CVE-2024-38557 net/mlx5: Reload only IB representors upon lag disable/enable

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Reload only IB representors upon lag disable/enable On lag disable, the bond IB device along with all of its representors are destroyed, and then the slaves' representors get reloaded. In case the slave IB representor...

PT-2024-26280 · Unknown · Help Desk - Customer Support Management System

Name of the Vulnerable Software and Affected Versions: Help Desk - Customer Support Management System versions up to 2.4.0 Description: The issue allows a customer to upload .php files. Methods HelpdeskHelpdeskModuleFrontController::submitTicket and...

PT-2024-26284 · Channable · Channable

Name of the Vulnerable Software and Affected Versions: Channable for PrestaShop versions up to 3.2.1 Description: The issue allows a guest to perform SQL injection via the ChannableFeedModuleFrontController::postProcess function. Recommendations: For versions up to 3.2.1, consider disabling the...

PT-2024-37390 · Unknown · Monbela Tourist Inn Online Reservation System

Name of the Vulnerable Software and Affected Versions: Monbela Tourist Inn Online Reservation System version 1.0 Description: A critical issue affects the processing of the file login.php, where the manipulation of the email argument leads to sql injection. The attack can be initiated remotely...

PT-2024-37393 · Unknown · Simple Online Hotel Reservation System

Name of the Vulnerable Software and Affected Versions: Simple Online Hotel Reservation System version 1.0 Description: A critical vulnerability has been found in the Simple Online Hotel Reservation System, affecting some unknown functionality of the file edit room.php. The manipulation of the pho...

PT-2024-9750 · Unknown +1 · Async Http Client +1

Name of the Vulnerable Software and Affected Versions: AsyncHttpClient versions prior to 3.0.1 Description: The AsyncHttpClient library has an issue where the automatically enabled and self-managed CookieStore silently replaces explicitly defined Cookies with any that have the same name from the...

PT-2024-37374 · Bethesda · Bethesda Online Reservation System

Name of the Vulnerable Software and Affected Versions: Bethesda Online Reservation System version 1.0 Description: A critical issue has been found in the Bethesda Online Reservation System, affecting the uploadImage function of the file /admin/mod room/controller.php?action=add. The manipulation ...

PT-2024-14815 · WordPress · The Business Directory Plugin

Name of the Vulnerable Software and Affected Versions: The Business Directory Plugin plugin for WordPress versions up to, and including, 6.4.3 Description: The issue allows authenticated attackers, with author-level permissions and above, to embed untrusted input into CSV files exported by...

CVE-2024-37891

urllib3 is a user-friendly HTTP client library for Python. When using urllib3's proxy support with ProxyManager, the Proxy-Authorization header is only sent to the configured proxy, as expected. However, when sending HTTP requests without using urllib3's proxy support, it's possible to accidental...

PT-2024-30771

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.9.0 Description A NULL pointer dereference vulnerability was found in the Linux kernel's wifi module, specifically in the mac80211 subsystem. The issue occurs when starting a tx ba session in an MLD connection,...

PT-2024-37356 · Gpac +2 · Gpac +2

Name of the Vulnerable Software and Affected Versions: GPAC version 2.5-DEV-rev228-g11067ea92-master Description: A problematic issue was found, affecting the swf svg add iso sample function of the src/filters/load text.c file in the MP4Box component. This issue leads to a null pointer dereferenc...

PT-2024-26230 · Unknown · Itsourcecode Payroll Management System

Name of the Vulnerable Software and Affected Versions: Sourcecodester Payroll Management System version 1.0 Description: The issue allows an unauthenticated attacker to upload a malicious PHP file via the "save settings" page, which is intended for image uploads. This can lead to the execution of...

PT-2024-12590 · Unknown · Jlink Ax1800

Name of the Vulnerable Software and Affected Versions: Jlink AX1800 version 1.0 Description: An issue in the Jlink AX1800 allows a remote attacker to execute arbitrary code via the router's authentication mechanism. Recommendations: For version 1.0, consider disabling the authentication mechanism...

PT-2024-27680 · Xinhu · Rockoa

Name of the Vulnerable Software and Affected Versions: Xinhu RockOA version 2.6.3 Description: A reflected cross-site scripting XSS issue was found in the /kaoqin/tpl kaoqin locationchange.html component. Recommendations: For version 2.6.3, consider disabling access to the /kaoqin/tpl kaoqin...

PT-2024-27075 · Unknown · Getsetprop

Name of the Vulnerable Software and Affected Versions: getsetprop version 1.1.0 Description: A Prototype Pollution issue allows an attacker to execute arbitrary code via global.accessor. Recommendations: For getsetprop version 1.1.0, consider disabling access to the global.accessor until a patch ...

PT-2024-37312 · Itsourcecode · Itsourcecode Event Calendar

Name of the Vulnerable Software and Affected Versions: itsourcecode Event Calendar version 1.0 Description: A critical issue has been found in the function regConfirm/regDelete of the file process.php. The manipulation of the userId argument leads to SQL injection. The attack can be launched...

Notes app can be tricked into using a received share created before the user logged in

None...

Event create can create attachments that link to other websites

None...

PT-2024-7453 · Unknown · Matrix-React-Sdk

Name of the Vulnerable Software and Affected Versions: matrix-react-sdk versions 3.18.0 through 3.101.9 Description: The issue is related to insufficient protection of service data, allowing a malicious homeserver to potentially steal message keys for a room when a user invites another user to th...

PT-2024-20356 · Mgt Commerce · Mgt-Commerce Cloudpanel

Name of the Vulnerable Software and Affected Versions: Mgt-commerce CloudPanel versions 2.0.0 through 2.4.0 Description: A Directory Traversal issue allows a remote attacker to obtain sensitive information and execute arbitrary code via the service parameter of the load-logfiles function...