O2OA 安全漏洞

O2OA is an enterprise application development platform from O2OA open source. A security vulnerability exists in O2OA v8.3.8, which stems from the presence of an arbitrary file upload vulnerability that allows an attacker to execute arbitrary code by uploading a crafted PDF file...

pcp: exposure of the redis server backend allows remote command execution via pmproxy

A flaw was found in PCP. The default pmproxy configuration exposes the Redis server backend to the local network, allowing remote command execution with the privileges of the Redis user. This issue can only be exploited when pmproxy is running. By default, pmproxy is not running and needs to be...

CVE-2024-34952

taurusxin ncmdump v1.3.2 was discovered to contain a segmentation violation via the NeteaseCrypt::FixMetadata function at /src/ncmcrypt.cpp. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted .ncm file...

WordPress ChaosTheory theme <= 1.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Rafie Muhammad Patchstack in WordPress Theme ChaosTheory versions = 1.3...

PT-2024-12725 · Unknown · Averta Phlox Portfolio

Name of the Vulnerable Software and Affected Versions: Averta Phlox Portfolio versions prior to 2.3.1 Description: The issue is related to an Improper Limitation of a Pathname to a Restricted Directory, also known as 'Path Traversal', which allows PHP Local File Inclusion. This means that an...

WordPress month name translation benaceur plugin < 2.3.8 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Bob Matyas in WordPress Plugin month name translation benaceur versions 2.3.8...

CVE-2024-35108

idccms v1.35 was discovered to contain a Cross-Site Request Forgery CSRF via the component /admin/homeProdeal.php?mudi=del&dataType=&dataTypeCN...

PT-2024-21778 · Ibm · Vios +1

Name of the Vulnerable Software and Affected Versions: IBM AIX versions 7.2 through 7.3 VIOS versions 3.1 through 4.1 Description: A vulnerability in the invscout command allows a non-privileged local user to execute arbitrary commands. This issue poses a high risk and could be exploited by...

CVE-2023-47712

IBM Security Guardium 11.3, 11.4, 11.5, and 12.0 could allow a local user to gain elevated privileges on the system due to improper permissions control. IBM X-Force ID: 271527...

WordPress Popup – Popup More Popups plugin <= 2.3.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Rayhan Ramdhany Hanaputra Patchstack Alliance in WordPress Plugin Popup More Popups versions = 2.3.1...

HDF Group HDF5 安全漏洞

HDF Group HDF5 is a suite of tools for managing and storing different types of data from the American company HDF Group. The product supports managing, manipulating, viewing and analyzing data and generating files in portable formats. A security vulnerability exists in HDF5 Library version 1.14.3...

PT-2024-25111 · Tencent · Tencent Libpag

Name of the Vulnerable Software and Affected Versions: Tencent Libpag version 4.3 Description: The issue allows a user to send a crafted image to trigger a buffer overflow, which can lead to remote code execution. Recommendations: For Tencent Libpag version 4.3, update to a version that fixes the...

CVE-2024-33766

lunasvg v2.3.9 was discovered to contain an FPE Floating Point Exception at blendtransformedtiledargb.isra.0...

PT-2024-20700 · Ibm · Ibm Mq

Name of the Vulnerable Software and Affected Versions: IBM MQ versions 9.2 LTS through 9.3 CD Description: The issue allows a remote user to cause a denial of service by sending HTTP requests that would consume all available resources. Recommendations: For IBM MQ versions 9.2 LTS through 9.3 CD,...

pcp: exposure of the redis server backend allows remote command execution via pmproxy

A flaw was found in PCP. The default pmproxy configuration exposes the Redis server backend to the local network, allowing remote command execution with the privileges of the Redis user. This issue can only be exploited when pmproxy is running. By default, pmproxy is not running and needs to be...

WordPress Unique theme <= 0.3.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by stealthcopter Patchstack Alliance in WordPress Theme Unique versions = 0.3.0...

WordPress Debug Log Manager plugin <= 2.3.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Dhabaleshwar Das Patchstack Alliance in WordPress Plugin Debug Log Manager versions = 2.3.1...

PT-2024-25321 · 8Theme · 8Theme Xstore Core

Name of the Vulnerable Software and Affected Versions: 8theme XStore Core versions n/a through 5.3.5 Description: The issue is related to the deserialization of untrusted data in 8theme XStore Core. This can potentially lead to security risks. No information is provided about the estimated number...

PT-2024-25425 · Zammad · Zammad

Name of the Vulnerable Software and Affected Versions: Zammad versions prior to 6.3.0 Description: An issue was discovered where the Zammad Upload Cache uses insecure, partially guessable FormIDs to identify content. This could allow an attacker to brute force these IDs and upload malicious conte...

WordPress Custom field finder plugin <= 0.3 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by CatFather Patchstack Alliance in WordPress Plugin Custom field finder versions = 0.3...