PT-2024-16036 · WordPress · Woocommerce - Social Login

Name of the Vulnerable Software and Affected Versions: WooCommerce - Social Login plugin for WordPress versions up to, and including, 2.7.7 Description: The issue is due to insufficient verification on the user being returned by the social login token, making it possible for unauthenticated...

PT-2024-8266 · NetGear · Netgear Xr300

Name of the Vulnerable Software and Affected Versions: Netgear XR300 version 1.0.3.78 Description: The issue is related to a buffer overflow in the bridge wireless main.cgi script of Netgear XR300 routers, specifically when handling the ssid parameter. This can be exploited by sending a specially...

Access control vulnerable to user data deletion by anonynmous users

Impact Anonymous users can delete the user data maintained by an AccessControl.userfolder.UserFolder which may prevent any privileged access. Patches The problem is fixed in version 7.2. Workarounds The problem can be fixed by adding dataroles = to AccessControl.userfolder.UserFolder. References...

PT-2024-31840 · Draytek · Draytek Vigor3900

Name of the Vulnerable Software and Affected Versions: DrayTek Vigor3900 version 1.5.1.3 Description: The issue is a post-authentication command injection problem. It occurs when the action parameter in the "cgi-bin/mainfunction.cgi" endpoint is set to delete wlan profile. Recommendations: For...

PT-2024-34665 · Unknown · Meshtastic

Name of the Vulnerable Software and Affected Versions: Meshtastic firmware versions prior to 2.5.6 Description: The Meshtastic firmware does not check for packets claiming to be from the special broadcast address 0xFFFFFFFF, which could result in unexpected behavior and potential for DDoS attacks...

PT-2024-33254 · Zohocorp · Zoho Manageengine Admanager Plus

Name of the Vulnerable Software and Affected Versions: Zohocorp ManageEngine ADManager Plus versions 7241 and prior Description: The issue is related to SQL Injection in the Archived Audit Report. This allows for potential exploitation. Recommendations: For versions 7241 and prior, update to a...

PT-2024-34817 · Wpdeveloper · Wpdeveloper Betterlinks

Name of the Vulnerable Software and Affected Versions: WPDeveloper BetterLinks versions 2.1.7 and earlier Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks...

PT-2024-16494 · Tongda Oa · Tongda Oa

Name of the Vulnerable Software and Affected Versions: Tongda OA versions up to 11.10 Description: A critical issue was found in Tongda OA, affecting an unknown function of the file /pda/appcenter/check seal.php. The manipulation of the ID argument leads to SQL injection. It is possible to launch...

SUSE CVE-2024-47825

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Starting in version 1.14.0 and prior to versions 1.14.16 and 1.15.10, a policy rule denying a prefix that is broader than /32 may be ignored if there is a policy rule referencing a more narrow prefix CIDRSe...

PT-2024-16507 · Unknown · Phpgurukul Online Shopping Portal

Name of the Vulnerable Software and Affected Versions: PHPGurukul Online Shopping Portal version 2.0 Description: A vulnerability was found in the PHPGurukul Online Shopping Portal, allowing for cross-site scripting XSS attacks. The issue is related to an unknown function in the file...

PT-2024-16407 · Safenet · Esafenet Cdg

Name of the Vulnerable Software and Affected Versions: ESAFENET CDG version 5 Description: A critical issue affects the delProtocol function of the file /com/esafenet/servlet/system/PrintScreenListService.java. The manipulation of the id argument leads to SQL injection. The attack may be initiate...

PT-2024-30469 · Fonts · Fonts

Name of the Vulnerable Software and Affected Versions: Fonts versions through 3.7.7 Description: The issue is related to a Missing Authorization vulnerability in the Fonts Plugin, which allows exploitation of incorrectly configured access control security levels. Recommendations: For versions...

PT-2024-32957 · Cubewp · Cubewp

Name of the Vulnerable Software and Affected Versions: CubeWP – All-in-One Dynamic Content Framework versions 1.1.15 and earlier Description: The issue affects the CubeWP – All-in-One Dynamic Content Framework due to a Missing Authorization vulnerability. This vulnerability allows for the...

PT-2024-34578 · Draytek · Draytek Vigor3900

Name of the Vulnerable Software and Affected Versions: DrayTek Vigor3900 version 1.5.1.3 Description: The issue allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the ruequest certificate function. Recommendations: For DrayTek Vigor3900...

PT-2024-16414 · Tongda Oa · Tongda Oa

Name of the Vulnerable Software and Affected Versions: Tongda OA 2017 up to 11.10 Description: A critical issue has been found in Tongda OA, affecting some unknown processing of the file /pda/reportshop/record detail.php. The manipulation of the repid argument leads to SQL injection. The attack m...

PT-2024-33626 · Unknown · Ekc Tournament Manager

Name of the Vulnerable Software and Affected Versions: EKC Tournament Manager versions n/a through 2.2.1 Description: A Cross-Site Request Forgery CSRF issue allows attackers to upload a web shell to a web server. This can be exploited by attackers to gain unauthorized access to the server...

PT-2024-24326 · Engenius · Engenius Esr580

Name of the Vulnerable Software and Affected Versions: EnGenius ESR580 A8J-EMR5000 devices affected versions not specified Description: The issue allows a remote attacker to conduct stored XSS attacks, potentially leading to arbitrary JavaScript code execution under the context of the user's...

PT-2024-16324 · Klokan Maptiler · Tileserver-Gl

Name of the Vulnerable Software and Affected Versions: Klokan MapTiler tileserver-gl version 2.3.1 Description: A vulnerability was found in the component URL Handler of Klokan MapTiler tileserver-gl, which can lead to cross-site scripting when the key argument is manipulated. This issue can be...

PT-2024-34588 · Draytek · Draytek Vigor3900

Name of the Vulnerable Software and Affected Versions: Draytek Vigor3900 version 1.5.1.3 Description: The issue allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doGRETunnel function. Recommendations: For Draytek Vigor3900 version...

PT-2024-16329 · Unknown · Codezips Online Institute Management System

Name of the Vulnerable Software and Affected Versions: Codezips Online Institute Management System version 1.0 Description: A critical issue has been found in the system, affecting the processing of the file /login.php. The manipulation of the email argument leads to sql injection. The attack can...