ForU CMS, affecting some unknown functionality of the file cms admin.php. The manipulation of the a name argument leads to sql injection. The exploit has been...

PT-2024-15785 · Foru Cms · Foru Cms

Name of the Vulnerable Software and Affected Versions: ForU CMS versions up to 2020-06-23 Description: A problematic issue was found in ForU CMS, affecting an unknown functionality of the file channel.php. The manipulation of the c cmodel argument leads to file inclusion. This issue can be...

PT-2024-14327

Name of the Vulnerable Software and Affected Versions YonBIP version 3 23.05 Description The issue is an arbitrary file read vulnerability. It occurs via the CommonServletDispatcher component in the nc.bs.framework.comn.serv package. Recommendations For YonBIP version 3 23.05, consider restrictin...

PT-2024-15776 · Byzoro · Byzoro Smart S150 Management Platform

Name of the Vulnerable Software and Affected Versions: Byzoro Smart S150 Management Platform version V31R02B15 Description: A vulnerability has been found in the Byzoro Smart S150 Management Platform, affecting an unknown part of the file /log/download.php of the component Backup File Handler. Th...

PT-2024-19481 · Flycms · Flycms

Name of the Vulnerable Software and Affected Versions: FlyCms version 1.0 Description: The issue is related to Cross Site Scripting XSS in the email settings of the website settings section. This allows for potential malicious script injection. Recommendations: For FlyCms version 1.0, as a...

PT-2024-19408 · Unknown · Group-Office

Name of the Vulnerable Software and Affected Versions: Group-Office versions prior to 6.8.29 Description: The issue is related to the file upload mechanism in Group-Office, allowing an attacker to execute arbitrary JavaScript code by embedding it within a file's name. For example, using a filenam...

PT-2024-12764 · Ibm · Ibm Openpages With Watson

Name of the Vulnerable Software and Affected Versions: IBM OpenPages with Watson versions 8.3 through 9.0 Description: The issue provides weaker than expected security in an OpenPages environment using Native authentication. An attacker with access to the OpenPages database could exploit this...

PT-2024-19501 · Flycms · Flycms

Name of the Vulnerable Software and Affected Versions: FlyCms version 1.0 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. It occurs via the "/system/links/add link" API endpoint. This allows for potentially malicious requests to be made without the user's knowledge or...