SAP NetWeaver Authorization Issues Vulnerability (CNVD-2024-49632)

SAP NetWeaver is the German SAP SAP company's set of service-oriented integrated application platform. The platform mainly for SAP applications to provide development and runtime environment. SAP NetWeaver suffers from an authorization issue vulnerability that stems from a lack of authorization...

PT-2024-37781 · Tnb Mobile Solutions · Tnb Mobile Solutions Cockpit

Name of the Vulnerable Software and Affected Versions: TNB Mobile Solutions Cockpit Software versions prior to v2.13 Description: The issue is related to the use of hard-coded credentials in TNB Mobile Solutions Cockpit Software, allowing unauthorized access to read sensitive strings within an...

PT-2024-39225 · Unknown · I-Doit Pro

Name of the Vulnerable Software and Affected Versions: idoit pro version 28 Description: A Cross-site Scripting XSS issue allows an attacker to retrieve session details of an authenticated user due to the lack of proper sanitization of the following parameters: id, lang, mNavID, name, pID,...

SAP Student Life Cycle Management 安全漏洞

SAP Student Life Cycle Management is a student life cycle management system from SAP, Germany. A security vulnerability exists in SAP Student Life Cycle Management, which results from an authenticated attacker with elevated privileges being able to use SLCM transaction functions to which access...

PT-2024-38993 · Abcd2 · Abcd2

Name of the Vulnerable Software and Affected Versions: ABCD ABCD2 versions up to 2.2.0-beta-1 Description: A problematic issue has been found in the software, affecting the processing of the file /buscar integrada.php. The manipulation of the Sub Expresion argument leads to cross-site scripting...

PT-2024-30800 · Zynith · Zynith

Name of the Vulnerable Software and Affected Versions: ZYNITH versions prior to 7.4.9 Description: The issue is related to a missing authorization vulnerability in ZYNITH, allowing access to functionality not properly constrained by Access Control Lists ACLs. This means that users can access...

PT-2024-29371

Name of the Vulnerable Software and Affected Versions phpipam version 1.6 Description The issue is a Cross Site Scripting XSS vulnerability. It occurs through the appadminimport-exportimport-load-data.php file. This allows for potential malicious script execution. Recommendations For phpipam...

PT-2024-31240 · Unknown · Eq Enterprise Management System

Name of the Vulnerable Software and Affected Versions: EQ Enterprise Management System versions prior to v2.0.0 Description: An issue in EQ Enterprise Management System allows attackers to execute a directory traversal via crafted requests. This issue affects versions prior to v2.0.0...

PT-2024-38809 · Pretix · Pretix

Name of the Vulnerable Software and Affected Versions: pretix versions up to 2024.7.0 Description: The issue allows malicious event organizers to inject HTML tags into e-mail previews on the settings page. The default Content Security Policy of pretix prevents execution of attacker-provided...

PT-2024-31480

Name of the Vulnerable Software and Affected Versions llama index versions prior to 0.10.38 Description An issue was discovered in the download/integration.py file, which includes an exec call for import of a class name specified by the cls name variable. This could potentially lead to execution ...

CVE-2024-22281 Apache Helix Front (UI): Helix front hard-coded secret in the express-session

UNSUPPORTED WHEN ASSIGNED The Apache Helix Front UI component contained a hard-coded secret, allowing an attacker to spoof sessions by generating their own fake cookies. This issue affects Apache Helix Front UI: all versions. As this project is retired, we do not plan to release a version that...

PT-2024-29896 · Hertzbeat · Hertzbeat

Name of the Vulnerable Software and Affected Versions: Hertzbeat versions 1.6.0 and earlier Description: Hertzbeat is an open source, real-time monitoring system. It declares an endpoint /api/monitor/monitorId/metric/metricFull to download job metrics. In the process, it executes a SQL query with...

PT-2024-22012 · Friendica · Friendica

Name of the Vulnerable Software and Affected Versions: Friendica version 2023.12 Description: A Cross Site Scripting issue allows a remote attacker to obtain sensitive information via the location parameter of the calendar event feature. Recommendations: For Friendica version 2023.12, consider...

PT-2024-26327 · Openbmc · Openbmc

Name of the Vulnerable Software and Affected Versions: OpenBMC versions FW1020.00 through FW1020.60 OpenBMC versions FW1030.00 through FW1030.50 OpenBMC versions FW1050.00 through FW1050.10 Description: A vulnerability in the combination of OpenBMC's default password and session management allows...

PT-2024-38071 · WordPress · Essential Addons For Elementor

Name of the Vulnerable Software and Affected Versions: The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress versions up to, and including, 5.9.27 Description: The issue is related to Stored Cross-Site Scripting via the no more...

The vulnerability of the Jenkins Automation Remoting server library allows for the execution of arbitrary code.

The vulnerability of the Jenkins Automation Remoting server library is related to deficiencies in path name restrictions for restricted access catalogs. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by loading class and resource files from the controller via...

The vulnerability of the Omnivise T3000 Application Server’s software-defined hardware environment for monitoring industrial processes in Siemens Omnivise T3000 systems arises from incorrect restrictions on path names in the restricted access catalog. This allows attackers to upload arbitrary files.

The vulnerability of the Omnivise T3000 Application Server, a software-and-hardware platform for managing and monitoring industrial processes from Siemens, is related to an incorrect limitation on the path name to the restricted access catalog. Exploiting this vulnerability allows a malicious act...

PT-2024-25620 · Unknown · School Management System +1

Name of the Vulnerable Software and Affected Versions: School Attendance Monitoring System and School Event Management System version 1.0 Description: A Cross-Site Scripting XSS issue allows an attacker to create a specially crafted URL and send it to a victim to obtain details of their session...

PT-2024-25623 · Unknown · School Management System

Name of the Vulnerable Software and Affected Versions: School Event Management System version 1.0 Description: A Cross-Site Scripting XSS issue affects the system, allowing an attacker to exploit it by sending a specially crafted query to the server. This can lead to the retrieval of all stored...

PT-2024-25625 · Unknown · School Management System

Name of the Vulnerable Software and Affected Versions: School Event Management System version 1.0 Description: The issue is related to a Cross-Site Scripting XSS vulnerability. An attacker could create a specially crafted URL and send it to a victim to obtain their session details via the view...