PT-2024-22890 · Xmedcon · Xmedcon

Name of the Vulnerable Software and Affected Versions: xmedcon versions 0.23.0 Description: The issue allows an attacker to execute arbitrary code via a Buffer Overflow in libs/dicom/basic.c. Recommendations: For xmedcon version 0.23.0, update to version 0.24.0 to resolve the issue. As a temporar...

PT-2024-26461 · Ecshop · Ecshop

Name of the Vulnerable Software and Affected Versions: Ecshop version 3.6 Description: The issue is related to Cross Site Scripting XSS via the ecshop/article cat.php file. This means an attacker could potentially inject malicious scripts into the website, affecting user sessions. Recommendations...

Session Hijacking

laravel/socialite is vulnerable to Session Hijacking. The vulnerability is due to the state guessing during OAuth authentication, which could potentially lead to session hijacking...

PT-2024-30372 · Unknown · Gaizhenbiao/Chuanhuchatgpt

Name of the Vulnerable Software and Affected Versions: gaizhenbiao/chuanhuchatgpt version 20240310 Description: A Local File Inclusion LFI vulnerability exists within the application’s chat history upload functionality. The issue stems from improper input validation when handling file paths durin...

PT-2024-25667 · WordPress · Wp Prayer

Name of the Vulnerable Software and Affected Versions: WP Prayer WordPress plugin versions 2.0.9 and earlier Description: The issue is related to the lack of a CSRF check when updating settings, which could allow attackers to make a logged-in admin change them via a CSRF attack. Recommendations:...

PT-2024-3567

Name of the Vulnerable Software and Affected Versions Git versions prior to 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4 Description The issue allows an attacker to execute arbitrary code when cloning repositories with submodules. This is possible because Git can be fooled into...

PT-2024-24100 · Aruba · Aruba Central Communications Service

Name of the Vulnerable Software and Affected Versions: Aruba Central Communications service affected versions not specified Description: The issue concerns buffer overflow vulnerabilities in the Central Communications service, which could lead to unauthenticated remote code execution. This can be...

SQL Injection

openlink virtuoso-opensource is vulnerable to SQL Injection. The vulnerability is due to an issue in the nssdatabaselookup component, allowing attackers to cause a DoS via crafted SQL statements...

SQL Injection

openlink virtuoso-opensource is vulnerable to SQL Injection. The vulnerability is due to an issue in the mpboxdeserializestring function, which allows attackers to cause a DoS after executing a SELECT statement...

PT-2024-33056 · Agentejo · Agentejo Cockpit Cms

Name of the Vulnerable Software and Affected Versions: Agentejo Cockpit CMS version 0.5.5 Description: A vulnerability has been discovered that consists of an arbitrary file upload in the /media/api endpoint via a post request. An attacker could upload files to the server, compromising the entire...

PT-2024-22377 · Unknown · Code-Projects Computer Book Store

Name of the Vulnerable Software and Affected Versions: Code-projects Computer Book Store version 1.0 Description: The issue allows for SQL Injection, which can be exploited via the "book.php?bookisbn=" endpoint. An attacker can manipulate this endpoint remotely. It is estimated that a significant...

PT-2024-19559 · Panoramic · Hp Digital Imaging

Name of the Vulnerable Software and Affected Versions: Panoramic Corporation Digital Imaging Software version 9.1.2.7600 Description: The issue allows a local attacker to escalate privileges via the ccsservice.exe component. Recommendations: For version 9.1.2.7600, consider restricting access to...

Werkzeug debugger vulnerable to remote execution when interacting with attacker controlled domain

The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a domain and subdomain they control, and enter the debugger PIN, but if they are successful it...

Access Control Bypass

github.com/pterodactyl/wings is vulnerable to Access Control Bypass. The vulnerability is due to improper access controls within the pull endpoint, allowing authenticated users to evade restrictions and potentially access resources on local networks...

PT-2024-25679

Name of the Vulnerable Software and Affected Versions Werkzeug versions prior to 3.0.3 Description The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact wit...

Security Bulletin: IBM Aspera Orchestrator affected by usage of vulnerable software (CVE-2020-27511, CVE-2022-31160, CVE-2021-41184, CVE-2021-41182, CVE-2021-41183, CVE-2018-20677, CVE-2018-20676, CVE-2018-14040, CVE-2016-10735, CVE-2019-8331)

Summary IBM Aspera Orchestrator has addressed multiple vulnerabilities related to the use of vulnerable software jQuery and Bootstrap that could allow denial of service and cross-site scripting attacks. Vulnerability Details CVEID:CVE-2020-27511 DESCRIPTION: Prototype is vulnerable to a denial of...

PT-2024-25859 · Savsoft · Savsoft Quiz

Name of the Vulnerable Software and Affected Versions: Savsoft Quiz version 6.0 Description: The issue allows stored XSS via the quiz name parameter in the "index.php/quiz/insert quiz/" endpoint. This enables potential attackers to inject malicious scripts into the application. Recommendations: F...

PT-2024-25678 · Unknown · Pterodactyl

Name of the Vulnerable Software and Affected Versions: Pterodactyl versions prior to 1.11.6 Description: Importing a malicious egg or gaining access to a wings instance could lead to cross-site scripting XSS on the panel, potentially allowing an attacker to gain an administrator account. The...

Cross Site Scripting (XSS)

yapi-vendor is vulnerable to Cross Site Scripting XSS. The vulnerability is due to insufficient input validation in its Advanced Expectation - Response module, allowing attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the body field...

PT-2024-19886 · Zscaler · Zscaler Client Connector

Name of the Vulnerable Software and Affected Versions: Zscaler Client Connector versions prior to 4.2.1 Description: The anti-tampering protection of the Zscaler Client Connector can be bypassed under certain conditions when running the Repair App functionality. Recommendations: For versions prio...