PT-2024-35244 · Unknown · B-Banner Slider

Name of the Vulnerable Software and Affected Versions: B-Banner Slider versions 1.1 and earlier Description: The issue is related to an unrestricted upload of files with dangerous types, allowing an attacker to upload a web shell to a web server. This poses a severe cybersecurity risk...

UBUNTU-CVE-2024-43417

GLPI is a free asset and IT management software package. An unauthenticated user can provide a malicious link to a GLPI technician in order to exploit a reflected XSS vulnerability located in the Software form. Upgrade to 10.0.17...

Information Exposure

Overview calibreweb is a Web app for browsing, reading and downloading eBooks stored in a Calibre database. Affected versions of this package are vulnerable to Information Exposure in shelf.py, which includes the name of the shelf in error output. An attacker can view shelf names owned by other...

PT-2024-15883 · Openemr · Openemr

Name of the Vulnerable Software and Affected Versions: openemr/openemr version 7.0.1 Description: A stored cross-site scripting XSS issue exists in the Secure Messaging feature. An attacker can inject malicious payloads into the inputBody field, which can then be sent to other users. When the...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the mimes parameter. Details Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be sent through streams. The reverse...

Mozilla Thunderbird < 132.0.1

The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 132.0.1. It is, therefore, affected by a vulnerability as referenced in the mfsa2024-62 advisory. - Using remote content in OpenPGP encrypted messages can lead to the disclosure of plaintext. CVE-2024-11159 Note...

Unchecked Input for Loop Condition

Overview System.Formats.Nrbf is a package that exposes only one component: NrbfDecoder: a stateless, forward-only decoder class that can decode .NET Remoting Binary Format NRBF binary data from a stream. Affected versions of this package are vulnerable to Unchecked Input for Loop Condition via th...

Improper Input Validation

Overview ansible-core is an a radically simple IT automation system. It handles configuration management, application deployment, cloud provisioning, ad-hoc task execution, network automation, and multi-node orchestration. Ansible makes complex changes like zero-downtime rolling updates with load...

Exposed Dangerous Method or Function

Overview orchid/platform is a Platform for back-office applications, admin panel or CMS your Laravel app. Affected versions of this package are vulnerable to Exposed Dangerous Method or Function in the asynchronous modal functionality via the Screen class. An attacker can call arbitrary methods...

Access Control Bypass

Overview moodle/moodle is a learning platform. Affected versions of this package are vulnerable to Access Control Bypass due to insufficient access control mechanisms implemented in the external API for quiz overrides. Remediation Upgrade moodle/moodle to version 4.4.2 or higher. References -...

Authentication Bypass Using an Alternate Path or Channel

Overview codechecker is an analyzer tooling, defect database and viewer extension Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel due to improperly parsing the endpoint path, which allows bypassing authentication on all but the...

Unverified Password Change

Overview OctoPrint is a snappy web interface for your 3D printer Affected versions of this package are vulnerable to Unverified Password Change due to improper authentication in the settings interface. An attacker can gain unauthorized access to API keys and potentially disrupt system operations ...

CVE-2024-51500 Failure to check for packets from the broadcast address allows potential DDoS amplification attack in Meshtastic firmware

Meshtastic firmware is a device firmware for the Meshtastic project. The Meshtastic firmware does not check for packets claiming to be from the special broadcast address 0xFFFFFFFF which could result in unexpected behavior and potential for DDoS attacks on the network. A malicious actor could cra...

SQL Injection

Overview mysql-connector-python is a MySQL driver written in Python which does not depend on MySQL C client libraries and implements the DB API v2.0 specification PEP-249. Affected versions of this package are vulnerable to SQL Injection due to improper sanitization of schema and table names...

PT-2024-32964 · Elementor · Happy Addons For Elementor

Name of the Vulnerable Software and Affected Versions: Happy Addons for Elementor versions 3.12.3 and earlier Description: The issue is related to a Missing Authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This enables unauthorized acces...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data allowing an attacker to execute arbitrary code or gain unauthorized access by intercepting traffic between a replication client and server or controlling the target replication node URL. Details...

PT-2024-34162 · Unknown · Icg.Aspnetcore.Utilities.Cloudstorage

Name of the Vulnerable Software and Affected Versions: ICG.AspNetCore.Utilities.CloudStorage versions prior to 8.0.0 Description: The issue affects users of the ICG.AspNetCore.Utilities.CloudStorage library who set a duration for a SAS Uri with a value other than 1 hour, potentially resulting in ...

PT-2024-34152

Name of the Vulnerable Software and Affected Versions: symfony/http-client versions prior to 5.4.46 symfony/http-client versions prior to 6.4.14 symfony/http-client versions prior to 7.1.7 Description: The issue is related to the NoPrivateNetworkHttpClient in the symfony/http-client module, which...

Code Injection

Overview snyk-php-plugin is a plugin for the Snyk CLI tool, providing dependency metadata for PHP projects. Affected versions of this package are vulnerable to Code Injection when scanning an untrusted PHP project. The vulnerability can be triggered if Snyk test is run inside the untrusted projec...

Cross-site Request Forgery (CSRF)

Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the redirect parameter in Commerce Catalogs. An attacker can perform administrative actions, execute arbitrary code, and alter user settings by convincing a user to follow a malicious link. Remediatio...