PT-2024-20226 · Jsherp · Jsherp

Name of the Vulnerable Software and Affected Versions: jshERP version 3.3 Description: The issue concerns an Arbitrary File Upload vulnerability. The jshERP-boot/systemConfig/upload interface does not check the uploaded file type, and the biz parameter can be spliced into the upload path, resulti...

PT-2024-14050 · Nagios Xi · Nagios Xi

Name of the Vulnerable Software and Affected Versions: Nagios XI versions up to and including 2024R1 Description: A stored cross-site scripting XSS vulnerability in the NOC component allows low-privileged users to execute malicious HTML or JavaScript code via the audio file upload functionality...

PT-2024-19642 · Eyoucms · Eyoucms

Name of the Vulnerable Software and Affected Versions: eyoucms version 1.6.5 Description: The issue allows a remote attacker to run arbitrary code via a crafted URL, exploiting a Cross Site Scripting vulnerability in the input parameter. Recommendations: For eyoucms version 1.6.5, consider...

PT-2024-1440 · Kaspersky · Kaspersky Security 8.0 For Linux Mail Server

Name of the Vulnerable Software and Affected Versions: Kaspersky Security 8.0 for Linux Mail Server Description: The issue allows an attacker to potentially force an administrator to click on a malicious link to perform unauthorized actions. This is due to the lack of measures to neutralize speci...

PT-2024-11748 · Sparx Systems · Enterprise Architect

Name of the Vulnerable Software and Affected Versions: Enterprise Architect version 16.0.1605 Description: The issue allows attackers to run arbitrary SQL commands via the Find parameter in the Select Classifier dialog box. This can be exploited by attackers to execute unauthorized SQL queries...

PT-2024-19520 · Seo Panel · Seo Panel

Name of the Vulnerable Software and Affected Versions: SEO Panel version 4.10.0 Description: A user enumeration issue was found, occurring during user authentication. This issue allows an attacker to determine if a username is valid or not through differences in error messages, enabling a...

PT-2024-20148 · Cups Easy · Cups Easy

Name of the Vulnerable Software and Affected Versions: Cups Easy Purchase & Inventory version 1.0 Description: A Cross-Site Scripting XSS issue has been reported, where user-controlled inputs are not sufficiently encoded. This can be exploited via the /cupseasylive/statemodify.php endpoint,...

PT-2024-11023 · Unknown · Contiki-Ng Tinydtls

Name of the Vulnerable Software and Affected Versions: Contiki-NG tinyDTLS through master branch 53a0d97 Description: An assertion failure in the check certificate request function allows attackers to cause a denial of service. This issue affects Contiki-NG tinyDTLS, enabling attackers to exploit...

PT-2024-4875 · Solarwinds · Solarwinds Access Rights Manager

Name of the Vulnerable Software and Affected Versions: SolarWinds Access Rights Manager affected versions not specified Description: The issue is related to the createGlobalServerChannelInternal method in SolarWinds Access Rights Manager, which has weaknesses in its deserialization mechanism. Thi...

CVE-2024-23342 python-ecdsa vulnerable to Minerva attack on P-256

The ecdsa PyPI package is a pure Python implementation of ECC Elliptic Curve Cryptography with support for ECDSA Elliptic Curve Digital Signature Algorithm, EdDSA Edwards-curve Digital Signature Algorithm and ECDH Elliptic Curve Diffie-Hellman. Versions 0.18.0 and prior are vulnerable to the...

CVE-2024-23342 python-ecdsa vulnerable to Minerva attack on P-256

The ecdsa PyPI package is a pure Python implementation of ECC Elliptic Curve Cryptography with support for ECDSA Elliptic Curve Digital Signature Algorithm, EdDSA Edwards-curve Digital Signature Algorithm and ECDH Elliptic Curve Diffie-Hellman. Versions 0.18.0 and prior are vulnerable to the...

PT-2024-12024

Name of the Vulnerable Software and Affected Versions Jensen of Scandinavia Eagle 1200AC version V15.03.06.33 en Description A command injection issue was discovered in the function formWriteFacMac, allowing attackers to execute arbitrary commands by manipulating the mac parameter. This enables...

PT-2024-1191 · Oracle · Oracle Webcenter Content

Name of the Vulnerable Software and Affected Versions: Oracle WebCenter Content version 12.2.1.4.0 Description: The issue is related to insufficient input validation in the Content Server component of Oracle WebCenter Content, allowing an unauthenticated attacker with network access via HTTP to...

PT-2024-14361 · Totolink · Totolink A3700R

Name of the Vulnerable Software and Affected Versions: TOTOlink A3700R version 9.1.2u.5822 B20200513 Description: The issue is related to a remote command execution RCE vulnerability. It can be exploited via the NTPSyncWithHost function. Recommendations: For version 9.1.2u.5822 B20200513, conside...

PT-2024-14364 · Totolink · Totolink A3700R

Name of the Vulnerable Software and Affected Versions: TOTOlink A3700R version 9.1.2u.5822 B20200513 Description: The issue is related to a remote command execution RCE vulnerability. It can be exploited via the setOpModeCfg function. Recommendations: For TOTOlink A3700R version 9.1.2u.5822...

PT-2024-14362 · Totolink · Totolink A3700R

Name of the Vulnerable Software and Affected Versions: TOTOlink A3700R version 9.1.2u.5822 B20200513 Description: The issue is related to a remote command execution RCE vulnerability. It can be exploited via the setTracerouteCfg function. Recommendations: For TOTOlink A3700R version 9.1.2u.5822...

PT-2024-2984 · Unknown · Pandora Fms

Name of the Vulnerable Software and Affected Versions: Pandora FMS versions 700 through 776 Description: The issue is related to an improper neutralization of special elements used in an OS command, allowing OS command injection. This can enable the creation of a reverse shell and the execution o...

PT-2024-1501 · Cisco · Cisco Telepresence Management Suite

Name of the Vulnerable Software and Affected Versions: Cisco TelePresence Management Suite affected versions not specified Description: The issue exists due to insufficient input validation by the web-based management interface, allowing an authenticated, remote attacker to conduct a cross-site...

PT-2024-1485 · Cisco · Cisco Prime Infrastructure +1

Name of the Vulnerable Software and Affected Versions: Cisco Prime Infrastructure affected versions not specified Cisco Evolved Programmable Network EPN Manager affected versions not specified Description: A vulnerability in the web-based management interface could allow an authenticated, remote...

PT-2024-1560 · Sap · Sap S/4Hana Finance For Advanced Payment Management

Name of the Vulnerable Software and Affected Versions: SAP S/4HANA Finance for Advanced Payment Management - versions SAPSCORE 128, S4CORE 107 Description: The issue is related to improper authorization checks in the SAP S/4HANA Finance for Advanced Payment Management. This could allow an attacke...