PT-2024-27540 · Automattic · Newspack Blocks

Name of the Vulnerable Software and Affected Versions: Automattic Newspack Blocks versions n/a through 3.0.8 Description: The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as a 'Path Traversal' vulnerability. This vulnerability allows Path Traversa...

WordPress plugin FormCraft 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

PT-2024-34581 · Draytek · Draytek Vigor3900

Name of the Vulnerable Software and Affected Versions: DrayTek Vigor3900 version 1.5.1.3 Description: The issue allows attackers to inject malicious commands into "mainfunction.cgi" and execute arbitrary commands by calling the setup cacertificate function. This enables attackers to potentially...

ABB Cylon Aspect 3.08.01 (jsonProxy.php) Unauthenticated Credentials Disclosure

Summary ASPECT is an award-winning scalable building energy management and control solution designed to allow users seamless access to their building data through standard building protocols including smart devices. Description The ABB BMS/BAS controller allows an unauthenticated attacker to...

ABB Cylon Aspect 3.08.01 (jsonProxy.php) Unauthenticated Reflected XSS

Summary ASPECT is an award-winning scalable building energy management and control solution designed to allow users seamless access to their building data through standard building protocols including smart devices. Description The ABB BMS/BAS controller suffers from an unauthenticated reflected...

PT-2024-33077 · Unknown · Jeecg-Boot

Name of the Vulnerable Software and Affected Versions: JeecgBoot version 3.7.1 Description: A SQL injection vulnerability was discovered in JeecgBoot via the component /onlDragDatasetHead/getTotalData. This issue allows for potential SQL injection attacks. The estimated number of potentially...

PT-2024-27668 · Talkatone · Talkatone

Name of the Vulnerable Software and Affected Versions: Talkatone com.talkatone.android application version 8.4.6 Description: The issue allows any installed application to place phone calls without user interaction by sending a crafted intent via the...

PT-2024-34579 · Draytek · Draytek Vigor3900

Name of the Vulnerable Software and Affected Versions: DrayTek Vigor3900 version 1.5.1.3 Description: The issue allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doCertificate function. Recommendations: For DrayTek Vigor3900 version...

AZL-51909 CVE-2024-50613 affecting package libsndfile 1.2.2-5

libsndfile through 1.2.2 has a reachable assertion, that may lead to application exit, in mpegl3encode.c mpegl3encoderclose...

PT-2024-33119 · Ax2 Pro · Ax2 Pro

Name of the Vulnerable Software and Affected Versions: AX2 Pro home router version DI 7003G-19.12.24A1V16.03.29.50 Description: A command execution issue exists, allowing an attacker to construct a malicious payload and execute commands. This can lead to obtaining shell access to the router's fil...

ABB Cylon Aspect 3.08.01 logCriticalLookup.php Unauthenticated Log Disclosure

ABB Cylon Aspect 3.08.01 logCriticalLookup.php Unauthenticated Log Disclosure Vendor: ABB Ltd. Product web page: https://www.global.abb Affected version: NEXUS Series, MATRIX-2 Series, ASPECT-Enterprise, ASPECT-Studio Firmware: =3.08.01 Summary: ASPECT is an award-winning scalable building energy...

PT-2024-39597 · Wpzest · The Easy Menu Manager | Wpzest

Name of the Vulnerable Software and Affected Versions: The Easy Menu Manager | WPZest plugin for WordPress versions up to, and including, 1.0.1 Description: The issue is related to Stored Cross-Site Scripting via SVG File uploads due to insufficient input sanitization and output escaping. This...

PT-2024-10574

Name of the Vulnerable Software and Affected Versions MainWP Dashboard – The Private WordPress Manager for Multiple Website Maintenance plugin for WordPress versions up to, and including, 3.1.2 Description The issue is related to Stored Cross-Site Scripting, which occurs due to insufficient input...

CVE-2024-21285

Vulnerability in the Oracle Banking Liquidity Management product of Oracle Financial Services Applications component: Reports. The supported version that is affected is 14.5.0.12.0. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle...

CVE-2024-21234

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Core. Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic...

UBUNTU-CVE-2024-21194

Vulnerability in the MySQL Server product of Oracle MySQL component: InnoDB. Supported versions that are affected are 8.0.39 and prior, 8.4.2 and prior and 9.0.1 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise...

PT-2024-39736 · WordPress · Kama Spamblock

Name of the Vulnerable Software and Affected Versions: Kama SpamBlock plugin for WordPress versions up to, and including, 1.8.2 Description: The issue is related to Reflected Cross-Site Scripting via $ POST values due to insufficient input sanitization and output escaping. This allows...

PT-2024-7154 · Oracle · Oracle Hyperion

Name of the Vulnerable Software and Affected Versions: Oracle Hyperion BI+ version 11.2.18.0.000 Description: The issue is related to insufficient input validation in the UI and Visualization component of Oracle Hyperion BI+. It allows a low-privileged attacker to compromise Oracle Hyperion BI+ a...

PT-2024-33100 · Unknown · Sourcecodester Online Tours & Travels Management System

Name of the Vulnerable Software and Affected Versions: itsourcecode Online Tours and Travels Management System version 1.0 Description: The issue is related to a SQL Injection vulnerability. This vulnerability can be exploited via a crafted payload to the val-email parameter in the forget...

GitLab 11.4 < 17.2.9 / 17.3 < 17.3.5 / 17.4 < 17.4.2 (CVE-2024-5005)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - Gitlab reports: Run pipelines on arbitrary branches An attacker can impersonate arbitrary user SSRF in Analytics Dashboard Viewing diffs of MR with conflicts can be slow HTMLi in OAuth page Deploy Key...