12768 matches found
CVE-2024-52513
Nextcloud Server’s Text app contains an attachments folder that is accessible via Files drop or Password protected shares. A malicious user can download attachments referenced in text files without providing the password after receiving such a share link. Affected versions include Nextcloud Serve...
CVE-2024-52518 Nextcloud Server is missing password confirmation when changing external storage options
Nextcloud Server is a self hosted personal cloud system. After an attacker got access to the session of a user or administrator, the attacker would be able to create, change or delete external storages without having to confirm the password. It is recommended that the Nextcloud Server is upgraded...
CVE-2024-52521
The CVE records a vulnerability in Nextcloud Server where MD5 hashes were used to check background jobs for uniqueness, allowing a background job with specific arguments to be falsely identified as already existing and not queued. Technical details in connected documents confirm the root cause (M...
Siemens Solid Edge SSA-351178 Multiple Vulnerabilities
The version of Siemens Solid Edge installed on the remote Windows host is prior to 224.00.09.04. It is, therefore, affected by multiple vulnerabilities. For more information, consult the vendor advisory. Note that Nessus has not tested for these issues but has instead relied only on the...
PT-2024-34335 · Fortinet · Forticlientwindows
Name of the Vulnerable Software and Affected Versions: Fortinet FortiClientWindows versions 6.4.x through 7.4.0 Description: A use of a hard-coded cryptographic key in Fortinet FortiClientWindows may allow a low-privileged user to decrypt interprocess communication via a monitoring named pipe...
PT-2024-17577 · Pyload · Pyload
Name of the Vulnerable Software and Affected Versions: pyload/pyload version 0.5.0 Description: An open redirection vulnerability exists due to improper handling of the next parameter in the login functionality. This allows an attacker to redirect users to malicious sites, potentially leading to...
PT-2024-10979 · Chatwoot · Chatwoot
Name of the Vulnerable Software and Affected Versions: chatwoot/chatwoot versions prior to 2.4.0 Description: A Session Fixation issue exists, where the application does not invalidate existing sessions on other devices when a user changes their password, allowing old sessions to persist. This ca...
PT-2024-16490 · WordPress · Postx
Name of the Vulnerable Software and Affected Versions: PostX plugin for WordPress versions up to, and including, 4.1.16 Description: The issue is related to a missing capability check on the install required plugin callback function, allowing authenticated attackers with Subscriber-level access a...
PT-2024-8140 · Postgresql +10 · Postgresql +10
Name of the Vulnerable Software and Affected Versions: PostgreSQL versions prior to 17.1 PostgreSQL versions prior to 16.5 PostgreSQL versions prior to 15.9 PostgreSQL versions prior to 14.14 PostgreSQL versions prior to 13.17 PostgreSQL versions prior to 12.21 Description: The issue arises from...
PT-2024-16062 · WordPress · Simple File List
Name of the Vulnerable Software and Affected Versions: Simple File List WordPress plugin versions prior to 6.1.13 Description: The issue is related to a Reflected Cross-Site Scripting flaw. It occurs because the plugin does not properly sanitise and escape a generated URL before outputting it bac...
PT-2024-30579 · Amazon · Aws Sagemaker
Name of the Vulnerable Software and Affected Versions: imartinez/privategpt versions up to and including 0.3.0 versions prior to 0.6.0 Description: A Python command injection vulnerability exists in the complete method of the SagemakerLLM class within ./private...
PT-2024-38093 · Unknown · Dingo Dlibra
Name of the Vulnerable Software and Affected Versions: DInGO dLibra software versions 6.0 through 6.3.19 Description: The issue is related to improper neutralization of input during web page generation, allowing a Reflected Cross-Site Scripting XSS attack. This occurs in the filter parameter of t...
PT-2024-39476 · Funnelkit · Recover Woocommerce Cart Abandonment
Name of the Vulnerable Software and Affected Versions: Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit WordPress plugin versions prior to 3.3.0 Description: The issue allows unauthenticated users to perform SQL injection attacks due to the lack...
CVE-2024-8001 VIWIS LMS Print authorization
A vulnerability was found in VIWIS LMS 9.11. It has been classified as critical. Affected is an unknown function of the component Print Handler. The manipulation leads to missing authorization. It is possible to launch the attack remotely. A user with the role learner can use the administrative...
PT-2024-16374 · WordPress · Chartify
Name of the Vulnerable Software and Affected Versions: The Chartify – WordPress Chart Plugin versions up to, and including, 2.9.5 Description: The issue is related to Local File Inclusion, allowing unauthenticated attackers to include and execute arbitrary files on the server via the source...
PT-2024-15973 · Telerik · Telerik Ui For Winforms
Name of the Vulnerable Software and Affected Versions: Telerik UI for WinForms versions prior to 2024 Q4 2024.4.1113 Description: A code execution attack is possible through an insecure deserialization vulnerability. This issue allows for code execution, which can lead to significant security...
PT-2024-33129 · Abb · Abb Drive Composer
Name of the Vulnerable Software and Affected Versions: DotNetZip versions 1.16.0 and earlier ABB Drive Composer versions prior to 2.9.1 Description: The issue allows a remote attacker to execute arbitrary code via the src/Zip.Shared/ZipEntry.Extract.cs component. This affects products that are no...
PT-2024-35376 · Jenkins · Jenkins Shared Library Version Override Plugin
Name of the Vulnerable Software and Affected Versions: Jenkins Shared Library Version Override Plugin versions 17.v786074c9fce7 and earlier Description: The issue allows attackers with Item/Configure permission on a folder to configure a folder-scoped library override that runs without sandbox...
PT-2024-39719 · Mailmunch · Constant Contact Forms By Mailmunch
Name of the Vulnerable Software and Affected Versions: Constant Contact Forms by MailMunch plugin for WordPress versions up to, and including, 2.1.2 Description: The issue arises from the use of add query arg without proper escaping on the URL, allowing unauthenticated attackers to inject arbitra...
