PT-2024-9489

Name of the Vulnerable Software and Affected Versions: Advantech EKI-6333AC-2G versions 1.6.3 and earlier Advantech EKI-6333AC-2GD versions 1.6.3 and earlier Advantech EKI-6333AC-1GPO versions 1.2.1 and earlier Description: The issue exists due to the lack of neutralization of special elements us...

PT-2024-16373 · WordPress · Cleantalk

Name of the Vulnerable Software and Affected Versions: Security & Malware scan by CleanTalk plugin for WordPress versions up to, and including, 2.145 Description: The issue is related to unauthorized SQL Injection due to an authorization bypass via reverse DNS spoofing on the checkWithoutToken...

PT-2024-9149 · Fuji Electric · Fuji Electric Tellus Lite V-Simulator 5

Name of the Vulnerable Software and Affected Versions: Fuji Electric Tellus Lite V-Simulator 5 version V8 Description: The issue is a remote code execution vulnerability that allows attackers to execute arbitrary code on affected installations of Fuji Electric Tellus Lite. This is due to a lack o...

PT-2024-8866 · Microsoft · Dynamics 365 Sales

Name of the Vulnerable Software and Affected Versions: Microsoft Dynamics 365 Sales versions prior to 3.24104.15 Description: The issue concerns a spoofing vulnerability in Microsoft Dynamics 365 Sales. This vulnerability may allow a remote attacker to perform a spoofing attack by not taking...

PT-2024-35970

Name of the Vulnerable Software and Affected Versions Mongoose versions prior to 8.8.3 Description The issue is related to the improper use of the $where operator in Mongoose, which can lead to search injection and potentially allow a remote attacker to execute arbitrary code and gain read and...

PT-2024-35784

Name of the Vulnerable Software and Affected Versions masterstack imgcap version 0.0.1 Description The issue is related to a SQL injection vulnerability. It can be exploited via the "/submit" endpoint. Recommendations For masterstack imgcap version 0.0.1, as a temporary workaround, consider...

PT-2024-35694 · Boidcms · Boidcms

Name of the Vulnerable Software and Affected Versions: BoidCMS versions prior to 2.1.2 Description: A reflected Cross-site Scripting XSS issue exists in the "admin?page=media" endpoint, specifically in the file parameter, allowing an attacker to inject arbitrary JavaScript code. This could lead t...

PT-2024-11584 · Ipp · Ipp

Name of the Vulnerable Software and Affected Versions: IPP software versions prior to 1.71 Description: The issue is related to a default credential vulnerability. This could lead attackers to identify and access vulnerable systems. Recommendations: For versions prior to 1.71, update to version...

PT-2024-9959

Name of the Vulnerable Software and Affected Versions: Firefox versions prior to 133 Thunderbird versions prior to 133 Description: The issue is related to the lack of thread synchronization primitives, which could lead to a data race on members of the PlaybackParams structure. This could...

PT-2024-15279

Name of the Vulnerable Software and Affected Versions DataGear versions up to 4.60 Description A critical issue affects the unknown code of the file /dataSet/resolveSql, where the manipulation of the sql argument leads to sql injection. The attack can be initiated remotely. Upgrading to version...

PT-2024-28098 · Synology · Notes Station

Name of the Vulnerable Software and Affected Versions: Notes Station 3 versions prior to 3.9.7 Description: An OS command injection issue has been reported, which could allow remote authenticated attackers to execute commands if exploited. Recommendations: For versions prior to 3.9.7, update to...

PT-2024-16620 · WordPress · The Tribute Testimonials

Name of the Vulnerable Software and Affected Versions: The Tribute Testimonials – WordPress Testimonial Grid/Slider plugin versions up to, and including, 1.0.4 Description: The issue is related to Stored Cross-Site Scripting via the plugin's tribute testimonials slider shortcode due to insufficie...

PT-2024-35462 · Argo Helm · Argo Helm

Name of the Vulnerable Software and Affected Versions: Argo Helm versions prior to 0.45.0 Description: The issue is related to the workflow-role lacking granularity in its privileges, giving unnecessary permissions to workflowtasksets and workflowartifactgctasks for all workflow Pods. This could...

PT-2024-38656 · Special Minds Design · E-Commerce

Name of the Vulnerable Software and Affected Versions: Special Minds Design and Software e-Commerce versions prior to 22.11.2024 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL...

CVE-2024-52309

SFTPGo CVE-2024-52309 involves the EventManager allowing administrators to execute scripts or commands, which can grant access to the underlying OS/container with the same permissions as the SFTPGo process. The root cause is that command execution could be performed by any admin with script-permi...

PT-2024-33325 · Microsoft · Edge

Name of the Vulnerable Software and Affected Versions: Microsoft Edge Chromium-based versions up to 131.0.2903.48 Description: The Microsoft Edge browser, specifically the Chromium-based version, is affected by a spoofing issue that can be remotely exploited. Users should upgrade Microsoft Edge t...

PT-2024-8878 · Unknown · Pandora Fms

Name of the Vulnerable Software and Affected Versions: Pandora FMS versions 700 through 777.4 Description: The issue is related to a command injection vulnerability in the LDAP authentication mechanism, allowing for the execution of arbitrary commands on the server. This can be exploited by a...

PT-2024-35726 · Totolink · Totolink A810R

Name of the Vulnerable Software and Affected Versions: TOTOLINK A810R version 4.1.2cu.5182 B20201026 Description: The issue is related to a Buffer Overflow in the downloadFlile.cgi endpoint. This can potentially allow for unauthorized access or execution of malicious code. Recommendations: For...

PT-2024-10480 · Drupal · Node Export

Name of the Vulnerable Software and Affected Versions: Drupal Node export versions 7.X- through 7.X-3.2 Description: The issue is related to the deserialization of untrusted data in the Node export module of the Drupal CMS, which can lead to object injection. This allows a remote attacker to...

PT-2024-35291 · Unknown · Aaron Robbins Post Ideas

Name of the Vulnerable Software and Affected Versions: Aaron Robbins Post Ideas versions n/a through 2 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows SQL Injection. This means an attacker can trick a user into performing unintended actions on the web...