PT-2024-38754 · Genexis · Genexis Tilgin Home Gateway

Name of the Vulnerable Software and Affected Versions: Genexis Tilgin Home Gateway version 322 AS0500-03 05 13 05 Description: This issue affects some unknown processing of the file "/vood/cgi-bin/vood view.cgi?lang=EN&act=user/spec...

PT-2024-38070 · WordPress · Lh Add Media From Url

Name of the Vulnerable Software and Affected Versions: LH Add Media From Url plugin for WordPress versions up to, and including, 1.23 Description: The issue is related to Reflected Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows unauthenticated attacke...

PT-2024-30042 · Unknown · Warehouse Inventory System

Name of the Vulnerable Software and Affected Versions: Warehouse Inventory System version 2.0 Description: A Cross-Site Request Forgery CSRF issue in the edit group.php component allows attackers to escalate privileges. Recommendations: For Warehouse Inventory System version 2.0, consider disabli...

PT-2024-37580 · 3Dswymer +1 · 3Dswymer +1

Name of the Vulnerable Software and Affected Versions: 3DPassport in 3DSwymer versions Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x Description: The issue allows an attacker to redirect users to an arbitrary website via a crafted URL, which is an open redirect vulnerability...

PT-2024-38699 · Unknown · Itsourcecode Project Expense Monitoring System

Name of the Vulnerable Software and Affected Versions: itsourcecode Project Expense Monitoring System version 1.0 Description: A critical issue has been identified, affecting an unknown functionality of the file execute.php. The manipulation of the code argument leads to sql injection. This issue...

PT-2024-20039 · Oppo · Coloros Internet Browser

Name of the Vulnerable Software and Affected Versions: ColorOS Internet Browser version 45.10.3.4.1 Description: The issue allows a remote attacker to execute arbitrary JavaScript code via the com.android.browser.RealBrowserActivity component. Recommendations: For version 45.10.3.4.1, consider...

PT-2024-30084 · Linksys · Linksys E1500

Name of the Vulnerable Software and Affected Versions: Linksys E1500 version 1.0.06.001 Description: A Command Injection vulnerability exists in the do upgrade post function of the httpd binary. As a result, an authenticated attacker can execute OS commands with root privileges. This could...

PT-2024-30558

Name of the Vulnerable Software and Affected Versions Mobile Security Framework MobSF versions prior to 4.0.7 Description The issue is related to a flaw in the Static Libraries analysis section of MobSF, specifically during the extraction of .a extension files. The measure intended to prevent Zip...

PT-2024-30174 · Trendnet · Trendnet Tew-752Dru

Name of the Vulnerable Software and Affected Versions: TRENDnet TEW-752DRU version 1.03B01 Description: The issue is due to a lack of length verification for the service field in gena.cgi, leading to a buffer overflow. This can cause the remote target device to crash or allow attackers to execute...

PT-2024-38708 · Unknown · Laravel Property Management System

Name of the Vulnerable Software and Affected Versions: Laravel Property Management System version 1.0 Description: A critical issue affects the upload function of the PropertiesController.php file, allowing for unrestricted file upload through the manipulation of the file argument. This can be...

PT-2024-6467 · Totolink · Totolink X6000R

Name of the Vulnerable Software and Affected Versions: TOTOLINK X6000R version 9.4.0cu.852 20230719 Description: A critical issue has been found in the TOTOLINK X6000R, affecting the function setSyslogCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument rtLogServer leads to...

PT-2024-38681 · Sourcecodester · Yoga Class Registration System

Name of the Vulnerable Software and Affected Versions: SourceCodester Yoga Class Registration System version 1.0 Description: A problematic vulnerability has been found in the system, affecting an unknown function of the file /php-ycrs/classes/SystemSettings.php. The manipulation of the address...

PT-2024-7784 · Tenda · Tenda Fh1201

Name of the Vulnerable Software and Affected Versions: Tenda FH1201 version 1.2.0.14 Description: The issue is related to a stack buffer overflow vulnerability in the formWrlExtraGet function. This vulnerability can be exploited by a remote attacker to impact the confidentiality, integrity, and...

CVE-2024-42995

VTiger CRM = 8.1.0 does not correctly check user privileges. A low-privileged user can interact directly with the "Migration" administrative module to disable arbitrary modules...

mm/shmem: disable PMD-sized page cache if needed

...

PT-2024-21149 · Octobercms · October Cms Bloghub Plugin

Name of the Vulnerable Software and Affected Versions: October CMS Bloghub Plugin versions 1.3.8 and lower Description: A stored cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload into the Comments section. This can lead to the execution...

PT-2024-30128 · Dokuwiki · Indexmenu Plugin

Name of the Vulnerable Software and Affected Versions: indexmenu plugin version v2024-01-05 Description: A Cross-site Scripting XSS issue exists in the indexmenu plugin for Dokuwiki. This allows a malicious attacker to input XSS payloads, for example, when creating or editing a page. The XSS is...

CVE-2024-34734

In onForegroundServiceButtonClicked of FooterActionsViewModel.kt, there is a possible way to disable the active VPN app from the lockscreen due to an insecure default value. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not...

PT-2024-9543 · Adobe · Experience Manager

Name of the Vulnerable Software and Affected Versions: Adobe Experience Manager versions 6.5.21 and earlier Description: The issue is related to a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious...

PT-2024-30221 · Tenda · Tenda Fh1201

Name of the Vulnerable Software and Affected Versions: Tenda FH1201 version 1.2.0.14 Description: The issue is related to a stack overflow via the mit pptpusrpw parameter in the fromWizardHandle function. This allows attackers to cause a Denial of Service DoS via a crafted POST request to the...