PT-2024-1517 · Buildkit +3 · Buildkit +3

Name of the Vulnerable Software and Affected Versions: BuildKit versions prior to 0.12.5 Description: A malicious BuildKit frontend or Dockerfile using RUN --mount could trick the feature that removes empty files created for the mountpoints into removing a file outside the container, from the hos...

Cookie Information < 2.0.23 - Subscriber+ Arbitrary Options Update

Description The plugin is vulnerable to arbitrary option updates due to a missing capability check on its AJAX request handler, allowing any authenticated users, such as subscriber to update arbitrary site options PoC Run the below command in the developer console of the web browser while being o...

PT-2024-19626 · Undefined · Undefined

Name of the Vulnerable Software and Affected Versions: No information is available about the vulnerable software and its affected versions. Description: A security issue has been identified, but details are not provided in the given information. No estimated number of potentially affected devices...

PT-2024-20362 · Totolink · Totolink A3300R

Name of the Vulnerable Software and Affected Versions: TOTOLINK A3300R version V17.0.0cu.557 B20221024 Description: A command injection issue was discovered via the enable parameter in the setPortForwardRules function. This allows for potential exploitation. Recommendations: For TOTOLINK A3300R...

PT-2024-1735 · Emerson · Emerson Rosemount Gc700Xa +2

Name of the Vulnerable Software and Affected Versions: Emerson Rosemount GC370XA, GC700XA, and GC1500XA products affected versions not specified Description: An unauthenticated user with network access could obtain access to sensitive information or cause a denial-of-service condition due to...

PT-2024-13305 · Undefined · Undefined

Name of the Vulnerable Software and Affected Versions: No vulnerable software or affected versions specified. Description: A previously reported issue was withdrawn by its CNA after further investigation showed it was not a security issue. Recommendations: At the moment, there is no information...

PT-2024-15820 · Unknown · Saskutil64.Sys +1

Name of the Vulnerable Software and Affected Versions: SUPERAntiSpyware Pro X version 10.0.1260 Description: The issue concerns kernel-level API parameters manipulation and Denial of Service vulnerabilities. This can be triggered by manipulating the 0x9C402140 IOCTL code of the saskutil64.sys...

PT-2024-13164 · Line · Line

Name of the Vulnerable Software and Affected Versions: Line version 13.6.1 Description: An issue in the Otakara lapis totuka mini-app on Line allows attackers to send crafted malicious notifications via leakage of the channel access token. This leakage enables attackers to exploit the system...

PT-2025-31022 · Pypi · Serde-Json-Wasm

Name of the Vulnerable Software and Affected Versions: serde-json-wasm versions prior to 1.0.1 Description: The serde-json-wasm crate is susceptible to a stack consumption issue when processing deeply nested JSON data. Recommendations: Update to version 1.0.1 or later...

PT-2025-31024 · Snow · Snow

Name of the Vulnerable Software and Affected Versions: snow crate versions prior to 0.9.5 Description: The snow crate, when using stateful TransportState, allows incrementing a nonce, potentially leading to denial of message delivery. Recommendations: Update to snow crate version 0.9.5 or later...

PT-2024-6078 · Apple +9 · Ipados +14

Name of the Vulnerable Software and Affected Versions: watchOS versions prior to 10.3 tvOS versions prior to 17.3 iOS versions prior to 17.3 iPadOS versions prior to 17.3 macOS Sonoma versions prior to 14.3 iOS versions prior to 16.7.5 iPadOS versions prior to 16.7.5 Safari versions prior to 17.3...

Product Import Export for WooCommerce < 2.3.8 - Shop Manager+ Arbitrary File Upload via upload_import_file

Description The plugin is vulnerable to arbitrary file uploads due to missing file type validation in the 'uploadimportfile' function n all versions up to, and including, 2.3.7. This makes it possible for authenticated attackers, with Shop Manager access and above, to upload arbitrary files on th...

Events Addon for Elementor < 2.1.3 - Cross-Site Request Forgery

Description The plugin is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.2. This is due to missing nonce validation on the naeventsbwsettingssavefunc, naeventsbwtogglesubmitfunc, naeventsprosettingssavefunc, naeventsprotogglesubmitfunc and...

PT-2024-11965 · Undefined · Undefined

Name of the Vulnerable Software and Affected Versions: No information is available about the vulnerable software and its affected versions. Description: The provided information does not contain details about the issue. It appears to be a notification about a rejected reason related to CNA rules,...

PT-2024-13710 · Device · Device

Name of the Vulnerable Software and Affected Versions: Device affected versions not specified Description: The root user password is hardcoded into the device and cannot be changed in the user interface. Additionally, there is an issue where a user's browser may be forced to execute JavaScript an...

PT-2024-15003 · Tecnick.Com +3 · Tcexam

Name of the Vulnerable Software and Affected Versions: Software affected versions not specified Description: The issue arises when access to the "admin" folder is not protected by external authorization mechanisms, such as Apache Basic Auth. This allows any user to download protected information,...

PT-2024-11628 · Elite Crm · Elite Crm

Name of the Vulnerable Software and Affected Versions: Elite CRM version 1.2.11 Description: A Cross Site Scripting issue allows an attacker to execute arbitrary code via the language parameter to the "/ngs/login" endpoint. Recommendations: For Elite CRM version 1.2.11, avoid using the language...

PT-2024-12121

Name of the Vulnerable Software and Affected Versions NetScoutnGeniusOne version 6.3.4 Description A Cross Site Scripting issue allows a remote attacker to execute arbitrary code via the name parameter of the Profile and Exclusion List pages. Recommendations For NetScoutnGeniusOne version 6.3.4,...

PT-2024-11600 · Obsidian · Obsidian Mind Map

Name of the Vulnerable Software and Affected Versions: Obsidian Mind Map version 1.1.0 Description: The issue allows attackers to execute arbitrary code via a crafted payload injected into an uploaded document. Recommendations: For Obsidian Mind Map version 1.1.0, update to a version that contain...

Denial Of Service (DOS)

PeterO.Cbor is vulnerable to Denial Of Service. The vulnerability is due to use of less efficient data structures like regular a Dictionary that are not optimized for performance. An attacker can exploit this inefficiency by decoding specially crafted CBOR data which can potentially lead to Denia...