PT-2024-37374 · Bethesda · Bethesda Online Reservation System

Name of the Vulnerable Software and Affected Versions: Bethesda Online Reservation System version 1.0 Description: A critical issue has been found in the Bethesda Online Reservation System, affecting the uploadImage function of the file /admin/mod room/controller.php?action=add. The manipulation ...

PT-2024-37393 · Unknown · Simple Online Hotel Reservation System

Name of the Vulnerable Software and Affected Versions: Simple Online Hotel Reservation System version 1.0 Description: A critical vulnerability has been found in the Simple Online Hotel Reservation System, affecting some unknown functionality of the file edit room.php. The manipulation of the pho...

PT-2024-14815 · WordPress · The Business Directory Plugin

Name of the Vulnerable Software and Affected Versions: The Business Directory Plugin plugin for WordPress versions up to, and including, 6.4.3 Description: The issue allows authenticated attackers, with author-level permissions and above, to embed untrusted input into CSV files exported by...

CVE-2024-37891

urllib3 is a user-friendly HTTP client library for Python. When using urllib3's proxy support with ProxyManager, the Proxy-Authorization header is only sent to the configured proxy, as expected. However, when sending HTTP requests without using urllib3's proxy support, it's possible to accidental...

PT-2024-37356 · Gpac +2 · Gpac +2

Name of the Vulnerable Software and Affected Versions: GPAC version 2.5-DEV-rev228-g11067ea92-master Description: A problematic issue was found, affecting the swf svg add iso sample function of the src/filters/load text.c file in the MP4Box component. This issue leads to a null pointer dereferenc...

PT-2024-30771

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.9.0 Description A NULL pointer dereference vulnerability was found in the Linux kernel's wifi module, specifically in the mac80211 subsystem. The issue occurs when starting a tx ba session in an MLD connection,...

PT-2024-12590 · Unknown · Jlink Ax1800

Name of the Vulnerable Software and Affected Versions: Jlink AX1800 version 1.0 Description: An issue in the Jlink AX1800 allows a remote attacker to execute arbitrary code via the router's authentication mechanism. Recommendations: For version 1.0, consider disabling the authentication mechanism...

PT-2024-27680 · Xinhu · Rockoa

Name of the Vulnerable Software and Affected Versions: Xinhu RockOA version 2.6.3 Description: A reflected cross-site scripting XSS issue was found in the /kaoqin/tpl kaoqin locationchange.html component. Recommendations: For version 2.6.3, consider disabling access to the /kaoqin/tpl kaoqin...

PT-2024-26230 · Unknown · Itsourcecode Payroll Management System

Name of the Vulnerable Software and Affected Versions: Sourcecodester Payroll Management System version 1.0 Description: The issue allows an unauthenticated attacker to upload a malicious PHP file via the "save settings" page, which is intended for image uploads. This can lead to the execution of...

PT-2024-27075 · Unknown · Getsetprop

Name of the Vulnerable Software and Affected Versions: getsetprop version 1.1.0 Description: A Prototype Pollution issue allows an attacker to execute arbitrary code via global.accessor. Recommendations: For getsetprop version 1.1.0, consider disabling access to the global.accessor until a patch ...

PT-2024-37312 · Itsourcecode · Itsourcecode Event Calendar

Name of the Vulnerable Software and Affected Versions: itsourcecode Event Calendar version 1.0 Description: A critical issue has been found in the function regConfirm/regDelete of the file process.php. The manipulation of the userId argument leads to SQL injection. The attack can be launched...

Notes app can be tricked into using a received share created before the user logged in

None...

Event create can create attachments that link to other websites

None...

PT-2024-7453 · Unknown · Matrix-React-Sdk

Name of the Vulnerable Software and Affected Versions: matrix-react-sdk versions 3.18.0 through 3.101.9 Description: The issue is related to insufficient protection of service data, allowing a malicious homeserver to potentially steal message keys for a room when a user invites another user to th...

PT-2024-37291 · Unknown · Itsourcecode Online House Rental System

Name of the Vulnerable Software and Affected Versions: itsourcecode Online House Rental System version 1.0 Description: A critical issue has been found in the itsourcecode Online House Rental System, affecting an unknown function of the file manage user.php. The manipulation of the id argument...

PT-2024-20356 · Mgt Commerce · Mgt-Commerce Cloudpanel

Name of the Vulnerable Software and Affected Versions: Mgt-commerce CloudPanel versions 2.0.0 through 2.4.0 Description: A Directory Traversal issue allows a remote attacker to obtain sensitive information and execute arbitrary code via the service parameter of the load-logfiles function...

PT-2024-25170 · Gunet · Gunet Openeclass E-Learning Platform

Name of the Vulnerable Software and Affected Versions: GUnet OpenEclass E-learning Platform versions 3.15 and before Description: The issue is a cross-site scripting XSS vulnerability that allows an authenticated privileged attacker to execute arbitrary code. This can be achieved via the title an...

PT-2024-22652 · Dell · Dell Scg

Name of the Vulnerable Software and Affected Versions: Dell SCG versions prior to 5.24.00.00 Description: The issue is related to an Improper Access Control vulnerability in the SCG exposed for an internal update REST API. This API is only accessible if enabled by an Admin user from the UI. A...

PT-2024-26434 · Libyaml · Libyaml

Name of the Vulnerable Software and Affected Versions: libyaml version 0.2.5 Description: The issue is related to a Buffer Overflow vulnerability. It affects the yaml emitter emit function in the /src/libyaml/src/emitter.c file. The manipulation leads to a double-free. Recommendations: For libyam...

PT-2024-26433 · Libyaml · Libyaml

Name of the Vulnerable Software and Affected Versions: libyaml versions up to 0.2.5 Description: A vulnerability was found in libyaml, affecting the function yaml event delete of the file /src/libyaml/src/api.c. The manipulation leads to a double-free. Recommendations: For libyaml versions up to...