Denial Of Service (DOS)

netresearch/jsonmapper and pocketmine/netresearch-jsonmapper is vulnerable to Denial Of Service. The vulnerability is due to there is no proper validation when constructing objects from scalar types. This flaw potentially leads to a server crash caused by malformed JSON...

PT-2024-22276 · Wasmi · Wasmi

Name of the Vulnerable Software and Affected Versions: Wasmi versions 0.15.0 through 0.31.0 Description: The issue arises when the host calls or resumes a Wasm function with more parameters than the default limit 128, causing an Out-of-bounds Buffer Write. This affects calls from host to Wasm, bu...

PT-2024-19571 · Unknown · Boyiddha Automated-Mess-Management-System

Name of the Vulnerable Software and Affected Versions: boyiddha Automated-Mess-Management-System version 1.0 Description: A critical issue affects the Setting Handler component of the system, specifically the /admin/index.php file, leading to improper access controls. The attack can be initiated...

BIT-TOMCAT-2021-43980 Apache Tomcat: Information disclosure

The simplified implementation of blocking reads and writes introduced in Tomcat 10 and back-ported to Tomcat 9.0.47 onwards exposed a long standing but extremely hard to trigger concurrency bug in Apache Tomcat 10.1.0 to 10.1.0, 10.0.0 to 10.0.18, 9.0.0 to 9.0.60 and 8.5.0 to 8.5.77 that could...

PT-2024-40070 · Budibase +2 · Budibase +2

Name of the Vulnerable Software and Affected Versions: Budibase versions prior to 2.20.0 Description: The issue arises from a vulnerability in the vm2 library used for code execution inside the Budibase builder and apps. This vulnerability allows users to escape the sandbox provided by vm2 and...

PT-2024-20655 · Dell · Dell Secure Connect Gateway (Scg) Policy Manager

Name of the Vulnerable Software and Affected Versions: Dell Secure Connect Gateway SCG Policy Manager, all versions Description: The issue is a Stored Cross-Site Scripting vulnerability that could be exploited by an adjacent network high privileged attacker, leading to the storage of malicious HT...

PT-2024-21801 · Puppet +1 · Puppet +1

Name of the Vulnerable Software and Affected Versions: dp-golang versions prior to 1.2.7 Description: The issue arises when dp-golang is used to install Go, potentially leading to files being installed with incorrect ownership. This occurs when Puppet is run as root and the installed package is o...

PT-2024-18665 · Session · Session

Name of the Vulnerable Software and Affected Versions: Session version 1.17.5 Description: The application is vulnerable to Local File Read via chat attachments, allowing internal application files and public files from the user's device to be obtained without the user's consent. Recommendations:...

PT-2024-15529 · Recipes · Recipes

Name of the Vulnerable Software and Affected Versions: Recipes version 1.5.10 Description: The application is vulnerable to Server-Side Request Forgery SSRF, allowing arbitrary HTTP requests to be made through the server. Recommendations: For Recipes version 1.5.10, as a temporary workaround,...

PT-2024-21155 · Unknown · Ba Importer

Name of the Vulnerable Software and Affected Versions: Import/Update Bulk Product from any Csv/Excel File Pro ba importer versions up to 1.1.28 Description: A SQL injection issue exists in the affected module, allowing a guest to perform SQL injection. Recommendations: For versions up to 1.1.28,...

PT-2024-2634 · Liblas · Liblas

Name of the Vulnerable Software and Affected Versions: libLAS version 1.8.1 Description: The issue is related to a memory leak vulnerability in the /libLAS/apps/ts2las.cpp component of the libLAS library, which is used for reading and writing geospatial data. This vulnerability can be exploited b...

PT-2024-21640 · Undefined · Undefined

Name of the Vulnerable Software and Affected Versions: No vulnerable software or affected versions specified. Description: A candidate was withdrawn by its CNA due to being out of scope for their CVE ID assignments. Recommendations: At the moment, there is no information about a newer version tha...

PT-2024-20616 · Jquery · Quicksand Post Filter Jquery Plugin

Name of the Vulnerable Software and Affected Versions: Quicksand Post Filter jQuery Plugin versions through 3.1.1 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web...

PT-2024-1926

Name of the Vulnerable Software and Affected Versions Rack versions 1.3.0 through 3.0.9 and 2.2.8.1. Description Rack is a modular Ruby web server interface. A denial of service DoS vulnerability exists due to improper handling of Range headers. Carefully crafted Range headers can cause the serve...

Improper Neutralization of HTTP Headers in github.com/greenpau/caddy-security

All versions of the package github.com/greenpau/caddy-security are vulnerable to HTTP Header Injection via the X-Forwarded-Proto header due to redirecting to the injected protocol.Exploiting this vulnerability could lead to bypass of security mechanisms or confusion in handling TLS...

PT-2024-13043 · Undefined · Undefined

Name of the Vulnerable Software and Affected Versions: No information is available about the vulnerable software and its affected versions. Description: The provided information does not contain details about the issue. There is a mention of a rejected reason stating that the referenced item is...

PT-2024-13910 · Undefined · Undefined

Name of the Vulnerable Software and Affected Versions: No information is available about the vulnerable software and its affected versions. Description: The provided information does not contain details about the issue. There is a mention of a rejected reason stating that the information is unuse...

PT-2024-13878 · Undefined · Undefined

Name of the Vulnerable Software and Affected Versions: No information is available about the vulnerable software and its affected versions. Description: The provided information does not contain details about the issue. There is a mention of a rejected reason stating that the item is unused, alon...

PT-2024-14580 · Undefined · Undefined

Name of the Vulnerable Software and Affected Versions: No information is available about the vulnerable software and its affected versions. Description: The provided information does not contain details about the issue. There is a mention of a rejected reason stating that the information is unuse...

Path Traversal (Zip Slip)

github.com/artdarek/go-unzip is vulnerable to Zip Slip. The vulnerability is due to improper handling of file paths within an archive. An attacker can construct an archive containing files with arbitrary paths which results in arbitrary file write outside of the restricted target directory during...