PT-2024-1368 · Tenda · Tenda Ac10

Name of the Vulnerable Software and Affected Versions: Tenda AC10U version 15.03.06.49 multi TDE01 Description: A critical issue has been found in the function formSetDeviceName, which is related to a stack-based buffer overflow due to the manipulation of the argument devName. This can be exploit...

PT-2024-20147 · Cups Easy · Cups Easy

Name of the Vulnerable Software and Affected Versions: Cups Easy Purchase & Inventory version 1.0 Description: A Cross-Site Scripting XSS issue has been reported due to insufficient encoding of user-controlled inputs. This can be exploited via the /cupseasylive/grnprint.php endpoint, specifically...

PT-2024-1372 · Tenda · Tenda Ac10

Name of the Vulnerable Software and Affected Versions: Tenda AC10U versions 15.03.06.49 multi TDE01 Description: The issue is related to a buffer overflow vulnerability in the fromAddressNat function of the Tenda AC10U router's firmware. This vulnerability can be exploited remotely, potentially...

PT-2024-20153 · Cups Easy · Cups Easy

Name of the Vulnerable Software and Affected Versions: Cups Easy Purchase & Inventory version 1.0 Description: A Cross-Site Scripting XSS issue has been reported, where user-controlled inputs are not sufficiently encoded. This can be exploited via the "/cupseasylive/grnmodify.php" API endpoint,...

PT-2024-20145 · Cups Easy · Cups Easy

Name of the Vulnerable Software and Affected Versions: Cups Easy Purchase & Inventory version 1.0 Description: A Cross-Site Scripting XSS issue has been reported, where user-controlled inputs are not sufficiently encoded. This issue can be exploited via the /cupseasylive/taxstructurecreate.php...

PT-2024-20130 · Cups Easy · Cups Easy

Name of the Vulnerable Software and Affected Versions: Cups Easy Purchase & Inventory version 1.0 Description: A Cross-Site Scripting XSS issue has been reported, where user-controlled inputs are not sufficiently encoded. This issue can be exploited via the /cupseasylive/grndisplay.php endpoint,...

The vulnerability of the DisableDevice function in the Wayland protocol implementation for X.Org XWayland, which is part of the X Window System X.Org Server, allows a attacker to trigger a service failure or execute arbitrary code.

The vulnerability of the DisableDevice function in the Wayland protocol implementation for X.Org XWayland, which is part of the X.Org Server for the X Window System, is related to buffer overflow attacks. Exploiting this vulnerability can allow an attacker to cause a service failure or execute...

PT-2024-12439 · Splicecom · Splicecom Maximiser Soft Pbx

Name of the Vulnerable Software and Affected Versions: Splicecom Maximiser Soft PBX versions 1.5 and earlier Description: The issue is related to a cross-site scripting XSS vulnerability. This vulnerability can be exploited via the CLIENT NAME and DEVICE GUID fields in the login component...

PT-2024-1439 · Unknown · Systemk Nvr

Name of the Vulnerable Software and Affected Versions: SystemK NVR versions 2.3.5SK.30084998 and prior Description: The issue is related to a command injection vulnerability in the dynamic domain name system DDNS settings. This vulnerability could allow an attacker to execute arbitrary commands...

DRUPAL-CONTRIB-2024-004

Content within Open Social can have different visibilities. It is possible for a user to create public content even when this should not be allowed. This vulnerability is mitigated by the fact that the site must have public visibility disabled on a global level...

PT-2024-14369 · Totolink · Totolink X6000R

Name of the Vulnerable Software and Affected Versions: TOTOLINK X6000R version 9.4.0cu.852 B20230719 Description: An issue in TOTOLINK X6000R allows attackers to run arbitrary commands via the sub 41284C function. Recommendations: For TOTOLINK X6000R version 9.4.0cu.852 B20230719, consider...

PT-2024-14320 · Mathtex +1 · Mathtex +1

Name of the Vulnerable Software and Affected Versions: Mathtex versions 1.05 and earlier Description: The issue allows a remote attacker to execute arbitrary code via a crafted string in the application URL. This is due to a Stack Overflow vulnerability in the validate function. Recommendations:...

PT-2024-11023 · Unknown · Contiki-Ng Tinydtls

Name of the Vulnerable Software and Affected Versions: Contiki-NG tinyDTLS through master branch 53a0d97 Description: An assertion failure in the check certificate request function allows attackers to cause a denial of service. This issue affects Contiki-NG tinyDTLS, enabling attackers to exploit...

Two-factor Authentication (TFA) - Moderately critical - Access bypass - SA-CONTRIB-2024-003

This module enables you to allow and/or require users to use a second authentication method in addition to password authentication. In some cases, the module allows users to log in with an authentication plugin that an administrator has disabled. This vulnerability is mitigated by the fact that a...

PT-2024-1303 · Jenkins +1 · Jenkins +1

Name of the Vulnerable Software and Affected Versions: Jenkins versions 2.217 through 2.441 Jenkins LTS versions 2.222.1 through 2.426.2 Description: The issue is related to the built-in command line interface CLI of the Jenkins server, which has a weakness in its authentication procedure. This...

PT-2024-19812 · Tuta · Tuta

Name of the Vulnerable Software and Affected Versions: Tuta versions prior to 119.10 Description: The issue concerns the loading of external content in emails. In the default setting, external resources should not be loaded without user confirmation. However, certain embedded images can be loaded...

PT-2024-15553 · Iobit · Imfhpregfilter.Sys +1

Name of the Vulnerable Software and Affected Versions: IObit Malware Fighter version 11.0.0.1274 Description: The issue is related to a Denial of Service vulnerability that can be triggered by exploiting the 0x8001E00C IOCTL code of the ImfHpRegFilter.sys driver. Recommendations: For IObit Malwar...

PT-2024-15811 · Linzhaoguan · Linzhaoguan Pb-Cms

Name of the Vulnerable Software and Affected Versions: LinZhaoguan pb-cms version 2.0 Description: A problematic issue has been found in the Comment Handler component of the software, allowing for cross-site scripting through the manipulation of input, such as . This can be exploited remotely...

PT-2024-15807 · Nsasoft · Nsasoft Product Key Explorer

Name of the Vulnerable Software and Affected Versions: Nsasoft Product Key Explorer version 4.0.9 Description: A vulnerability has been found in the component Registration Handler of Nsasoft Product Key Explorer. The manipulation of the argument Name/Key leads to memory corruption. An attack has ...

PT-2024-20040

Name of the Vulnerable Software and Affected Versions LlamaHub aka llama-hub versions prior to 0.0.67 Description The OpenAPI and ChatGPT plugin loaders in LlamaHub allow attackers to execute arbitrary code because safe load is not used for YAML. This issue enables attackers to execute arbitrary...