PT-2024-5218

Name of the Vulnerable Software and Affected Versions: Express.js versions prior to 4.19.0 Express.js pre-release alpha and beta versions of 5.0 prior to 5.0.0-beta.3 Description: The issue is related to an open redirect vulnerability using malformed URLs. When Express performs a redirect using a...

PT-2024-23254 · Gnu +9 · Emacs +10

Name of the Vulnerable Software and Affected Versions: Emacs versions prior to 29.3 Org Mode versions prior to 9.6.23 Description: The issue arises because Org mode in Emacs considers the contents of remote files to be trusted. This could potentially lead to security issues if malicious content i...

PT-2024-12450 · Hasthemes · Hashthemes Viral +2

Name of the Vulnerable Software and Affected Versions: HashThemes Viral News versions 1.4.5 and earlier HashThemes Viral versions 1.8.0 and earlier HashThemes HashOne versions 1.3.0 and earlier Description: The issue is related to a Missing Authorization vulnerability in HashThemes products. This...

PT-2024-4137 · Unknown · Wix Toolset

Name of the Vulnerable Software and Affected Versions: WiX Toolset versions prior to 3.14.1 WiX Toolset versions prior to 4.0.5 Description: The custom action behind WiX's RemoveFolderEx functionality could allow a standard user to delete protected directories. RemoveFolderEx deletes an entire...

PT-2024-21653 · Frappe · Frappe

Name of the Vulnerable Software and Affected Versions: Frappe versions prior to 14.66.3 Frappe versions prior to 15.16.0 Description: Frappe is a full-stack web application framework. The issue allows file permission to be bypassed using certain endpoints, granting less privileged users permissio...

PT-2024-10423 · Dcmtk +4 · Dcmtk +4

Name of the Vulnerable Software and Affected Versions: DCMTK versions prior to 3.6.9 Description: The issue is related to a segmentation fault in the dcmdata component of the DCMTK library, which can be triggered by an invalid DIMSE message. This can potentially allow a remote attacker to cause a...

ROS-2-1926

2.1926 Denial of Service in Libxml2 CVE-2021-3541 1. Vulnerability Description: The vulnerability allows a remote attacker to perform a denial of service DoS attack. The vulnerability exists due to insufficient validation of user input. A remote attacker can pass specially crafted input data to a...

PT-2024-19066 · Unknown · Skysea Client View

Name of the Vulnerable Software and Affected Versions: SKYSEA Client View versions from Ver.16.100 prior to Ver.19.2 Description: An improper access control vulnerability exists in a specific folder of the software. This vulnerability can be exploited by a user who can log in to the PC where the...

PT-2024-3887

Name of the Vulnerable Software and Affected Versions Django versions 3.2 through 3.2.24 Django versions 4.2 through 4.2.10 Django versions 5.0 through 5.0.2 Description The issue is related to a potential regular expression denial-of-service in the django.utils.text.Truncator.words method. This...

PT-2024-20652 · Dell · Dell Secure Connect Gateway (Scg) Policy Manager

Name of the Vulnerable Software and Affected Versions: Dell Secure Connect Gateway SCG Policy Manager, all versions Description: The issue is related to an improper authorization vulnerability. An attacker with low privileges on an adjacent network could potentially exploit this, leading to...

PT-2024-20275 · Unknown · Crmeb Java

Name of the Vulnerable Software and Affected Versions: crmeb java versions prior to 1.3.4 Description: The issue allows attackers to execute arbitrary SQL commands by sending a crafted GET request to the "api/front/spread/people" endpoint. This enables attackers to manipulate the database,...

PT-2024-20504 · Unknown · W3Speedster

Name of the Vulnerable Software and Affected Versions: W3SPEEDSTER versions prior to 7.20 Description: A Cross-Site Request Forgery CSRF issue affects the software, allowing unauthorized actions to be performed on behalf of a user. Recommendations: For versions prior to 7.20, update to version 7....

PT-2024-19285 · Terminalfour · Terminalfour +1

Name of the Vulnerable Software and Affected Versions: Terminalfour versions 7.4 through 7.4.0004 QP3 Terminalfour versions 8 through 8.3.19 Formbank versions through 2.1.10-FINAL Description: An issue allows Unauthenticated Stored Cross-Site Scripting, potentially leading to Admin Session...

PT-2024-10915 · Liferay · Liferay Dxp +1

Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.2.0 through 7.3.5 Liferay DXP 7.3 before fix pack 1 Liferay DXP 7.2 before fix pack 17 Description: The issue allows attackers to use man-in-the-middle or shoulder surfing attacks to steal user's password reminder...

PT-2024-11055 · Meinberg · Meinberg Lantime-Firmware +1

Name of the Vulnerable Software and Affected Versions: Meinberg LANTIME-Firmware versions 6.24.029 and earlier Meinberg LANTIME-Firmware versions 7.04.008 and earlier Description: An issue was discovered in the LTOS-Web-Interface where path validation is mishandled. This allows an admin to read o...

PT-2024-1711

Name of the Vulnerable Software and Affected Versions libxml2 versions 2.11.7 and earlier libxml2 versions 2.12.x through 2.12.4 Description A use-after-free flaw was found in the xmlValidatePopElement function of the libxml2 library when using the XML Reader interface with DTD validation and...

PT-2024-20111 · Ledgersmb +3 · Ledgersmb +3

Name of the Vulnerable Software and Affected Versions: LedgerSMB versions prior to 1.10.30 LedgerSMB versions prior to 1.11.9 Description: LedgerSMB is a free web-based double-entry accounting system. When a LedgerSMB database administrator has an active session in "/setup.pl", an attacker can...

PT-2024-3256 · Mediawiki +1 · Mediawiki +1

Name of the Vulnerable Software and Affected Versions: MediaWiki versions prior to 1.39.7 MediaWiki versions 1.40.x prior to 1.40.3 MediaWiki versions 1.41.x prior to 1.41.1 Description: The issue is related to the incorrect neutralization of input during web page creation in the...

PT-2024-1776 · Apple · Macos Sonoma +5

Name of the Vulnerable Software and Affected Versions: watchOS versions prior to 10.3 iOS versions prior to 17.3 and 16.7.5 iPadOS versions prior to 17.3 and 16.7.5 macOS Sonoma versions prior to 14.3 Safari versions prior to 17.3 Description: A privacy issue was addressed with improved handling ...

PT-2024-11967 · WordPress · Directorist Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Directorist WordPress plugin versions prior to 7.5.4 Description: The issue is related to Local File Inclusion, where the plugin does not validate the file parameter when importing CSV files. This allows for potential exploitation. There is n...