PT-2024-28316 · Adolph Dudu · Ratio-Swiper

Name of the Vulnerable Software and Affected Versions: adolph dudu ratio-swiper version 0.0.2 Description: The issue allows attackers to execute arbitrary code or cause a Denial of Service DoS via injecting arbitrary properties through a prototype pollution vulnerability in the parse function...

PT-2024-6750 · Splunk · Splunk Cloud Platform +1

Name of the Vulnerable Software and Affected Versions: Splunk Enterprise versions prior to 9.2.2 Splunk Enterprise versions prior to 9.1.5 Splunk Enterprise versions prior to 9.0.10 Splunk Cloud Platform versions prior to 9.1.2312.109 Splunk Cloud Platform versions prior to 9.1.2308.207...

PT-2024-28308 · Airvertco · Airvertco Frappejs

Name of the Vulnerable Software and Affected Versions: airvertco frappejs version 0.0.11 Description: The issue is related to a prototype pollution vulnerability via the registerView function. This allows attackers to execute arbitrary code or cause a Denial of Service DoS by injecting arbitrary...

PT-2024-26988

Name of the Vulnerable Software and Affected Versions Flowise version 1.4.3 Description The issue concerns a lack of sanitization of the fileName body parameter in the "/api/v1/openai-assistants-file" endpoint, which is located in the index.ts file. This lack of sanitization leads to an arbitrary...

PT-2024-37617 · Mesbook · Mesbook

Name of the Vulnerable Software and Affected Versions: MESbook version 20221021.03 Description: The issue allows an unauthenticated remote attacker to register user accounts without authentication. This can be done by accessing the "/account/Register/" route and providing parameters such as...

CVE-2024-36401

GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.22.6, 2.23.6, 2.24.4, and 2.25.2, multiple OGC request parameters allow Remote Code Execution RCE by unauthenticated users through specially crafted input against a default GeoServer...

PT-2024-28403 · Gradio · Gradio

Name of the Vulnerable Software and Affected Versions: Gradio version 4.36.1 Description: A code injection issue was discovered in Gradio via the component /gradio/component meta.py. This issue is triggered by a crafted input. Note that the supplier disputes this report as it involves a user...

PT-2024-5848

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.4.59 and earlier Description The issue is related to a substitution encoding problem in the mod rewrite module of the Apache HTTP Server, allowing an attacker to execute scripts in directories permitted by the...

PT-2024-37608 · Ingenico · Ingenico Estate Manager

Name of the Vulnerable Software and Affected Versions: Ingenico Estate Manager version 2023 Description: A problematic vulnerability was found in the New Widget Handler component, affecting an unknown functionality of the file /emgui/rest/preferences/PREF HOME PAGE/sponsor/3/. The manipulation of...

PT-2024-4823 · Ibm · Ibm Infosphere Information Server

Name of the Vulnerable Software and Affected Versions: IBM InfoSphere Information Server version 11.7 Description: The issue is related to cross-site request forgery, which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. This...

PT-2024-4814 · Ibm · Ibm Infosphere Information Server

Name of the Vulnerable Software and Affected Versions: IBM InfoSphere Information Server version 11.7 Description: The issue is related to the disclosure of information through a query string, potentially allowing a remote attacker to gain unauthorized access to protected information. This could ...

PT-2024-5888 · Envoy +1 · Envoy +1

Name of the Vulnerable Software and Affected Versions: Envoy versions prior to 1.30.4 Envoy versions prior to 1.29.7 Envoy versions prior to 1.28.5 Envoy versions prior to 1.27.7 Description: The issue is related to a use-after-free error in the Envoy proxy server module. Exploitation of this iss...

OESA-2024-1779 rubygem-actionpack security update

Eases web-request routing, handling, and response as a half-way front, half-way page controller. Implemented with specific emphasis on enabling easy unit/integration testing that doesn't require a browser. Security Fixes: Action Pack is a framework for handling and responding to web requests. Und...

OESA-2024-1778 rubygem-actionpack security update

Eases web-request routing, handling, and response as a half-way front, half-way page controller. Implemented with specific emphasis on enabling easy unit/integration testing that doesn't require a browser. Security Fixes: Action Pack is a framework for handling and responding to web requests. Und...

OESA-2024-1762 rubygem-activesupport security update

A toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Rich support for multibyte strings, internationalization, time zones, and testing. Security Fixes: Action Pack is a framework for handling and responding to web requests. Under certain circumstances respon...

PT-2024-28370 · Idccms · Idccms

Name of the Vulnerable Software and Affected Versions: idccms version 1.35 Description: A Cross-Site Request Forgery CSRF issue was discovered in the component "/admin/userSys deal.php?mudi=infoSet". This allows for potential unauthorized actions on the affected system. Recommendations: For idccm...

PT-2024-28360 · Zziplib +1 · Zziplib +1

Name of the Vulnerable Software and Affected Versions: zziplib version 0.13.77 Description: A Heap Buffer Overflow issue allows attackers to cause a denial of service. This is achieved through the zzip parse root directory function located at /zzip/zip.c. Recommendations: For zziplib version...

Astra Linux – Vulnerability in Composer

Composer is a dependency manager for PHP. On the 2.x branch, prior to versions 2.2.24 and 2.7.7, the status, reinstall, and remove commands, when packages were installed from sources via Git, could allow execution of malicious code if the branch name contained specially crafted text in the...

PT-2024-34936 · Unknown · Mudler/Localai

Name of the Vulnerable Software and Affected Versions: mudler/localai version 2.14.0 Description: A command injection issue exists due to the application's handling of the backend parameter in the configuration file. This parameter is used in the name of the initialized process, allowing an...

PT-2024-25203 · Lumisxp · Lumisxp

Name of the Vulnerable Software and Affected Versions: Lumisxp versions 15.0.x through 16.1.x Description: A cross-site scripting XSS issue in the UrlAccessibilityEvaluation.jsp component allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the contentHtml...