PT-2024-13008 · Kiloview · P1/P2 +2

Name of the Vulnerable Software and Affected Versions: No specific software or versions mentioned. Description: The system is exposed to potential remote code execution risks due to inadequate input validation. Attackers can exploit this by appending shell commands to the Speed-Measurement featur...

CVE-2024-37145

Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, a reflected cross-site scripting vulnerability occurs in the /api/v1/chatflows-streaming/id endpoint. If the default configuration is used unauthenticated, an attacker may be able...

CVE-2024-37145 GHSL-2023-247: Flowise xss in /api/v1/chatflows-streaming/id

Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, a reflected cross-site scripting vulnerability occurs in the /api/v1/chatflows-streaming/id endpoint. If the default configuration is used unauthenticated, an attacker may be able...

CVE-2024-36423

Flowise 1.4.3 has a reflected cross-site scripting (XSS) vulnerability in the endpoint /api/v1/public-chatflows/id. When configured unauthenticated, an attacker can craft a URL that injects JavaScript into user sessions, potentially stealing information, creating false popups, or redirecting user...

Microsoft Edge Buffer Error Vulnerability

Microsoft Edge is a web browser from Microsoft Corporation USA that comes with systems after Windows 10. A buffer error vulnerability exists in Microsoft Edge. No information about this vulnerability is available at this time, so stay tuned to CNNVD or the vendor announcement...

PT-2024-37577 · Unknown · Sourcecodester Online Food Ordering System

Name of the Vulnerable Software and Affected Versions: itsourcecode Online Food Ordering System version 1.0 Description: A critical issue has been found in the itsourcecode Online Food Ordering System, affecting the file /addproduct.php. The manipulation of the photo argument leads to unrestricte...

PT-2024-37354

Name of the Vulnerable Software and Affected Versions: Phloc Webscopes version 7.0.0 Description: An information disclosure issue allows local attackers with access to the log files to view logged HTTP requests that contain user passwords or other sensitive information. Recommendations: For Phloc...

PT-2024-25209 · H3C · H3C Seasql Dws

Name of the Vulnerable Software and Affected Versions: H3C SeaSQL DWS version 2.0 Description: The issue allows a remote attacker to execute arbitrary code via a crafted file. This is a result of a SQL Injection vulnerability in the H3C SeaSQL DWS product. Recommendations: For H3C SeaSQL DWS...

PT-2024-4675 · Huawei · Huawei Ws7206-10 +3

Name of the Vulnerable Software and Affected Versions: Huawei home routers affected versions not specified Huawei TC7001-10, WS7200-10, and WS7206-10 affected versions not specified Description: The issue is related to a connection hijacking vulnerability in some Huawei home routers. This...

CVE-2024-38394

A flaw was found in gnome-settings-daemon. This vulnerability allows an attacker, via kernel and local access, to access and jeopardize the USB in a Linux environment. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product...

PT-2024-4376 · Google +5 · Google Chrome +5

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 126.0.6478.114 Microsoft Edge affected versions not specified Description: The issue is related to a use after free vulnerability in the Dawn component, which can lead to heap corruption. A remote attacker can...

PT-2024-21680 · Toshiba · Toshiba Printers

Name of the Vulnerable Software and Affected Versions: Toshiba printers affected versions not specified Description: The issue concerns a Local Privilege Escalation vulnerability, allowing an attacker to remotely compromise Toshiba printers. Recommendations: At the moment, there is no information...

PT-2024-37291 · Unknown · Itsourcecode Online House Rental System

Name of the Vulnerable Software and Affected Versions: itsourcecode Online House Rental System version 1.0 Description: A critical issue has been found in the itsourcecode Online House Rental System, affecting an unknown function of the file manage user.php. The manipulation of the id argument...

PT-2024-21706 · Unknown · Remote Command Program

Name of the Vulnerable Software and Affected Versions: Remote Command program affected versions not specified Description: The issue allows an attacker to achieve Remote Code Execution through the Remote Command program. Recommendations: At the moment, there is no information about a newer versio...

document-merge-service vulnerable to Remote Code Execution via Server-Side Template Injection

Impact What kind of vulnerability is it? Who is impacted? A remote code execution RCE via server-side template injection SSTI allows for user supplied code to be executed in the server's context where it is executed as the document-merge-server user with the UID 901 thus giving an attacker...

PT-2024-4229

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 126.0.6478.54 Microsoft Edge affected versions not specified Description The issue is related to a use after free in PDFium, which can potentially allow a remote attacker to exploit heap corruption via a crafted...

PT-2024-4270

Name of the Vulnerable Software and Affected Versions Microsoft Streaming Service affected versions not specified Windows affected versions not specified Description The issue is related to a use-after-free vulnerability in the Microsoft Streaming Service of Windows operating systems, which can...

PT-2024-37140 · Unknown · Sourcecodester Stock Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Stock Management System version 1.0 Description: A critical vulnerability has been found in the SourceCodester Stock Management System, affecting an unknown functionality of the file index.php of the component Login. The...

BIT-NODE-2024-27983

An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside. It is possible to leave some data in nghttp2 memory after reset when headers with HTTP/2 CONTINUATION frame are sent to the server and then a T...

PT-2024-27066 · Idccms · Idccms

Name of the Vulnerable Software and Affected Versions: idccms version 1.35 Description: The issue is related to a Cross-Site Request Forgery CSRF that was discovered in idccms. This CSRF is accessible via the "admin/vpsCompany deal.php?mudi=del" endpoint. Recommendations: For idccms version 1.35,...