PT-2024-31502 · Diebold Nixdorf · Vynamic View

Name of the Vulnerable Software and Affected Versions: Diebold Nixdorf Vynamic View versions up to 5.9.4 Description: The issue concerns the exposure of sensitive information to unauthorized actors, identified as CWE-200. Local access is required for exploitation, and there is no public exploit...

PT-2024-39299 · Circutor · Circutor Q-Smt

Name of the Vulnerable Software and Affected Versions: CIRCUTOR Q-SMT version 1.0.4 Description: The issue allows an attacker with access to the web service to bypass authentication mechanisms on the login page, enabling them to use all functionalities implemented at the web level that allow...

PT-2024-19325 · Houzez · Houzez

Name of the Vulnerable Software and Affected Versions: Houzez versions 3.2.4 and earlier Description: The issue is related to an Incorrect Privilege Assignment vulnerability, which allows Privilege Escalation in Houzez. Recommendations: For Houzez versions 3.2.4 and earlier, update to a version...

PT-2024-29088 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions prior to Sequoia 15 Description: A permissions issue was addressed with additional restrictions. This issue allows an app to potentially access a user's Photos Library. Recommendations: For versions prior to macOS Sequoia 15,...

CVE-2024-29779

there is a possible escalation of privilege due to an unusual root cause. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2024-40650

CVE-2024-40650 is an Android elevation-of-privilege vulnerability caused by a missing FRP state check in wifi_item_edit_content (styles.xml). It enables local privilege escalation with no user interaction. Connected sources confirm Android FRP bypass and affected components; exploitation details ...

Exploit for Code Injection in Mjml Mjml_App

MJML Local Code Execution PoC A Proof-Of-Concept for CVE-2024...

PT-2024-13925

Name of the Vulnerable Software and Affected Versions Video Station versions prior to 5.8.1 Description A SQL injection vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow authenticated users to inject malicious code via a network. Recommendations...

PUB-A-336862373

there is a possible escalation of privilege due to an unusual root cause. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

kernel: cxl/port: Fix delete_endpoint() vs parent unregistration race

In the Linux kernel, the following vulnerability has been resolved: cxl/port: Fix deleteendpoint vs parent unregistration race The CXL subsystem, at cxlmem -probe time, establishes a lineage of ports struct cxlport objects between an endpoint and the root of a CXL topology. Each port including th...

Oracle Siebel CRM SEoL (8.0.x)

According to its version, Oracle Siebel CRM is 8.0.x. It is, therefore, no longer maintained by its vendor or provider. Lack of support implies that no new security patches for the product will be released by the vendor. As a result, it may contain security vulnerabilities. %NASLMINLEVEL 80900 C...

PT-2024-30253 · Zzcms · Zzcms

Name of the Vulnerable Software and Affected Versions: ZZCMS versions 2023 and earlier Description: A reflected cross-site scripting XSS issue exists due to the direct insertion of the HTTP REFERER header value into the HTML response without proper sanitization in the user/login.php file at line...

Medium: python-tqdm

Issue Overview: tqdm is an open source progress bar for Python and CLI. Any optional non-boolean CLI arguments e.g. --delim, --buf-size, --manpath are passed through python's eval, allowing arbitrary code execution. This issue is only locally exploitable and had been addressed in release version...

Medium: python3.9

Issue Overview: A defect was discovered in the Python "ssl" module where there is a memory race condition with the ssl.SSLContext methods "certstorestats" and "getcacerts". The race condition can be triggered if the methods are called at the same time as certificates are loaded into the SSLContex...

PT-2024-38541 · Fastcms · Fastcms

Name of the Vulnerable Software and Affected Versions: FastCMS versions up to 0.1.5 Description: A vulnerability was found in the New Article Category Page component of FastCMS, affecting an unknown function. This issue leads to cross-site scripting and can be exploited remotely. The exploit has...

PT-2024-6338 · Google +4 · Google Chrome +4

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 128.0.6613.119 Description: The issue is related to a use after free flaw in the WebAudio component, which could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This coul...

PT-2024-07: Reading arbitrary files via API in PT Application Inspector (PT AI)

The vulnerability was identified in PT AI affecting versions 4.3.1 to 4.7.2. The vulnerability can be exploited by an attacker with network access to the PT AI control server to read source code files of other user's projects. The vulnerability can be exploited for privilege escalation...

PT-2024-27057 · Unknown · Cert-Manager

Name of the Vulnerable Software and Affected Versions: cert-manager version 1.14.4 Description: The issue is related to insecure permissions, allowing attackers to access sensitive data and escalate privileges by obtaining the service account's token. Recommendations: For cert-manager version...

PT-2024-27058 · Unknown · Chaos-Mesh

Name of the Vulnerable Software and Affected Versions: chaos-mesh version 2.6.3 Description: The issue allows attackers to access sensitive data and escalate privileges by obtaining the service account's token due to insecure permissions. Recommendations: For chaos-mesh version 2.6.3, update to a...

PT-2024-27317 · Unknown · Biplob018 Shortcode Addons

Name of the Vulnerable Software and Affected Versions: biplob018 Shortcode Addons versions 3.2.5 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS attacks. Recommendation...