CVE-2024-42788

A Stored Cross Site Scripting XSS vulnerability was found in "/music/ajax.php?action=savemusic" in Kashipara Music Management System v1.0. This vulnerability allows remote attackers to execute arbitrary code via "title" & "artist" parameter fields...

Ivanti Avalanche deleteSkin Directory Traversal Arbitrary File Deletion Vulnerability

This vulnerability allows remote attackers to delete arbitrary files on affected installations of Ivanti Avalanche. Authentication is not required to exploit this vulnerability. The specific flaw exists within the deleteSkin method. The issue results from the lack of proper validation of a...

PT-2025-28263 · Invt · Invt Vt-Designer

Name of the Vulnerable Software and Affected Versions: INVT VT-Designer affected versions not specified Description: The issue is related to a remote code execution vulnerability due to out-of-bounds write when parsing PM3 files. There is no information provided about the estimated number of...

PT-2024-18568 · Modem · Modem

Name of the Vulnerable Software and Affected Versions: Modem affected versions not specified Description: The issue is related to a possible memory corruption due to a missing bounds check in Modem. This could lead to remote code execution with no additional execution privileges needed. User...

CVE-2024-38195 Azure CycleCloud Remote Code Execution Vulnerability

...

CVE-2024-6618

CVE-2024-6618 affects Ocean Data Systems Dream Report (and AVEVA Reports for Operations). The root cause is errors in processing relative paths to directories, enabling path traversal that could allow remote code execution via injection of a malicious DLL. Affected products/versions include Dream...

CVE-2024-38501 Pepperl+Fuchs: Device Master ICDM-RX/* XSS vulnerability allows HTML injection

An unauthenticated remote attacker may use a HTML injection vulnerability with limited length to inject malicious HTML code and gain low-privileged access on the affected device...

PT-2024-7999 · Symfony +5 · Symfony +5

Name of the Vulnerable Software and Affected Versions: Symfony versions prior to 5.4.46 Symfony versions prior to 6.4.14 Symfony versions prior to 7.1.7 Description: The issue exists due to the lack of measures to neutralize special elements, allowing a remote attacker to execute arbitrary code...

CVE-2024-5651

A flaw was found in the Fence Agents Remediation operator. This vulnerability can allow a Remote Code Execution RCE primitive by supplying an arbitrary command to execute in the --ssh-path/--telnet-path arguments. A low-privilege user, for example, a user with developer access, can create a...

PT-2024-38472 · Sourcecodester · Sourcecodester Kortex Lite Advocate Office Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Kortex Lite Advocate Office Management System version 1.0 Description: A critical issue has been found in the processing of the file delete register.php, where the manipulation of the case register id argument leads to SQL...

CVE-2024-7495 itsourcecode Laravel Accounting System HomeController.php unrestricted upload

A vulnerability, which was classified as critical, was found in itsourcecode Laravel Accounting System 1.0. This affects an unknown part of the file app/Http/Controllers/HomeController.php. The manipulation of the argument image leads to unrestricted upload. It is possible to initiate the attack...

PT-2024-8345 · FFmpeg +3 · Ffmpeg +3

Name of the Vulnerable Software and Affected Versions: FFmpeg versions up to 7.0.1 Description: A critical issue has been found in the function pnm decode frame in the /libavcodec/pnmdec.c library, which can lead to a heap-based buffer overflow. This can be exploited remotely, potentially allowin...

PT-2024-28272 · Studio 42 · Elfinder

Name of the Vulnerable Software and Affected Versions: Studio 42 elFinder version 2.1.64 Description: The issue allows an arbitrary attacker to expose secrets and perform remote code execution RCE by copying files with unauthorized extensions between server directories. This is due to incorrect...

Delta Electronics CNCSoft-G2 DPAX File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Delta Electronics CNCSoft-G2. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

CVE-2024-40629 Arbitrary File Write in Ansible Playbooks leads to RCE in Jumpserver

JumpServer is an open-source Privileged Access Management PAM tool that provides DevOps and IT teams with on-demand and secure access to SSH, RDP, Kubernetes, Database and RemoteApp endpoints through a web browser. An attacker can exploit the Ansible playbook to write arbitrary files, leading to...

PT-2024-28892 · Tenda · Tenda Ax2Pro

Name of the Vulnerable Software and Affected Versions: Tenda AX2pro version V16.03.29.48 cn Description: The issue allows a remote attacker to execute arbitrary code via the Routing functionality. Recommendations: For Tenda AX2pro version V16.03.29.48 cn, consider disabling the Routing...

PT-2024-5237

Name of the Vulnerable Software and Affected Versions: pypa/setuptools versions up to 69.1.1 Description: A vulnerability in the package index module of pypa/setuptools allows for remote code execution via its download functions. These functions, which are used to download packages from URLs...

CVE-2024-38044

DHCP Server Service Remote Code Execution Vulnerability...

CVE-2024-38363 Remote Code Execution (RCE) via Server Side Template Injection (SSTI) in Airbyte

Airbyte is a data integration platform for ELT pipelines. Airbyte connection builder docker image is vulnerable to RCE via SSTI which allows an authenticated remote attacker to execute arbitrary code on the server as the web server user. The connection builder is used to create and test new...

Zen Cart findPluginAdminPage Local File Inclusion Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Zen Cart. Authentication is not required to exploit this vulnerability. The specific flaw exists within the findPluginAdminPage function. The issue results from the lack of proper validation of...