PT-2024-28714 · Directus · Directus

Name of the Vulnerable Software and Affected Versions: Directus versions prior to 10.13.0 Description: The issue allows enumeration of existing SSO users in the instance when relying on SSO providers in combination with local authentication. This is possible because if an email address exists in...

PT-2024-13565 · Realtek · Realtek Rtl819X Jungle Sdk

Name of the Vulnerable Software and Affected Versions: Realtek rtl819x Jungle SDK version 3.4.11 Description: A stack-based buffer overflow vulnerability exists in the boa formDnsv6 functionality of Realtek rtl819x Jungle SDK. A specially crafted series of network requests can lead to arbitrary...

PT-2024-27643 · Unknown · Image Hover Effects - Caption Hover With Carousel

Name of the Vulnerable Software and Affected Versions: Image Hover Effects - Caption Hover with Carousel versions 3.0.2 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS...

PT-2024-28932

Name of the Vulnerable Software and Affected Versions MediaWiki CheckUser extension versions through 1.42.1 Description The Special:Investigate feature can expose suppressed information for log events due to the TimelineService not supporting proper suppression. Recommendations For versions throu...

PT-2024-22859 · Unknown · Volmarg Personal Management System

Name of the Vulnerable Software and Affected Versions: Volmarg Personal Management System version 1.4.64 Description: The Volmarg Personal Management System is vulnerable to Server Side Request Forgery SSRF via uploading a SVG file. This allows the server to make unintended HTTP and DNS requests ...

PT-2024-22000 · Unknown · Eskooly Web Product

Name of the Vulnerable Software and Affected Versions: Eskooly Web Product version 3.0 Description: The issue allows a remote attacker to execute arbitrary code via the searchby parameter of the "allstudents.php" component and the id parameter of the "requestmanager.php" component. This enables t...

PT-2024-5369 · Skupper · Skupper

Name of the Vulnerable Software and Affected Versions: Skupper affected versions not specified Description: A flaw was found in Skupper that may allow an attacker to bypass authentication to the Skupper console via a specially-crafted cookie. This issue arises when Skupper is initialized with the...

PT-2024-28329 · Idccms · Idccms

Name of the Vulnerable Software and Affected Versions: idccms version 1.35 Description: A Cross-Site Request Forgery CSRF issue was discovered in idccms. The vulnerability can be exploited via the "/admin/idcProData deal.php" endpoint, specifically when the mudi parameter is set to "del". This...

PT-2024-27739 · 14Finger · 14Finger

Name of the Vulnerable Software and Affected Versions: 14Finger version 1.1 Description: The issue allows for arbitrary user deletion through the "/api/admin/user?id" API endpoint. This endpoint is used for administrative purposes, and the vulnerability could be exploited to delete users without...

PT-2024-29211

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.43 Description The issue is related to the ksmbd component in the Linux kernel, where the may open function does not allow a directory to be opened with write access. However, some writing flags set by the...

MESbook Resource Management Error Vulnerability

MESbook is a web-based system from MESbook Inc. connects to factory machines and converts data into information for real-time management. MESbook has a resource management error vulnerability that can be exploited by an attacker to cause resource consumption and disable the application...

CVE-2024-6427

MESbook is affected by CVE-2024-6427 via the message parameter in version 20221021.03, allowing an unauthenticated remote attacker to inject JavaScript payloads that cause the application to loop requests, leading to resource consumption and potential service disruption. Multiple connected source...

CVE-2024-6427 Uncontrolled Resource Consumption vulnerability in MESbook

Uncontrolled Resource Consumption vulnerability in MESbook 20221021.03 version. An unauthenticated remote attacker can use the "message" parameter to inject a payload with dangerous JavaScript code, causing the application to loop requests on itself, which could lead to resource consumption and...

PT-2024-28396 · Gost +1 · Gost +1

Name of the Vulnerable Software and Affected Versions: gost version 2.11.5 Description: An authentication bypass in the SSH service allows attackers to intercept communications by setting the HostKeyCallback function to ssh.InsecureIgnoreHostKey. This issue is related to missing key verification ...

PT-2024-28408 · Simpcms · Simpcms

Name of the Vulnerable Software and Affected Versions: SimpCMS version 0.1 Description: A cross-site scripting XSS vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title field at the "/admin.php" API endpoint. Recommendations: For...

PT-2024-28697 · Znc +2 · Znc +2

Name of the Vulnerable Software and Affected Versions: ZNC versions prior to 1.9.1 Description: The issue allows for remote code execution in the modtcl module of ZNC, which can be triggered through a prepared kick message. Recommendations: For versions prior to 1.9.1, update to version 1.9.1 or...

MESbook Resource Management Error Vulnerability

MESbook is a web-based system from MESbook Inc. connects to factory machines and converts data into information for real-time management. MESbook has a resource management error vulnerability that can be exploited by an attacker to cause resource consumption and disable the application...

PT-2024-28323 · Unknown · 2O3T-Utility

Name of the Vulnerable Software and Affected Versions: 2o3t-utility version 0.1.2 Description: The issue allows attackers to execute arbitrary code or cause a Denial of Service DoS via injecting arbitrary properties using the extend function, which is affected by prototype pollution...

PT-2024-27333 · Flowise · Flowise

Name of the Vulnerable Software and Affected Versions: Flowise version 1.4.3 Description: A reflected cross-site scripting issue occurs in the "/api/v1/credentials/id" endpoint. If the default configuration is used, an attacker may craft a specially crafted URL to inject Javascript into user...

PT-2024-28313

Name of the Vulnerable Software and Affected Versions requirejs version 2.3.6 Description The issue allows attackers to execute arbitrary code or cause a Denial of Service DoS via injecting arbitrary properties through a prototype pollution vulnerability in the config function. Recommendations Fo...