PT-2024-38039

Name of the Vulnerable Software and Affected Versions open-webui/open-webui version 0.3.8 Description The /api/pipelines/upload endpoint is susceptible to arbitrary file write and deletion due to improper sanitization of the file.filename variable when concatenated with CACHE DIR. This allows...

PT-2024-7463

Name of the Vulnerable Software and Affected Versions: Mitel MiCollab versions 9.8 SP1 FP2 9.8.1.201 and earlier Description: A vulnerability in the NuPoint Unified Messaging NPM component of Mitel MiCollab could allow an unauthenticated attacker to conduct a path traversal attack due to...

PT-2025-11524 · Dell · Os10

Name of the Vulnerable Software and Affected Versions: Dell SmartFabric OS10 Software versions 10.5.4.x through 10.6.0.x Description: The issue is related to Improper Privilege Management, which could be exploited by a low-privileged attacker with local access, potentially leading to unauthorized...

PT-2024-17126

Name of the Vulnerable Software and Affected Versions Wireshark versions 4.2.0 through 4.2.8 Wireshark versions 4.4.0 through 4.4.1 Description The issue allows for denial of service via packet injection or crafted capture file. It is related to the ECMP dissector crash in Wireshark...

PT-2024-31739

Name of the Vulnerable Software and Affected Versions: Apache Subversion versions up to and including 1.14.3 Description: On Windows platforms, a "best fit" character encoding conversion of command line arguments to Subversion's executables may lead to unexpected command line argument...

PT-2024-32834 · Directus · Directus

Name of the Vulnerable Software and Affected Versions: Directus versions prior to 10.13.2 Description: The issue concerns the exposure of access tokens from query strings in system logs, potentially allowing an attacker to gain administrative control and access to unauthorized data. This occurs...

PT-2024-7643 · X.Org +11 · X.Org Server +11

Name of the Vulnerable Software and Affected Versions: X.Org Server versions prior to 21.1.14 Description: A flaw was found in the X.org server due to improperly tracked allocation size in XkbSetCompatMap, allowing a local attacker to trigger a buffer overflow condition via a specially crafted...

PT-2024-26091

Name of the Vulnerable Software and Affected Versions Sound Assistant versions prior to 6.1.0.9 Description The issue concerns the use of implicit intent for sensitive communication in Sound Assistant, allowing local attackers to obtain sensitive information. Recommendations For versions prior to...

PT-2024-39351 · WordPress · Custom Twitter Feeds

Name of the Vulnerable Software and Affected Versions: Custom Twitter Feeds WordPress plugin versions prior to 2.2.3 Description: The issue allows high privilege users to inject scripts due to the plugin not filtering some of its settings. Recommendations: For versions prior to 2.2.3, update to...

PT-2024-31846 · Solvait · Solvait

Name of the Vulnerable Software and Affected Versions: Solvait version 24.4.2 Description: A security flaw has been discovered that allows an attacker to elevate their privileges. By manipulating the Request ID and Action Type parameters in "/AssignToMe/SetAction" API endpoint, an attacker can...

PT-2024-26084 · Unknown · Libsef.Quram.So

Name of the Vulnerable Software and Affected Versions: libSEF.quram.so versions prior to SMR Oct-2024 Release 1 Description: The issue is related to an integer overflow in libSEF.quram.so, which allows local attackers to write out-of-bounds memory. This can be exploited by local attackers...

PT-2024-9590 · Gstreamer +7 · Gstreamer +7

Name of the Vulnerable Software and Affected Versions: GStreamer versions prior to 1.24.10 Description: The issue is related to a use-after-free vulnerability in the GStreamer multimedia framework. This vulnerability is associated with the processing of CodecPrivate elements in Matroska streams...

PT-2024-32557 · Pickplugins · Pickplugins Accordion

Name of the Vulnerable Software and Affected Versions: PickPlugins Accordion versions 2.2.99 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS in PickPlugins Accordion...

PT-2024-39679 · WordPress · Secure Custom Fields +1

Name of the Vulnerable Software and Affected Versions: Secure Custom Fields WordPress plugin versions prior to 6.3.9 Advanced Custom Fields Pro WordPress plugin versions prior to 6.3.9 Description: The issue allows high privilege users, such as admins, to run arbitrary PHP functions through the...

PT-2024-39052 · WordPress · Phlox

Name of the Vulnerable Software and Affected Versions: Shortcodes and extra features for Phlox theme plugin for WordPress versions up to, and including, 2.16.3 Description: The issue is related to Stored Cross-Site Scripting via the url parameter in the Modern Heading and Icon Picker widgets. Thi...

PT-2024-32297 · Artifex +6 · Artifex Ghostscript +6

Name of the Vulnerable Software and Affected Versions: Artifex Ghostscript versions prior to 10.04.0 Description: An issue was discovered in the decode utf8 function in base/gp utf8.c of Artifex Ghostscript. This issue is related to overlong UTF-8 encoding, which can lead to possible ../ director...

PT-2024-8121 · Rockwell Automation · Rockwell Automation Products +1

Name of the Vulnerable Software and Affected Versions: Rockwell Automation products affected versions not specified Verve Asset Manager versions prior to v1.38 Description: An improper authorization issue exists in the affected products, potentially allowing an unauthorized user to sign in and...

PT-2024-29431 · Cadclick · Cadclick

Name of the Vulnerable Software and Affected Versions: CADClick versions 1.11.0 and earlier Description: A reflected cross-site scripting XSS vulnerability is present in "Artikel.aspx" in CADClick, allowing remote attackers to inject arbitrary web script or HTML via the searchindex parameter. Thi...

PT-2024-6649

Name of the Vulnerable Software and Affected Versions: Apache Avro versions 1.11.3 and previous versions Apache Avro versions prior to 1.11.4 Bamboo Data Center and Server versions 9.2.1, 9.6.0, and 10.0.0-rc3 Bitbucket Data Center and Server versions 8.6.0, 8.7.0, 8.8.0, 8.9.0, 8.10.0, 8.11.0,...

PT-2024-32653

Name of the Vulnerable Software and Affected Versions Apache Commons IO versions 2.0 through 2.13.x Description The org.apache.commons.io.input.XmlStreamReader class may excessively consume CPU resources when processing maliciously crafted input. This issue affects Apache Commons IO from version...