PT-2024-29319 · Unknown · Kashipara Responsive School Management System

Name of the Vulnerable Software and Affected Versions: Kashipara Responsive School Management System version 3.2.0 Description: A Reflected Cross Site Scripting XSS issue was discovered in the "/smsa/admin login.php" endpoint, allowing remote attackers to execute arbitrary code via the error...

PT-2024-38434 · Tenda · Tenda I22

Name of the Vulnerable Software and Affected Versions: Tenda i22 version 1.0.0.34687 Description: A critical issue was found in the function formApPortalAccessCodeAuth of the file /goform/apPortalAccessCodeAuth. The manipulation of the argument accessCode/data/acceInfo leads to a buffer overflow...

PT-2024-10350 · Unknown · Opigno Learning Path

Name of the Vulnerable Software and Affected Versions: Opigno Learning path versions 0.0.0 through 3.1.2 Description: The issue is related to improper neutralization of directives in statically saved code, also known as 'static code injection', which allows for PHP Local File Inclusion. This can...

PT-2024-5516 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 13.9 through 17.0.6 GitLab CE/EE versions 17.1 through 17.1.4 GitLab CE/EE versions 17.2 through 17.2.2 Description: An issue has been discovered in GitLab CE/EE where access tokens may have been logged when an API reque...

PT-2024-5838 · Calibre · Calibre

Name of the Vulnerable Software and Affected Versions: Calibre versions prior to 7.14.0 Description: The issue is related to path traversal in the software, allowing unauthenticated attackers to achieve arbitrary file read. This is due to incorrect restriction of the directory path name with...

PT-2024-6460 · D Link · D-Link Di 8004W

Name of the Vulnerable Software and Affected Versions: D-Link DI 8004W version 16.07.26A1 Description: The issue is related to a command execution vulnerability in the msp info htm function of the jhttpd module. This vulnerability may allow a remote attacker to execute arbitrary commands. The...

GHSA-6H53-Q94J-348W RobotsAndPencils go-saml authentication bypass vulnerability

RobotsAndPencils go-saml, a SAML client library written in Go, contains an authentication bypass vulnerability in all known versions. This is due to how the xmlsec1 command line tool is called internally to verify the signature of SAML assertions. When xmlsec1 is used without defining the enabled...

RobotsAndPencils go-saml authentication bypass vulnerability

RobotsAndPencils go-saml, a SAML client library written in Go, contains an authentication bypass vulnerability in all known versions. This is due to how the xmlsec1 command line tool is called internally to verify the signature of SAML assertions. When xmlsec1 is used without defining the enabled...

PT-2024-5829 · Mailcow · Mailcow

Name of the Vulnerable Software and Affected Versions: mailcow: dockerized versions prior to 2024-07 Description: The issue is related to the Relay Hosts configuration, where an authenticated admin user can inject a JavaScript payload. This payload is executed when the configuration page is viewe...

PT-2024-5395 · Raisecom · Raisecom Msg2200 +3

Name of the Vulnerable Software and Affected Versions: Raisecom MSG1200, MSG2100E, MSG2200 and MSG2300 version 3.90 Description: A critical issue affects the sslvpn config mod function of the /vpn/list ip network.php file in the Web Interface component. The manipulation of the template and stylen...

PT-2024-8735 · Foxit · Foxit Pdf Reader +1

Name of the Vulnerable Software and Affected Versions: Foxit PDF Reader affected versions not specified Foxit PDF Editor affected versions not specified Description: This issue allows remote attackers to disclose sensitive information on affected installations. User interaction is required, where...

GHSA-5CF7-CXRF-MQ73 Bostr Improper Authorization vulnerability

Even with authorizedkeys is filled with allowed pubkeys, If noscraper is enabled, It will allow anyone to use bouncer even it's pubkey is not in authorizedkeys. Impact - Private bouncer Patches Available on version 3.0.10 Workarounds Disable noscraper if you have authorizedkeys being set in confi...

PT-2024-29956 · Elliptic +1 · Elliptic +1

Name of the Vulnerable Software and Affected Versions: Elliptic package version 6.5.6 Description: The issue concerns ECDSA signature malleability due to a missing check for whether the leading bit of r and s is zero. This results in a cryptographic weakness. There is no information provided abou...

PT-2024-38309 · Sourcecodester · Sourcecodester Simple Realtime Quiz System

Name of the Vulnerable Software and Affected Versions: SourceCodester Simple Realtime Quiz System version 1.0 Description: A critical issue was found in the system, affecting some unknown functionality of the file /manage question.php. The manipulation of the id argument leads to sql injection. T...

PT-2024-6400 · Eset · Eset

Name of the Vulnerable Software and Affected Versions: ESET versions prior to the fixed version Description: The issue is related to insufficient access control in ESET's antivirus protection, potentially allowing an attacker to misuse file operations during the removal of a detected file on the...

PT-2024-29638 · Mattermost · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost versions 9.5.x through 9.5.6 Mattermost versions 9.9.x through 9.9.0 Description: The issue allows a malicious remote to set arbitrary RemoteId values for synced users, which can lead to claiming that a user was synced from another...

PT-2024-38293 · Sourcecodester · Sourcecodester Tracking Monitoring Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Tracking Monitoring Management System version 1.0 Description: A critical issue has been found in the processing of the file /manage user.php. The manipulation of the id argument leads to SQL injection. The attack can be...

GHSA-258H-F687-4226 PheonixAppAPI has visible Encoding Maps

Impact This is a kind of moderate issue. The impact is not big for normal users but can be for users who want to secure their code/files/etc. The issue is that the map of encoding/decoding languages are visible in code. Patches The Problem was patched in 0.2.5, so you should try to upgrade to the...

MobSF vulnerable to Open Redirect in Login Redirect

Impact What kind of vulnerability is it? Who is impacted? An open redirect vulnerability exist in MobSF authentication view. PoC 1. Go to http://127.0.0.1:8000/login/?next=//afine.com in a web browser. 2. Enter credentials and press "Sign In". 3. You will be redirected to afine.com Users who are...

URL Redirection to Untrusted Site ('Open Redirect')

Overview IdentityServer4 is an OpenID Connect and OAuth 2.0 Framework for ASP.NET Core Affected versions of this package are vulnerable to URL Redirection to Untrusted Site 'Open Redirect' through the commonly used GetAuthorizationContextAsync and IsValidReturnUrl methods which return non-null...