HelpDeskZ Cross-Site Scripting Vulnerability

HelpDeskZ is a free PHP-based software that allows you to manage your site's support using a web-based support ticket system. Provides quality support. A cross-site scripting vulnerability exists in HelpDeskZ 2.0.2 and prior versions, which stems from the presence of a cross-site scripting XSS...

PT-2024-20433

Name of the Vulnerable Software and Affected Versions Lepton CMS version 7.0.0 Description An issue in Lepton CMS allows a local attacker to execute arbitrary code via the upgrade.php file in the languages place. Recommendations For Lepton CMS version 7.0.0, consider restricting access to the...

GHSA-QP56-82VP-XQGV Mezzanine allows attackers to bypass access control mechanisms

An issue in Mezzanine v6.0.0 allows attackers to bypass access control mechanisms in the admin panel via a crafted request...

CVE-2024-1808

The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'suqrcode' shortcode in all versions up to, and including, 7.0.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it...

PT-2024-21422 · Uverif · Uverif

Name of the Vulnerable Software and Affected Versions: uverif version 2.0 Description: An issue in the software allows a remote attacker to obtain sensitive information. Recommendations: For uverif version 2.0, at the moment, there is no information about a newer version that contains a fix for...

UBUNTU-CVE-2024-24568

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.3, the rules inspecting HTTP2 headers can get bypassed by crafted traffic. The vulnerability has been patched in 7.0.3...

mysql: Server: JSON unspecified vulnerability (CPU Apr 2023)

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: JSON. Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks ...

mysql: Server: DDL unspecified vulnerability (CPU Apr 2023)

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: DDL. Supported versions that are affected are 8.0.32 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks o...

mysql: Server: Optimizer unspecified vulnerability (CPU Oct 2023)

Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Optimizer. Supported versions that are affected are 8.0.34 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful...

PT-2024-2171 · Unknown · F-Logic Datacube3

Name of the Vulnerable Software and Affected Versions: F-logic DataCube3 version 1.0 Description: The issue is related to unrestricted file upload, which could allow an authenticated malicious actor to upload a file of a dangerous type by manipulating the filename extension. This could potentiall...

NetApp SnapCenter Security Vulnerability

NetApp SnapCenter is a suite of applications from Network Appliance NetApp that provides the ability to back up, verify, clone, and restore NetApp storage systems. A security vulnerability exists in NetApp SnapCenter versions 4.8 through prior to 5.0. An attacker could exploit the vulnerability t...

Dell ESI for SAP LaMa 安全漏洞

Dell ESI for SAP LAMA is a software solution that integrates SAP LaMa with Dell products from Dell USA. An information disclosure vulnerability exists in Dell ESI for SAP LAMA version 10.0, which can be exploited by an attacker to obtain administrator-level credentials by eavesdropping on network...

PT-2024-20327

Name of the Vulnerable Software and Affected Versions Yonyou space-time enterprise information integration platform versions 9.0 and earlier Description The issue allows an attacker to obtain sensitive information via the gwbhAIM parameter in the "saveMove.jsp" file located in the "hr position"...

HPESBHF04596 rev.2 - HPE SimpliVity Servers Using SSH, Remote Authentication Bypass (Terrapin Attack)

Potential Security Impact: Remote: Access Restriction Bypass SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. SimpliVity Omnistack for HPE - Version 4.2.0 and earlier CVSS Scores: | CVE | CVSS Vector | Base Score | | --- | --- | --- | | CVE-2023-48795 |...

CVE-2023-34315

Incorrect default permissions in some IntelR VROC software before version 8.0.8.1001 may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2024-25213

Employee Managment System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /edit.php...

lambda-middleware Security Vulnerabilities

lambda-middleware is a collection of middleware for AWS lambda functions. A security vulnerability exists in dbartholomae lambda-middleware frameguard version 1.0.4 and earlier, which stems from a security vulnerability in the component JSON Mime-Type Handler...

CVE-2024-25305

Code-projects Simple School Managment System 1.0 allows Authentication Bypass via the username and password parameters at School/index.php...

PT-2024-20423 · Unknown · Employee Management System

Name of the Vulnerable Software and Affected Versions: Employee Management System version 1.0 Description: The issue allows a remote attacker to execute arbitrary code via the "edit-photo.php" component. This is due to an Unrestricted File Upload vulnerability. Recommendations: For Employee...

PT-2024-15220 · Snow · Snow Inventory Agent

Name of the Vulnerable Software and Affected Versions: Snow Inventory Agent versions through 6.14.5 Description: The issue is related to an Authentication Bypass by Spoofing vulnerability, allowing Signature Spoof. This vulnerability does not have any reported real-world incidents or estimated...