PT-2024-27829 · Unknown · Cliengo – Chatbot

Name of the Vulnerable Software and Affected Versions: Cliengo – Chatbot versions 3.0.1 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web application that...

PT-2024-27047 · Zkteco · Zkbio Cvsecurity

Name of the Vulnerable Software and Affected Versions: ZKTeco ZKBio CVSecurity version 6.1.1 Description: A hardcoded cryptographic key was discovered in the software. Recommendations: For ZKTeco ZKBio CVSecurity version 6.1.1, consider updating to a newer version that does not contain the...

PT-2024-27050 · Undertow · Undertow

Name of the Vulnerable Software and Affected Versions: Undertow affected versions not specified Description: A vulnerability was found in Undertow, which requires the learning-push handler to be enabled in the server's config. By default, this handler is disabled. If enabled and the maxAge config...

PT-2025-29114

Name of the Vulnerable Software and Affected Versions: Apache HTTP Server versions prior to 2.4.64 Description: An Server-Side Request Forgery SSRF issue exists in Apache HTTP Server when mod proxy is loaded. This allows an attacker to send outbound proxy requests to a URL controlled by the...

PT-2024-27425 · Foxiz · Foxiz

Name of the Vulnerable Software and Affected Versions: Foxiz versions 2.3.5 and earlier Description: A Server-Side Request Forgery SSRF vulnerability has been identified in Theme-Ruby Foxiz. This issue allows for unauthorized access to internal resources, potentially leading to sensitive data...

CVE-2024-38346 Apache CloudStack: Unauthenticated cluster service port leads to remote execution

The CloudStack cluster service runs on unauthenticated port default 9090 that can be misused to run arbitrary commands on targeted hypervisors and CloudStack management server hosts. Some of these commands were found to have command injection vulnerabilities that can result in arbitrary code...

CGA-Q22C-5FJ7-HJJX

Bulletin has no description...

PT-2024-5594

Name of the Vulnerable Software and Affected Versions Apache HTTP Server version 2.4.60 Description A regression in the core of Apache HTTP Server 2.4.60 ignores some use of the legacy content-type based configuration of handlers. "AddType" and similar configuration, under some circumstances wher...

PT-2024-5886 · Go +10 · Go +10

Name of the Vulnerable Software and Affected Versions: Go versions prior to 1.22.5 Description: The net/http HTTP/1.1 client mishandled the case where a server responds to a request with an "Expect: 100-continue" header with a non-informational 200 or higher status. This mishandling could leave a...

Exploit for Deserialization of Untrusted Data in Apache Dubbo

Apache Dubbo 反序列化漏洞CVE-2023-29234 is a vulnerability in the Apache Dubbo framework, which allows an attacker to execute arbitrary code on the server-side. The vulnerability is caused by a deserialization issue in the Dubbo framework, which can be exploited by sending a specially crafted serialize...

Improperly Controlled Modification of Dynamically-Determined Object Attributes

Overview org.webjars.npm:ag-grid-community is a fully-featured and highly customizable JavaScript data grid. Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes via the .mergeDeep function. An attacker can execute...

PT-2024-4623

Name of the Vulnerable Software and Affected Versions: Apache HTTP Server versions 2.4.59 and earlier Description: The issue is related to the core of the Apache HTTP Server, where malicious or exploitable response headers from backend applications can lead to information disclosure, Server-Side...

PT-2024-6493 · Unknown · Nginx Proxy Manager

Name of the Vulnerable Software and Affected Versions: Nginx Proxy Manager version 2.11.3 Description: The issue is related to a command injection vulnerability in the requestLetsEncryptSsl function of the NGINX Proxy Manager. This vulnerability can be exploited by a remote attacker to execute...

PT-2024-6554 · Unknown · Nginx Proxy Manager

Name of the Vulnerable Software and Affected Versions: NginxProxyManager version 2.11.3 Description: A command injection vulnerability in the requestLetsEncryptSslWithDnsChallenge function allows an attacker to achieve remote code execution via the "Add Let's Encrypt Certificate" feature. This...

PT-2024-28309 · Rjrodger · Jsonic-Next

Name of the Vulnerable Software and Affected Versions: rjrodger jsonic-next version 2.12.1 Description: The issue allows attackers to execute arbitrary code or cause a Denial of Service DoS via injecting arbitrary properties, leveraging a prototype pollution vulnerability in the empty function...

PT-2024-40913 · Softwarex +1 · Softwarex +1

Name of the Vulnerable Software and Affected Versions: SoftwareX versions prior to 0.9.7 SoftwareX versions prior to 0.10.4 Description: The issue arises from unsafe memory accesses due to the assumption that reprpacked guarantees a specific field order in structs. However, the Rust specification...

PT-2024-28318 · Unknown · Jsonic-Next

Name of the Vulnerable Software and Affected Versions: jsonic-next version 2.12.1 Description: The issue allows attackers to execute arbitrary code or cause a Denial of Service DoS via injecting arbitrary properties. This is achieved through a prototype pollution vulnerability in the util.clone...

PT-2024-5848

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.4.59 and earlier Description The issue is related to a substitution encoding problem in the mod rewrite module of the Apache HTTP Server, allowing an attacker to execute scripts in directories permitted by the...

PT-2024-12862 · WordPress · Goya Theme For Wordpress

Name of the Vulnerable Software and Affected Versions: Goya theme for WordPress versions up to, and including, 1.0.8.7 Description: The issue is related to Reflected Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject...

PT-2024-37181 · Kadence Wp · Gutenberg Blocks With Ai By Kadence Wp

Name of the Vulnerable Software and Affected Versions: The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress versions up to, and including, 3.2.45 Description: The issue is related to DOM-based Stored Cross-Site Scripting via HTML data attributes due to...