PT-2024-32987 · Sourcecodester · Sourcecodester Open Source Clinic Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Open Source Clinic Management System version 1.0 Description: A critical issue has been found in the SourceCodester Open Source Clinic Management System, affecting an unknown functionality of the file setting.php. The...

PT-2024-22376 · Unknown · Sourcecodester School Task Manager

Name of the Vulnerable Software and Affected Versions: Sourcecodester School Task Manager version 1.0 Description: A vulnerability was identified within the subject name= parameter, enabling Stored Cross-Site Scripting XSS attacks. This issue allows attackers to manipulate the subject's name,...

PT-2024-25225 · Open5Gs · Open5Gs

Name of the Vulnerable Software and Affected Versions: Open5GS version 2.7.0 Description: An issue in Open5GS allows an attacker to cause a denial of service via the 64 unsuccessful UE/gnb registration. Recommendations: For Open5GS version 2.7.0, at the moment, there is no information about a new...

Shanghai Sunfull Automation BACnet Server HMI1002-ARM 安全漏洞

The Shanghai Sunfull Automation BACnet Server HMI1002-ARM is a WEB configuration gateway from Shanghai Sunfull in China. A security vulnerability exists in the Shanghai Sunfull Automation BACnet Server HMI1002-ARM version 2.0.4, which is caused by a buffer overflow...

PT-2024-25586 · Unknown · Atanas Yonkov Pliska

Name of the Vulnerable Software and Affected Versions: Atanas Yonkov Pliska versions 0.3.5 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows for Stored XSS attacks. Recommendations: For...

PT-2024-22570 · Ibm · Ibm Websphere Automation

Name of the Vulnerable Software and Affected Versions: IBM WebSphere Automation version 1.7.0 Description: This issue allows users to embed arbitrary JavaScript code in the Web UI, potentially altering the intended functionality and leading to credentials disclosure within a trusted session...

PT-2024-13740 · Shenzhen · Shenzhen Jf6000 Cloud Media Collaboration Processing Platform

Name of the Vulnerable Software and Affected Versions: Shenzhen JF6000 Cloud Media Collaboration Processing Platform firmware version V1.2.0 Shenzhen JF6000 Cloud Media Collaboration Processing Platform software version V2.0.0 build 6245 Description: The issue is related to Incorrect Access...

PT-2024-25736 · Totolink · Totolink Cp450

Name of the Vulnerable Software and Affected Versions: TOTOLINK CPE CP450 version 4.1.0cu.747 B20191224 Description: A stack buffer overflow issue was found in the setIpQosRules function. This issue can potentially be exploited, but no details about the estimated number of affected devices or...

PYSEC-2024-209

Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. In versions 0.3.10 and prior, using the sqrt builtin can result in double eval vulnerability when the argument has side-effects. It can be seen that the buildIR function of the sqrt builtin doesn't cache the argument to...

OPENSUSE-SU-2024:0113-1 Security update for dcmtk

This update for dcmtk fixes the following issues: Fixed incorrect type conversion in the DVPSSoftcopyVOIPList:createFromImage functionality of OFFIS DCMTK boo1223324, CVE-2024-28130 - Add missing requirements for dcmtk-devel boo1220809 - Update to 3.6.8 See DOCS/CHANGES.368 for the full list of...

SUSE-SU-2024:1415-1 Security update for cockpit-wicked

This update for cockpit-wicked fixes the following issues: - CVE-2023-26364: Fixed denial of service due to improper input validation during CSS parsing bsc1217325 Other fixes: - Update to version 5git8.c06c55b...

CVE-2024-30951

FUDforum v3.1.3 was discovered to contain a reflected cross-site scripting XSS vulnerability via the chpos parameter at /adm/admsmiley.php...

CVE-2024-3852

GetBoundName could return the wrong version of an object when JIT optimizations were applied. This vulnerability affects Firefox 125, Firefox ESR 115.10, and Thunderbird 115.10...

PT-2024-24187 · Shibang Communications · Shibang Communications Co.

Name of the Vulnerable Software and Affected Versions: Shibang Communications Co., Ltd. IP network intercom broadcasting system version 1.0 Description: The issue allows a local attacker to execute arbitrary code via the my parser.php component. This is a result of a File Upload vulnerability in...

CVE-2024-32139 WordPress Podlove Podcast Publisher plugin <= 4.0.12 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Podlove Podlove Podcast Publisher.This issue affects Podlove Podcast Publisher: from n/a through 4.0.12...

CVE-2024-22721

Cross Site Request Forgery CSRF vulnerability in Form Tools 3.1.1 allows attackers to manipulate sensitive user data via crafted link...

Vulnerabilities fixed in Apache HTTP Server

Apache has fixed vulnerabilities in Apache HTTP Server. The vulnerabilities potentially allow a malicious party to launch attacks execute attacks that result in the following categories of damage: Denial-of-Service DoS Apache has released updates to fix the vulnerabilities in Apache server 2.4.59...

CVE-2020-36829

The Mojolicious module before 8.65 for Perl is vulnerable to securecompare timing attacks that allow an attacker to guess the length of a secret string. Only versions after 1.74 are affected...

PT-2024-23863 · Sunshine · Sunshine

Name of the Vulnerable Software and Affected Versions: Sunshine versions 0.10.0 through 0.22.x Description: The issue affects Sunshine, a self-hosted game stream host for Moonlight. After unpairing all devices in the web UI interface and then pairing only one device, all of the previously paired...

CVE-2024-29892 ZITADEL's actions can overload reserved claims

ZITADEL, open source authentication management software, uses Go templates to render the login UI. Under certain circumstances an action could set reserved claims managed by ZITADEL. For example it would be possible to set the claim urn:zitadel:iam:user:resourceowner:name. To compensate for this ...