PT-2024-4651 · Jenkins · Jenkins Credentials Plugin

Name of the Vulnerable Software and Affected Versions: Jenkins Plain Credentials Plugin versions 182.v468b 97b 9dcb 8 and earlier Description: The issue is related to the storage of secret file credentials by the Jenkins Plain Credentials Plugin. In rare cases, the plugin stores these credentials...

PT-2024-37404 · Unknown · Spa-Cartcms

Name of the Vulnerable Software and Affected Versions: spa-cartcms version 1.9.0.6 Description: A problematic issue has been found in the Checkout Page component, affecting the processing of the file /checkout. The manipulation of the quantity argument with the input -10 leads to enforcement of...

PT-2024-4825 · Jetbrains · Youtrack

Name of the Vulnerable Software and Affected Versions: JetBrains YouTrack versions prior to 2024.2.34646 Description: The issue is related to insufficient protection of registration data in the Access Token Handler component. This could allow a remote attacker to gain unauthorized access to...

Firefly III has a MFA bypass in oauth flow

Impact A MFA bypass in the Firefly III OAuth flow may allow malicious users to bypass the MFA-check. This allows malicious users to use password spraying to gain access to your Firefly III data using passwords stolen from other sources. As OAuth applications are easily enumerable using an...

GHSA-4GM4-C4MH-4P7W Firefly III has a MFA bypass in oauth flow

Impact A MFA bypass in the Firefly III OAuth flow may allow malicious users to bypass the MFA-check. This allows malicious users to use password spraying to gain access to your Firefly III data using passwords stolen from other sources. As OAuth applications are easily enumerable using an...

PT-2024-37356 · Gpac +2 · Gpac +2

Name of the Vulnerable Software and Affected Versions: GPAC version 2.5-DEV-rev228-g11067ea92-master Description: A problematic issue was found, affecting the swf svg add iso sample function of the src/filters/load text.c file in the MP4Box component. This issue leads to a null pointer dereferenc...

PT-2024-10046 · Rancher +2 · Rke2 +3

Name of the Vulnerable Software and Affected Versions: Rancher Manager versions prior to v2.8.9 RKE2 versions prior to v1.27.15 RKE2 versions prior to v1.28.11 RKE2 versions prior to v1.29.6 RKE2 versions prior to v1.30.2 Description: The issue is related to incorrect permission assignment for a...

PT-2024-26945 · Freefrom · Freefrom

Name of the Vulnerable Software and Affected Versions: FreeFrom - the nostr client versions prior to 1.3.5 Description: The issue is related to improper verification of cryptographic signatures. This means the affected app cannot detect event data with invalid signatures, potentially allowing...

PT-2024-37360 · Sourcecodester · Sourcecodester Best House Rental Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Best House Rental Management System version 1.0 Description: A critical issue has been discovered, allowing for SQL injection through the manipulation of the month of argument in the payment report.php file. This can be exploit...

PT-2024-12303 · Rancher · Rancher

Name of the Vulnerable Software and Affected Versions: Rancher versions 2.7.0 through 2.7.13 Rancher versions 2.8.0 through 2.8.4 Description: A vulnerability has been identified whereby privilege escalation checks are not properly enforced for RoleTemplate objects when external=true, which in...

PT-2024-5734 · Gtk +9 · Gtk +9

Name of the Vulnerable Software and Affected Versions: GTK versions prior to the fixed version Description: A flaw was found in the GTK library, allowing for library injection from the current working directory under certain conditions. This could potentially enable an attacker to elevate their...

Can access comments and attachments of deleted cards

None...

Read-only users can restore old versions

None...

PT-2024-33483 · WordPress · Canto

Name of the Vulnerable Software and Affected Versions: Canto plugin for WordPress versions up to, and including, 3.0.8 Description: The issue allows unauthenticated attackers to include remote files on the server, resulting in code execution. This is achieved via the abspath parameter and require...

PT-2024-27698 · Trendnet · Trendnet Tew-814Dap

Name of the Vulnerable Software and Affected Versions: TRENDnet TEW-814DAP version v1 FW1.01B01 Description: A stack overflow issue was discovered via the submit-url parameter at the "/formSysLog" API endpoint. Recommendations: For TRENDnet TEW-814DAP version v1 FW1.01B01, as a temporary...

PT-2024-27088

Name of the Vulnerable Software and Affected Versions Aegon Life version 1.0 Description The issue is a SQL injection vulnerability. It can be exploited via the client id parameter at the "clientStatus.php" endpoint. Recommendations For Aegon Life version 1.0, as a temporary workaround, consider...

PT-2024-26434 · Libyaml · Libyaml

Name of the Vulnerable Software and Affected Versions: libyaml version 0.2.5 Description: The issue is related to a Buffer Overflow vulnerability. It affects the yaml emitter emit function in the /src/libyaml/src/emitter.c file. The manipulation leads to a double-free. Recommendations: For libyam...

PT-2024-27689 · Totolink · Totolink A3700R

Name of the Vulnerable Software and Affected Versions: TOTOLINK A3700R version 9.1.2u.6165 20211012 Description: A stack overflow issue was discovered in the setWiFiBasicCfg function via the ssid parameter. This issue can potentially be exploited. Recommendations: For TOTOLINK A3700R version...

PT-2024-27466 · WordPress · Cooked Pro

Name of the Vulnerable Software and Affected Versions: The Cooked Pro recipe plugin for WordPress versions up to, and including, 1.7.15.4 Description: The issue is related to Persistent Cross-Site Scripting XSS via the recipe settingspost title parameter due to insufficient input sanitization and...

Globus `identity_provider` restriction ignored when used with `allow_all` in JupyterHub 5.0

Impact JupyterHub 5.0, when used with GlobusOAuthenticator, could be configured to allow all users from a particular institution only. The configuration for this would look like: python Require users to be using the "foo.horse" identity provider, often an institution or university...