PT-2024-21179 · Unknown · Enhavo Cms

Name of the Vulnerable Software and Affected Versions: Enhavo CMS version 0.13.1 Description: A cross-site scripting XSS issue in the Header module allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Undertitle text field. This enables attackers to...

PT-2024-11692 · Unknown · Livebox Collaboration Vdesk

Name of the Vulnerable Software and Affected Versions: LIVEBOX Collaboration vDesk versions through v031 Description: An issue was discovered in LIVEBOX Collaboration vDesk, where an Observable Response Discrepancy can occur under the "/api/v1/vdeskintegration/user/isenableuser" endpoint, the...

PT-2024-12783 · Dell · Dell Esi

Name of the Vulnerable Software and Affected Versions: DELL ESI Enterprise Storage Integrator for SAP LAMA version 10.0 Description: The issue concerns an information disclosure vulnerability in the EHAC component of DELL ESI Enterprise Storage Integrator for SAP LAMA. A remote unauthenticated...

Base64 Command Encoder

This encoder uses base64 encoding to avoid bad characters. Module Options msf use encoder/cmd/base64 msf encoderbase64 show actions ...actions... msf encoderbase64 set ACTION msf encoderbase64 show options ...show and set options... msf encoderbase64 run This module requires Metasploit:...

PT-2024-20229 · Jsherp · Jsherp

Name of the Vulnerable Software and Affected Versions: jshERP version 3.3 Description: The issue concerns a SQL Injection vulnerability. Specifically, the findInOutMaterialCount function in com.jsh.erp.controller.DepotHeadController does not adequately filter the column and order parameters,...

SUSE CVE-2024-23653

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. In addition to running containers as build steps, BuildKit also provides APIs for running interactive containers based on built images. It was possible to use these APIs to ask...

PT-2024-20259 · Unknown · Springboot-Manager

Name of the Vulnerable Software and Affected Versions: springboot-manager version 1.6 Description: The issue is related to Cross Site Scripting XSS via the "/sys/user" API endpoint. This allows for potential malicious script execution. The estimated number of potentially affected devices worldwid...

PT-2024-15122 · Biges Safe Life Technologies Electronics Inc · Vguard

Name of the Vulnerable Software and Affected Versions: Biges Safe Life Technologies Electronics Inc. VGuard versions prior to V500.0003.R008.4011.C0012.B351.C Description: The issue is related to a Path Traversal vulnerability, specifically an Absolute Path Traversal, which can be exploited using...

PT-2024-13541 · Quest Analytics Llc · Iqcrm

Name of the Vulnerable Software and Affected Versions: Quest Analytics LLC IQCRM version 2023.9.5 Description: The issue allows a remote attacker to execute arbitrary code via a crafted request to the "Common.svc WSDL" page. This is a SQL Injection vulnerability. Recommendations: For Quest...

PT-2024-11968 · Undefined · Undefined

Name of the Vulnerable Software and Affected Versions: No specific software or versions mentioned. Description: A vulnerability has been reported, but details are not provided due to compliance with CNA rules. It is advised not to wait for vulnerability scanning results. Recommendations: At the...

PT-2024-19623 · Totolink · Totolink A3300R

Name of the Vulnerable Software and Affected Versions: TOTOLINK A3300R version 17.0.0cu.557 B20221024 Description: A command injection issue was discovered via the hostName parameter in the setWanCfg function. This allows for potential exploitation. Recommendations: For TOTOLINK A3300R version...

PT-2024-13655 · Semcms · Semcms

Name of the Vulnerable Software and Affected Versions: SEMCMS version 4.8 Description: A SQL injection issue was discovered via the languageID parameter in the "/web inc.php" API endpoint. This allows for potential exploitation. Recommendations: For SEMCMS version 4.8, consider restricting access...

PT-2023-30168

Name of the Vulnerable Software and Affected Versions Talent Software ECOP versions prior to 32255 Description The issue is related to an Improper Neutralization of Special Elements used in an SQL Command, also known as 'SQL Injection', which allows Command Line Execution through SQL Injection...

GHSA-3PJV-R7W4-2CF5 Grails data binding causes JVM crash and/or other denial of service

Impact A specially crafted web request can lead to a JVM crash or denial of service. Any Grails framework application using Grails data binding is vulnerable. Patches Patches are available for Grails 3 and later. Workarounds No workaround is possible except to avoid data binding to request data...

PT-2023-32814 · Jahastech · Nxfilter

Name of the Vulnerable Software and Affected Versions: Jahastech NxFilter version 4.3.2.5 Description: A problematic issue has been found in the Bind Request Handler component, affecting the processing of the file user,adap.jsp?actionFlag=test&id=1. This leads to ldap injection and can be initiat...

Playbook: Your First 100 Days as a vCISO - 5 Steps to Success

In an increasingly digital world, no organization is spared from cyber threats. Yet, not every organization has the luxury of hiring a full-time, in-house CISO. This gap in cybersecurity leadership is where you, as a vCISO, come in. You are the person who will establish, develop, and solidify the...

PT-2023-8048 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 14.2 Description: The issue is related to multiple memory corruption problems that have been addressed through improved input validation. Processing a maliciously crafted file may lead to unexpected app termination or...

PT-2023-8686 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 14.2 Description: The issue is related to a buffer overflow in the AppleVA component of the macOS operating system, which can lead to unexpected app termination or arbitrary code execution when processing a file. This ...

PT-2023-32566 · Unknown · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost affected versions not specified Description: The issue is related to improper authorization in the "/plugins/focalboard/api/v2/users" endpoint, allowing an attacker who is a guest user and knows the ID of another user to obtain the...

PT-2023-30775 · Unknown · Capsule-Proxy

Name of the Vulnerable Software and Affected Versions: capsule-proxy versions prior to 0.4.6 Description: The issue is a privilege escalation vulnerability based on a missing check if the user is authenticated based on the TokenReview result. This affects clusters running with the anonymous-auth...