PT-2024-40544 · Promonlogicalis · Asn1

Name of the Vulnerable Software and Affected Versions: github.com/PromonLogicalis/asn1 module version 7bdca06d0edf Description: The issue concerns malicious code in the github.com/PromonLogicalis/asn1 module. This malicious code downloads a program from a remote web server and executes it...

PT-2024-6559 · Papercut · Papercut Ng/Mf

Name of the Vulnerable Software and Affected Versions: PaperCut NG/MF versions affected versions not specified Description: The issue is related to an arbitrary file deletion vulnerability in PaperCut NG/MF, specifically affecting Windows servers with Web Print enabled. This vulnerability can be...

PT-2024-38245 · Langflow · Langflow

Name of the Vulnerable Software and Affected Versions: Langflow versions prior to 1.0.13 Description: The issue allows a remote and low privileged attacker to gain super admin privileges by performing a mass assignment request on the "/api/v1/users" endpoint. Recommendations: For Langflow version...

PT-2025-12383

Name of the Vulnerable Software and Affected Versions watchOS versions prior to 10.6 tvOS versions prior to 17.6 Safari versions prior to 17.6 macOS Sonoma versions prior to 14.6 visionOS versions prior to 1.3 iOS versions prior to 17.6 iPadOS versions prior to 17.6 Description The issue was...

PT-2024-29037

Name of the Vulnerable Software and Affected Versions iOS versions prior to 16.7.9 iPadOS versions prior to 16.7.9 Safari versions prior to 17.6 iOS versions prior to 17.6 iPadOS versions prior to 17.6 watchOS versions prior to 10.6 tvOS versions prior to 17.6 visionOS versions prior to 1.3 macOS...

Unauthorized Access

alextselegidis/easyappointments is vulnerable to Unauthorized Access. The vulnerability is due to insufficient access controls in the GET, PUT, DELETE /providers/providerId endpoints, allowing a low privileged user to fetch, modify, or delete a privileged user's data...

WordPress Social Auto Poster Plugin <= 5.3.14 is vulnerable to Broken Access Control

Software Social Auto Poster Type Plugin Vulnerable versions = 5.3.14 Fixed in 5.3.15 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-6755 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 68ae396383df Credits István Márton...

Secret Exposure

ops is vulnerable to Secret Exposure. The vulnerability is due to improper handling of secret content by passing it as CLI arguments which affects charms using Juju =3.0 and not correctly capturing and processing subprocess.CalledProcessError. The vulnerability allows an attacker to gain access t...

PT-2024-38002 · Tenda · Tenda O3

Name of the Vulnerable Software and Affected Versions: Tenda O3 version 1.0.0.10 Description: A critical issue has been found in the formexeCommand function, where the manipulation of the cmdinput argument leads to a stack-based buffer overflow. This issue can be exploited remotely. The vendor wa...

PT-2024-28882 · Microsoft · Asp.Net Mvc

Name of the Vulnerable Software and Affected Versions: Hospital Management System Project in ASP.Net MVC version 1 Description: The issue allows a remote attacker to execute arbitrary code via the btn login b Click function of the Loginpage.aspx. This can potentially lead to unauthorized access a...

PT-2024-28883 · Tenda · Tenda Ax12

Name of the Vulnerable Software and Affected Versions: Tenda AX12 version 16.03.49.18 cn+ Description: The issue allows a remote attacker to cause a denial of service via the Routing functionality and ICMP packet handling. Recommendations: For Tenda AX12 version 16.03.49.18 cn+, at the moment,...

PT-2024-5598

Name of the Vulnerable Software and Affected Versions Oracle Java SE versions 8u411, 8u411-perf, 11.0.23 Oracle GraalVM Enterprise Edition versions 20.3.14, 21.3.10 IBM SDK, Java Technology Edition versions 7.1.0.0 through 7.1.5.18 IBM SDK, Java Technology Edition versions 8.0.0.0 through 8.0.8.2...

PT-2024-35464 · Unknown · Wp-Affiliate-Platform

Name of the Vulnerable Software and Affected Versions: wp-affiliate-platform versions prior to 6.5.1 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back in the page. This cou...

PT-2024-28728 · Fog · Fog

Name of the Vulnerable Software and Affected Versions: FOG versions prior to 1.5.10.34 Description: The issue is related to a command injection via the filename parameter to the "/fog/management/export.php" API endpoint. This allows for code execution. The estimated number of potentially affected...

Authorization Bypass

alextselegidis/easyappointments is vulnerable to Authorization Bypass. The vulnerability is due to insufficient access control checks on the GET, PUT, and DELETE endpoints for /settings/settingName, allowing low privileged users to fetch, modify, or delete settings of any user, including admin...

Authorization Bypass

org.opensearch.plugin, opensearch-observability is vulnerable to Authorization Bypass. The vulnerability is due to improper verification of the resource author, allowing attackers to access private tenant resources such as notebooks...

PT-2024-37772 · Undefined · Undefined

Name of the Vulnerable Software and Affected Versions: No information is available about the vulnerable software and its affected versions. Description: The provided information does not contain details about the issue. It mentions a rejected or withdrawn CVE ID, but it does not provide any...

PT-2024-37785 · Undefined · Undefined

Name of the Vulnerable Software and Affected Versions: No information is available about the vulnerable software and its affected versions. Description: The issue is related to a rejected CVE candidate number. No further details are provided about the nature of the issue or its potential impact...

WordPress VK All in One Expansion Unit Plugin <= 9.99.1.0 is vulnerable to Cross Site Scripting (XSS)

Software VK All in One Expansion Unit Type Plugin Vulnerable versions = 9.99.1.0 Fixed in 9.99.2.0 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-37956 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 525bd2086dbb Credits savphill Required...

PT-2024-37771 · Undefined · Undefined

Name of the Vulnerable Software and Affected Versions: No information is available about the vulnerable software and its affected versions. Description: The provided information does not contain details about the issue. There is a mention of a rejected reason and a note about not using a specific...