PT-2024-34819 · Unknown · Sastra Essential Addons For Elementor

Name of the Vulnerable Software and Affected Versions: Sastra Essential Addons for Elementor versions 1.0.0 through 1.0.5 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. Specifically, it is a DOM-Based XSS...

Filament 安全漏洞

Filament is a collection of full-stack components used to accelerate Laravel development from Filament open source. A security vulnerability exists in Filament versions prior to 3.2.0 through 3.2.123, which stems from the use of the public disk as the default disk, resulting in sensitive data bei...

Apache Solr 5.3.0 < 8.11.4 / 9.x < 9.7.0 Authentication Bypass

Apache Solr versions 5.3.0 prior to 8.11.4 or 9.x prior to 9.7.0 using the PKIAuthenticationPlugin, which is activated by default when Solr authentication is used, enables an attacker to bypass authentication via a specially forged request. No source data...

PT-2024-34305 · Unknown · Stacks Mobile App Builder

Name of the Vulnerable Software and Affected Versions: Stacks Mobile App Builder versions n/a through 5.2.3 Description: The issue allows exposure of sensitive system information to an unauthorized control sphere, enabling the retrieval of embedded sensitive data. Recommendations: For versions n/...

PT-2024-30784 · Arraytics · Arraytics Timetics

Name of the Vulnerable Software and Affected Versions: Arraytics Timetics versions 1.0.0 through 1.0.23 Description: The issue is related to a Missing Authorization vulnerability, which allows accessing functionality not properly constrained by ACLs. Recommendations: For versions 1.0.0 through...

LyLme Spage 安全漏洞

LyLme Spage Six Zero navigation page is China Six Zero LyLme open source a navigation page . Dedicated to simple and efficient advertising-free Internet navigation and search portal , support for background add links , customize the search engine , precipitation of the most valuable links , no...

AshPostgres 安全漏洞

AshPostgres is an Ash Framework open source a PostgreSQL data layer for the Ash Framework. A security vulnerability exists in AshPostgres versions prior to 2.0.0 through 2.4.10, which stems from a policy that may be skipped for update operations under certain circumstances, resulting in the...

SUSE CVE-2024-49195

Mbed TLS 3.5.x through 3.6.x before 3.6.2 has a buffer underrun in pkwrite when writing an opaque key pair...

PT-2024-9303 · Dell · Dell Powerscale Onefs

Name of the Vulnerable Software and Affected Versions: Dell PowerScale OneFS versions 8.2.2.x through 9.9.0.x Description: The issue is related to an incorrect specified argument vulnerability in the Dell PowerScale OneFS operating system. This vulnerability can be exploited by a remote...

Drupal core 10.0-10.2.9 - Unauthenticated Multiple Vulnerabilities

Unauthenticated Multiple Vulnerabilities discovered by ? in WordPress Core Drupal versions 10.0-10.2.9...

CVE-2024-21258

Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite component: User Interface. Supported versions that are affected are 12.2.3-12.2.14. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Installed Base...

0x-relayer-cat (>=0.0.2, <=0.0.10), 0xauth (>=0.0.2, <=0.0.6) +8238 more potentially affected by CVE-2024-48948 via elliptic (>=6.0.2, <=6.5.7)

elliptic NPM version =6.0.2, =0.0.2, =0.0.2, =1.0.6-beta.1, =0.0.1-beta.1, =0.1.0, =0.0.92, =0.1.3, =4.2.1, =6.2.1, =13.6.1, =13.7.2 and more Source cves: CVE-2024-48948 Source advisory: OSV:GHSA-FC9H-WHQ2-V747...

PT-2024-7012 · Oracle · Oracle Advanced Pricing

Name of the Vulnerable Software and Affected Versions: Oracle Advanced Pricing component: Price List versions 12.2.3 through 12.2.13 Description: The issue is related to insufficient authorization procedure due to incorrect input validation in the Price List component of Oracle Advanced Pricing,...

Oracle E-Business Suite 安全漏洞

Oracle E-Business Suite E-Business Suite is a fully integrated set of global business management software from Oracle. The software provides customer relationship management, service management, financial management and other functions. A security vulnerability exists in Oracle E-Business Suite...

Astro 跨站脚本漏洞

Astro is an Astro open source web framework for content-driven websites. A cross-site scripting vulnerability exists in Astro versions 3.0.0 through 4.16.1 and earlier, which stems from not properly cleaning up the name attribute on a page...

@appknit-project/appknit-internal-sdk (>=1.0.98-alpha.0, <=1.0.98-alpha.11), @appknit-project/appknit-platform-sdk-v2 (>=1.3.65-alpha.0, <=1.3.65-alpha.10) +97 more potentially affected by CVE-2024-21534 via jsonpath-plus (>=10.0.0, <=10.1.0)

jsonpath-plus NPM version =10.0.0, =1.0.98-alpha.0, =1.3.65-alpha.0, =0.18.0-alpha.0, =0.17.3, =0.18.0-alpha.1, =0.1.0, =0.1.0, =0.1.0, =0.0.1, =0.0.2, =0.0.1, =0.0.1, =0.0.1, =0.0.12, =0.0.13 and more Source cves: CVE-2024-21534 Source advisory: OSV:GHSA-PPPG-CPFQ-H7WR...

PT-2024-31907 · Zhejiang University · Zhejiang University Entersoft Customer Resource Management System

Name of the Vulnerable Software and Affected Versions: Zhejiang University Entersoft Customer Resource Management System versions v2002 through v2024 Description: An arbitrary file upload vulnerability in the ProductAction.entphone interface allows attackers to execute arbitrary code via uploadin...

Drupal Block permissions module 1.0.0-1.1.9 - Administrator+ Broken Access Control vulnerability

Administrator+ Broken Access Control vulnerability discovered by Francesco Sardara in WordPress Module Block permissions versions 1.0.0-1.1.9...

CVE-2024-45330

A use of externally-controlled format string in Fortinet FortiAnalyzer versions 7.4.0 through 7.4.3, 7.2.2 through 7.2.5 allows attacker to escalate its privileges via specially crafted requests...

PT-2024-7176 · Sap · Sap Hana Node.Js Client Package

Name of the Vulnerable Software and Affected Versions: SAP HANA Node.js client package versions 2.0.0 through 2.21.30 Description: The issue is related to a Prototype Pollution vulnerability in the SAP HANA Node.js client package, specifically affecting the nestTables feature. This vulnerability...