PT-2024-21396 · Openemr · Openemr

Name of the Vulnerable Software and Affected Versions: open-emr versions prior to 7.0.2 Description: An issue in open-emr allows a remote attacker to escalate privileges via a crafted script to the formid parameter in the ereq form.php component. Recommendations: For versions prior to 7.0.2, upda...

PT-2024-21652 · Querybook · Querybook

Name of the Vulnerable Software and Affected Versions: Querybook versions prior to 3.31.2 Description: The issue arises from the use of dangerouslySetInnerHTML when highlighting search results, which can trigger an XSS payload if the result contains malicious code. Additionally, during "query...

PT-2024-1971

Name of the Vulnerable Software and Affected Versions Cisco FXOS Software affected versions not specified Cisco NX-OS Software affected versions not specified Description A vulnerability in the Link Layer Discovery Protocol LLDP feature could allow an unauthenticated, adjacent attacker to cause a...

Intel® NUC Software Advisory

Summary: Potential security vulnerabilities in some Intel® NUC software installers may allow escalation of privilege or denial of service. Intel is releasing software updates to mitigate these potential vulnerabilities. Vulnerability Details: CVEID: CVE-2023-32272 Description: Uncontrolled search...

CVE-2023-51518 Apache James server: Privilege escalation via JMX pre-authentication deserialisation

Apache James prior to version 3.7.5 and 3.8.0 exposes a JMX endpoint on localhost subject to pre-authentication deserialisation of untrusted data. Given a deserialisation gadjet, this could be leveraged as part of an exploit chain that could result in privilege escalation. Note that by default JM...

PT-2024-1879 · Teamviewer · Teamviewer Remote Client

Name of the Vulnerable Software and Affected Versions: TeamViewer Remote Client versions prior to 15.51.5 for Windows, Linux, and macOS Description: The issue is related to improper initialization of default settings, allowing a low-privileged user to elevate privileges by changing the personal...

CVE-2024-24564 Vyper extract32 can ready dirty memory

Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. When using the built-in extract32b, start, if the start index provided has for side effect to update b, the byte array to extract 32 bytes from, it could be that some dirty memory is read and returned by extract32. This...

PT-2024-21902

Name of the Vulnerable Software and Affected Versions LangChain versions prior to 0.1.8 langchain experimental versions prior to 0.0.52 Description The issue allows an attacker to bypass a previous fix and execute arbitrary code via certain attributes in Python code, including import , subclasses...

`@backstage/backend-common` vulnerable to path traversal through symlinks

Impact Paths checks with the resolveSafeChildPath utility were not exhaustive enough, leading to risk of path traversal vulnerabilities if symlinks can be injected by attackers. Patches Patched in @backstage/backend-common version 0.21.1. Patched in @backstage/backend-common version 0.20.2. Patch...

GHSA-77FC-4CV5-HMFR baserCMS OS command injection vulnerability in Installer

There is a OS command injection in Installer Feature to baserCMS. Target baserCMS 5.0.8 and earlier versions Vulnerability Malicious command may be executed in Installer. Countermeasures Update to the latest version of baserCMS Please refer to the following page to reference for more information...

CVE-2024-1707

A vulnerability, which was classified as problematic, was found in GARO WALLBOX GLB+ T2EV7 0.5. This affects an unknown part of the file /index.jspsettings of the component Software Update Handler. The manipulation of the argument Reference leads to cross site scripting. It is possible to initiat...

CVE-2024-1707 GARO WALLBOX GLB+ T2EV7 Software Update index.jsp#settings cross site scripting

A vulnerability, which was classified as problematic, was found in GARO WALLBOX GLB+ T2EV7 0.5. This affects an unknown part of the file /index.jspsettings of the component Software Update Handler. The manipulation of the argument Reference leads to cross site scripting. It is possible to initiat...

CVE-2024-1707 GARO WALLBOX GLB+ T2EV7 Software Update index.jsp#settings cross site scripting

A vulnerability, which was classified as problematic, was found in GARO WALLBOX GLB+ T2EV7 0.5. This affects an unknown part of the file /index.jspsettings of the component Software Update Handler. The manipulation of the argument Reference leads to cross site scripting. It is possible to initiat...

GHSA-468X-FRCM-GHX6 Liferay Portal and Liferay DXP vulnerable to reflected Cross-site Scripting

Reflected cross-site scripting XSS vulnerability in the instance settings for Accounts in Liferay Portal 7.4.3.44 through 7.4.3.97, and Liferay DXP 2023.Q3 before patch 6, and 7.4 update 44 through 92 allows remote attackers to inject arbitrary web script or HTML via a crafted payload injected in...

PT-2024-20571 · John Tendik · Jtrt Responsive Tables

Name of the Vulnerable Software and Affected Versions: JTRT Responsive Tables versions through 4.1.9 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability in John Tendik JTRT Responsive Tables. This type of vulnerability allows an attacker to trick a user into performing...

PT-2024-20909 · Emlog Pro · Emlog Pro

Name of the Vulnerable Software and Affected Versions: Emlog Pro version 2.2.8 Description: The issue is related to a Stored XSS vulnerability in the article publishing feature, caused by the non-filtering of quoted content. Recommendations: For Emlog Pro version 2.2.8, update to a newer version...

GARO Wallbox GLB/GTB/GTC Cross-Site Scripting Vulnerability

The GARO Wallbox GLB/GTB/GTC is an electric vehicle charger from the Swedish company GARO. A cross-site scripting vulnerability exists in GARO WALLBOX GLB+ T2EV7 version 0.5, which stems from a cross-site scripting vulnerability in the component Software Update Handler...

PT-2024-21195 · Unknown +1 · Tinymce Advanced Professional Formats/Styles +1

Name of the Vulnerable Software and Affected Versions: TinyMCE and TinyMCE Advanced Professional Formats and Styles versions n/a through 1.1.2 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing...

CVE-2024-25640 Improper Neutralization of Alternate XSS Syntax in iris-web

Iris is a web collaborative platform that helps incident responders share technical details during investigations. A stored Cross-Site Scripting XSS vulnerability has been identified in iris-web, affecting multiple locations in versions prior to v2.4.0. The vulnerability may allow an attacker to...

KLA65144 Multiple vulnerabilities in Apache Tomcat

Multiple vulnerabilities were found in Apache Tomcat. Malicious users can exploit these vulnerabilities to cause denial of service. Below is a complete list of vulnerabilities: 1. A denial of service vulnerability in WebSocket client can be exploited remotely to cause denial of service. 2. A deni...