PT-2024-37658 · WordPress · Login With Phone Number

Name of the Vulnerable Software and Affected Versions: Login with phone number plugin for WordPress versions up to, and including, 1.7.49 Description: The issue is due to a lack of validation and missing capability check on user-supplied data in the lwp update password action function. This allow...

PT-2024-39093 · Sourcecodester · Clinic'S Patient Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Clinics Patient Management System version 2.0 Description: A vulnerability exists in the system, allowing for an open redirect. The issue is related to the manipulation of the goto page argument in an unknown function of the fi...

PT-2024-18172 · Nt Ware +1 · Uniflow Online +1

Name of the Vulnerable Software and Affected Versions: uniFLOW Online versions prior to and including 2024.1.0 Description: The registration process of uniFLOW Online apps can be compromised when email login is enabled on the tenant, particularly for those utilizing email login in combination wit...

PT-2024-38512 · WordPress · Dn Popup

Name of the Vulnerable Software and Affected Versions: DN Popup WordPress plugin versions 1.2.2 and earlier Description: The issue is related to the lack of a CSRF check when updating the plugin's settings. This could allow attackers to make a logged-in admin change the settings via a CSRF attack...

CVE-2024-7540

oFono AT CMGL Command Uninitialized Variable Information Disclosure Vulnerability. This vulnerability allows local attackers to disclose sensitive information on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this...

PT-2024-27279

Name of the Vulnerable Software and Affected Versions ydata-profiling versions 3.7.0 or newer Description A cross-site scripting XSS issue in the ydata-profiling open-source library allows malicious payloads to run when a maliciously crafted report is viewed in the browser. Recommendations For...

PT-2024-26480 · Totolink · Totolink Cp900L

Name of the Vulnerable Software and Affected Versions: TOTOLINK CP900L version 4.1.5cu.798 B20221228 Description: A stack overflow issue was discovered via the desc parameter in the SetPortForwardRules function. This allows for potential exploitation. Recommendations: For TOTOLINK CP900L version...

PT-2024-26468 · Dedecms · Dedecms

Name of the Vulnerable Software and Affected Versions: DedeCMS version 5.7.114 Description: The issue concerns an arbitrary file upload vulnerability located on the media add .php page in the backend of the website. Recommendations: For version 5.7.114, consider restricting access to the media ad...

PT-2024-3929

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 125.0.6422.141 Microsoft Edge affected versions not specified Description: The issue is related to a use after free vulnerability in the Presentation API of Google Chrome and Microsoft Edge browsers. This...

PT-2024-31847 · Dedecms · Dedecms

Name of the Vulnerable Software and Affected Versions: DedeCMS version 5.7 Description: A vulnerability was found in DedeCMS, affecting unknown code of the file /src/dede/sys group edit.php. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The vendor was...

PT-2024-25925 · Clario · Clario

Name of the Vulnerable Software and Affected Versions: Clario through 2024-04-11 for Desktop Description: The issue is related to weak permissions for the %PROGRAMDATA%Clario directory and the attempt to load DLLs from this location as SYSTEM. Recommendations: For Clario through 2024-04-11 for...

PT-2024-21775 · Ibm · Ibm Db2

Name of the Vulnerable Software and Affected Versions: IBM Db2 for Linux, UNIX and Windows includes DB2 Connect Server versions 10.5, 11.1, and 11.5 Description: The issue is related to a denial of service condition that can be triggered with a specially crafted query under certain conditions...

PT-2024-2406 · Tenda · Tenda Ac15

Name of the Vulnerable Software and Affected Versions: Tenda AC15 versions 15.03.05.18 through 15.03.20 multi Description: A critical issue affects the function formSetSpeedWan of the file /goform/SetSpeedWan. The manipulation of the argument speed dir leads to a stack-based buffer overflow. This...

PT-2024-21782 · Ibm · Ibm Maximo Application Suite

Name of the Vulnerable Software and Affected Versions: IBM Maximo Application Suite version 7.6.1.3 Description: The issue is related to an XML External Entity Injection XXE attack when processing XML data. A remote attacker could exploit this to expose sensitive information or consume memory...

PT-2024-2436 · Adobe · Experience Manager

Name of the Vulnerable Software and Affected Versions: Adobe Experience Manager versions 6.5.19 and earlier Description: The issue is related to a stored Cross-Site Scripting XSS vulnerability that could allow an attacker to inject malicious scripts into vulnerable form fields. This could lead to...

PT-2024-14631

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free UAF issue has been resolved in the Linux kernel. The pmif driver data, which contains clocks, is allocated along with spmi controller. When a device is removed, spmi...

PT-2024-21976 · Supercali · Supercali

Name of the Vulnerable Software and Affected Versions: SuperCali version 1.1.0 Description: A reflected cross-site scripting XSS issue exists, allowing remote attackers to execute arbitrary JavaScript code via the email parameter in the "bad password.php" page. This could potentially affect a...

PT-2024-20958 · Terrasoft · Creatio Terrasoft Crm

Name of the Vulnerable Software and Affected Versions: Creatio Terrasoft CRM version 7.18.4.1532 Description: The issue allows a remote attacker to obtain sensitive information via a crafted request to the "terrasoft.axd" component. This enables the attacker to potentially access unauthorized dat...

Wordfence Intelligence Weekly WordPress Vulnerability Report (February 5, 2024 to February 11, 2024)

Did you know were running a Bug Bounty Extravaganza again? Earn over 6x our usual bounty rates, up to $10,000, for all vulnerabilities submitted through February 29th, 2024 when you opt to have Wordfence handle responsible disclosure! Last week, there were 95 vulnerabilities disclosed in 65...

PT-2024-13876 · Undefined · Undefined

Name of the Vulnerable Software and Affected Versions: No information is available about the vulnerable software and its affected versions. Description: The issue is mentioned on Twitter with a link provided, but the details about the issue itself are not specified. There is no information about...