Salon booking system < 10.0 - Missing Authorization

Description The Salon booking system plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on several functions hooked into admininit in all versions up to, and including, 9.9. This makes it possible for authenticated attackers with...

PT-2024-4387

Name of the Vulnerable Software and Affected Versions Composer versions prior to 2.2.24 and 2.7.7 Description The issue is related to the composer install command running inside a git/hg repository with specially crafted branch names, which can lead to command injection. This requires cloning...

WordPress Custom Field Template Plugin <= 2.6.1 is vulnerable to Sensitive Data Exposure

Software Custom Field Template Type Plugin Vulnerable versions = 2.6.1 Fixed in 2.6.2 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2023-6748 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 1ef89c7771d0 Credits Francesco Carlucci...

PT-2024-26707 · Unknown · Templatesnext Onepager

Name of the Vulnerable Software and Affected Versions: TemplatesNext OnePager versions 1.3.3 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS in TemplatesNext OnePager...

PT-2024-19238 · Unknown · Codection Import/Export Users/Customers

Name of the Vulnerable Software and Affected Versions: Codection Import and export users and customers versions 1.24.6 and earlier Description: The issue is related to a Missing Authorization vulnerability in Codection Import and export users and customers. This vulnerability affects the import a...

ZendFramework potential SQL Injection Vector When Using PDO_MySql

Developers using non-ASCII-compatible encodings in conjunction with the MySQL PDO driver of PHP may be vulnerable to SQL injection attacks. Developers using ASCII-compatible encodings like UTF8 or latin1 are not affected by this PHP issue, which is described in more detail here:...

Minimal Coming Soon – Coming Soon Page < 2.39 - Missing Authorization to Limited Settings Change

Description The Minimal Coming Soon – Coming Soon Page plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the validateajax, deactivateajax, and saveajax functions in all versions up to, and including, 2.38. This makes it possible for...

PT-2024-24518 · Unknown +1 · Gaizhenbiao/Chuanhuchatgpt +1

Name of the Vulnerable Software and Affected Versions: gaizhenbiao/chuanhuchatgpt versions prior to the fixed version released on 20240305 Description: The gaizhenbiao/chuanhuchatgpt application is vulnerable to a path traversal attack due to its use of an outdated gradio component. This...

PT-2024-18388 · Autogpt · Autogpt

Name of the Vulnerable Software and Affected Versions: AutoGPT versions v0.5.0 through v5.1.0 Description: The issue arises from the application's method of validating shell commands against an allowlist or denylist, where it only checks the first word of the command. This allows an attacker to...

PT-2024-24131 · Mintplex · Anything-Llm

Name of the Vulnerable Software and Affected Versions: mintplex-labs/anything-llm affected versions not specified Description: The issue is related to an uncontrolled resource consumption vulnerability in the upload file endpoint, which can lead to a denial of service DOS condition. Specifically,...

PT-2024-30005 · Gradio · Gradio

Name of the Vulnerable Software and Affected Versions: gradio-app/gradio affected versions not specified Description: The 'deploy-website.yml' workflow in the gradio-app/gradio repository is vulnerable to secrets exfiltration due to improper authorization. This vulnerability arises from the...

CVE-2024-24919: Check Point’s Quantum Gateway comes under Attack as Hackers exploit Zero-Day Vulnerability

Active Exploits target Check Point Security Gateway Zero-Day Information Disclosure flaw Check Point Cybersecurity has issued hotfixes to address a zero-day vulnerability in its VPNs that has been exploited to gain remote access to firewalls and potentially infiltrate corporate networks. On...

PT-2024-27928

Name of the Vulnerable Software and Affected Versions qdrant/qdrant version 1.9.0-dev Description The issue allows for arbitrary file read and write during the snapshot recovery process. Attackers can exploit this by manipulating snapshot files to include symlinks, leading to arbitrary file read ...

PT-2024-18551 · Modem · Modem

Name of the Vulnerable Software and Affected Versions: Modem affected versions not specified Description: The issue is related to a possible out of bounds write due to improper input invalidation. This could lead to remote denial of service with no additional execution privileges needed. User...

PT-2024-15201 · WordPress · Auto Featured Image

Name of the Vulnerable Software and Affected Versions: Auto Featured Image Auto Post Thumbnail plugin for WordPress versions up to, and including, 4.0.0 Description: The issue allows authenticated attackers with author-level access and above to make web requests to arbitrary locations originating...

PT-2024-25634 · Alt Linux +1 · Alt Linux +1

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned. Description: The issue concerns the site log report, which required additional encoding of event descriptions. This encoding is necessary to ensure that any HTML in the content is displayed in...

PT-2024-26519 · Finesoft · Finesoft

Name of the Vulnerable Software and Affected Versions: FineSoft version 8.0 Description: A cross-site scripting XSS issue in the login page allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the URL:errorname parameter after a failed login attempt...

Cross Site Scripting

silverstripe/comments is vulnerable to Cross Site Scripting. The vulnerability is due to an outdated version of jQuery that contains XSS vulnerabilities when user input is used in certain contexts...

PT-2024-26467

Name of the Vulnerable Software and Affected Versions Mocodo Mocodo Online versions 4.2.6 and below Description The issue arises from improper sanitization of the sql case input field in the /web/generate.php endpoint, allowing remote attackers to execute arbitrary SQL commands and potentially...

PT-2024-26466 · Mocodo · Mocodo Online

Name of the Vulnerable Software and Affected Versions: Mocodo Mocodo Online versions 4.2.6 and below Description: The issue allows for Remote Code Execution via the "/web/rewrite.php" API endpoint. Recommendations: For versions 4.2.6 and below, as a temporary workaround, consider restricting acce...