CVE-2024-24820

Icinga Director is a tool designed to make Icinga 2 configuration handling easy. Not any of Icinga Director's configuration forms used to manipulate the monitoring environment are protected against cross site request forgery CSRF. It enables attackers to perform changes in the monitoring...

PT-2024-5841

Name of the Vulnerable Software and Affected Versions WPML versions up to, and including, 4.6.12 Description The WPML plugin for WordPress is vulnerable to Remote Code Execution via the Twig Server-Side Template Injection. This is due to missing input validation and sanitization on the render...

HCL Sametime Authorization Issues Vulnerability

HCL Technologies HCL Sametime is a conferencing solution from HCL Technologies, USA. A security vulnerability exists in HCL Sametime that stems from the inability to disable a session...

CVE-2024-24820 Icinga Director configuration is susceptible to Cross-Site Request Forgery

Icinga Director is a tool designed to make Icinga 2 configuration handling easy. Not any of Icinga Director's configuration forms used to manipulate the monitoring environment are protected against cross site request forgery CSRF. It enables attackers to perform changes in the monitoring...

PT-2024-7831 · Esri · Esri Portal For Arcgis

Name of the Vulnerable Software and Affected Versions: Esri Portal for ArcGIS versions 11.1 and below Description: The issue is related to a reflected cross-site scripting problem, where an attacker could potentially execute arbitrary JavaScript code in their own browser. This could be achieved b...

PT-2024-11971 · Rancher · Rancher

Name of the Vulnerable Software and Affected Versions: Rancher versions prior to 2.6.14 Rancher versions prior to 2.7.10 Rancher versions prior to 2.8.2 Description: A vulnerability has been identified which may lead to sensitive data being leaked into Rancher's audit logs. The issue affects...

PT-2024-20420 · Unknown · Daily Habit Tracker

Name of the Vulnerable Software and Affected Versions: Daily Habit Tracker version 1.0 Description: The issue allows a remote attacker to execute arbitrary code via a crafted GET request. This is due to a SQL Injection vulnerability in the delete-tracker.php file. Recommendations: For Daily Habit...

PT-2024-12122 · Unknown · Egerie Risk Manager

Name of the Vulnerable Software and Affected Versions: Egerie Risk Manager version 4.0.5 Description: An issue in Egerie Risk Manager allows attackers to bypass the signature mechanism and tamper with the values inside the JWT payload, resulting in privilege escalation. Recommendations: For Egeri...

PT-2024-1592 · Suricata +1 · Suricata +1

Name of the Vulnerable Software and Affected Versions: Suricata versions prior to 6.0.16 and 7.0.3 Description: Suricata is a network Intrusion Detection System, Intrusion Prevention System, and Network Security Monitoring engine. An attacker can craft traffic to cause Suricata to use far more CP...

EulerOS 2.0 SP9 : python-urllib3 (EulerOS-SA-2024-1185)

According to the versions of the python-urllib3 package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - urllib3 is a user-friendly HTTP client library for Python. urllib3 previously wouldn't remove the HTTP request body when an HTTP redirect...

PT-2024-20419 · Unknown · Daily Habit Tracker

Name of the Vulnerable Software and Affected Versions: Daily Habit Tracker version 1.0 Description: A Cross Site Scripting issue allows a remote attacker to execute arbitrary code via the day, exercise, pray, read book, vitamins, laundry, alcohol, and meat parameters in the "add-tracker.php" and...

PT-2024-20320 · Zentao · Zentao

Name of the Vulnerable Software and Affected Versions: Zentao versions 18.0 through 18.10 Description: A remote code execution issue was discovered in Zentao, affecting its checkConnection method. The vulnerability can be exploited via the /app/zentao/module/repo/model.php endpoint, allowing for...

PT-2024-20423 · Unknown · Employee Management System

Name of the Vulnerable Software and Affected Versions: Employee Management System version 1.0 Description: The issue allows a remote attacker to execute arbitrary code via the "edit-photo.php" component. This is due to an Unrestricted File Upload vulnerability. Recommendations: For Employee...

PT-2024-20278 · Unknown · Cotonti Cms

Name of the Vulnerable Software and Affected Versions: Cotonti CMS version 0.9.24 Description: A stored cross-site scripting XSS vulnerability in the Edit Page function allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload. Recommendations: For Cotonti CMS...

Kibana 8.12.1, 7.17.18 Security Update (ESA-2024-04)

Kibana heap buffer overflow vulnerability ESA-2024-04 This issue requires authenticated access to Kibana. On Dec 21, 2023, Google Chrome announced CVE-2023-7024, described as “Heap buffer overflow in WebRTC in Google Chrome prior to 120.0.6099.129 allowed a remote attacker to potentially exploit...

apache-ivy: XML External Entity vulnerability

Improper Restriction of XML External Entity Reference, XML Injection aka Blind XPath Injection vulnerability in Apache Software Foundation Apache Ivy.This issue affects any version of Apache Ivy prior to 2.5.2. When Apache Ivy prior to 2.5.2 parses XML files - either its own configuration, Ivy...

PT-2024-20308 · Jsish · Jsish

Name of the Vulnerable Software and Affected Versions: Jsish version 3.5.0 Description: A stack-overflow issue was discovered in Jsish via the IterGetKeysCallback component at /jsish/src/jsiValue.c. Recommendations: For Jsish version 3.5.0, consider disabling the IterGetKeysCallback component as ...

PT-2024-20229 · Jsherp · Jsherp

Name of the Vulnerable Software and Affected Versions: jshERP version 3.3 Description: The issue concerns a SQL Injection vulnerability. Specifically, the findInOutMaterialCount function in com.jsh.erp.controller.DepotHeadController does not adequately filter the column and order parameters,...

PT-2024-17710 · Codeastro · Codeastro Restaurant Pos System

Name of the Vulnerable Software and Affected Versions: CodeAstro Restaurant POS System version 1.0 Description: A problematic issue has been found in the CodeAstro Restaurant POS System, affecting some unknown functionality of the file create account.php. The manipulation of the Full Name argumen...

PT-2024-12316 · Ibm · Ibm Security Verify Access

Name of the Vulnerable Software and Affected Versions: IBM Security Verify Access versions 10.0.0.0 through 10.0.6.1 Description: The issue allows an attacker on the network to take control of the server due to insecure calls. Recommendations: For versions 10.0.0.0 through 10.0.6.1, consider...