CVE-2024-36124 iq80 Snappy has an out-of-bounds read when uncompressing data, leading to JVM crash

iq80 Snappy is a compression/decompression library. When uncompressing certain data, Snappy tries to read outside the bounds of the given byte arrays. Because Snappy uses the JDK class sun.misc.Unsafe to speed up memory access, no additional bounds checks are performed and this has similar securi...

PT-2024-26581 · Unknown · Ninja Tables

Name of the Vulnerable Software and Affected Versions: Ninja Tables versions through 5.0.9 Description: A Server-Side Request Forgery SSRF issue has been identified. This allows an attacker to trick the server into making unintended requests, potentially leading to unauthorized access to sensitiv...

PT-2024-26859 · Unknown · Silverpeas

Name of the Vulnerable Software and Affected Versions: Silverpeas versions prior to 6.3.5 Description: The issue allows authentication bypass by omitting the Password field to AuthenticationServlet, potentially providing an unauthenticated user with superadmin access. This has been exploited in...

PT-2024-26191 · Unknown · Accessally Popupally

Name of the Vulnerable Software and Affected Versions: AccessAlly PopupAlly versions n/a through 2.1.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS, which allows Stored XSS. This could potentially compromi...

PT-2024-27117 · Unknown · Lylme Spage

Name of the Vulnerable Software and Affected Versions: LyLme spage version 1.9.5 Description: The issue is related to Cross Site Scripting XSS and can be exploited via the admin/link.php endpoint. This means an attacker could potentially inject malicious scripts into the website, affecting users...

PT-2024-4420 · Zyxel · Zyxel Nas542 +1

Name of the Vulnerable Software and Affected Versions: Zyxel NAS326 versions prior to V5.21AAZF.17C0 Zyxel NAS542 versions prior to V5.21ABAG.14C0 Description: A remote code execution vulnerability exists in the file upload-cgi program. An unauthenticated attacker can execute arbitrary code by...

PT-2024-4082 · Libvpx +10 · Libvpx +10

Name of the Vulnerable Software and Affected Versions: libvpx versions prior to 1.14.1 Description: The issue is related to integer overflows in the libvpx library, which can occur when calling vpx img alloc or vpx img wrap with large values of the d w, d h, or align parameters, or the stride ali...

PT-2024-36246 · Snapchat · Snapchat Lenscore

Name of the Vulnerable Software and Affected Versions: Snapchat LensCore versions prior to 12.88 Description: The issue is related to type confusion in Snapchat LensCore, which could lead to denial of service or arbitrary code execution. Recommendations: For versions prior to 12.88, upgrade to...

PT-2024-27179 · Libmodbus +2 · Libmodbus +2

Name of the Vulnerable Software and Affected Versions: libmodbus version 3.1.6 Description: The issue is related to an invalid pointer in the modbus receive function, which allows attackers to cause a Denial of Service DoS via a crafted message sent to the unit-test-server. Recommendations: For...

PT-2024-31086 · WordPress · Comparison Slider

Name of the Vulnerable Software and Affected Versions: Comparison Slider plugin for WordPress versions up to, and including, 1.0.5 Description: The issue is due to missing or incorrect nonce validation on several functions hooked to AJAX actions, making it possible for unauthenticated attackers t...

PT-2024-18802 · WordPress · Remote Content Shortcode

Name of the Vulnerable Software and Affected Versions: Remote Content Shortcode plugin for WordPress versions up to, and including, 1.5 Description: The issue is related to Stored Cross-Site Scripting via the 'remote content' shortcode due to insufficient input sanitization and output escaping on...

PT-2024-24776 · WordPress · Download Monitor

Name of the Vulnerable Software and Affected Versions: Download Monitor plugin for WordPress versions up to, and including, 4.9.13 Description: The issue allows unauthorized access to functionality due to a missing capability check on the dlm uninstall plugin function. This makes it possible for...

PT-2024-26509 · Sourcecodester · Sourcecodester Human Resource Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Human Resource Management System version 1.0 Description: A SQL injection issue allows attackers to execute arbitrary SQL commands via the password parameter in the "/hrm/index.php" API endpoint. Recommendations: For...

PT-2024-4750 · Splunk · Splunk Cloud Platform +1

Name of the Vulnerable Software and Affected Versions: Splunk Enterprise versions prior to 9.2.2 Splunk Enterprise versions prior to 9.1.5 Splunk Enterprise versions prior to 9.0.10 Splunk Cloud Platform versions prior to 9.1.2312.200 Splunk Cloud Platform versions prior to 9.1.2308.207...

PT-2024-24274 · WordPress · Unlimited Elements For Elementor

Name of the Vulnerable Software and Affected Versions: The Unlimited Elements For Elementor plugin for WordPress versions up to, and including, 1.5.107 Description: The issue is a Stored Cross-Site Scripting vulnerability due to insufficient input sanitization and output escaping on user-supplied...

PT-2024-26482 · Totolink · Totolink Cp900L

Name of the Vulnerable Software and Affected Versions: TOTOLINK CP900L version 4.1.5cu.798 B20221228 Description: A stack overflow issue was discovered via the desc parameter in the setIpPortFilterRules function. Recommendations: For TOTOLINK CP900L version 4.1.5cu.798 B20221228, consider disabli...

PT-2024-31578 · WordPress · Kkprogressbar2 Free

Name of the Vulnerable Software and Affected Versions: KKProgressbar2 Free WordPress plugin versions 1.1.4.2 and earlier Description: The issue concerns the lack of CSRF checks in certain areas, potentially allowing attackers to trick logged-in users into performing unintended actions through CSR...

PT-2024-26474 · Totolink · Totolink Nr1800X

Name of the Vulnerable Software and Affected Versions: TOTOLINK NR1800X version 9.1.0u.6681 B20230703 Description: A stack overflow issue was discovered via the password parameter in the urldecode function. Recommendations: For TOTOLINK NR1800X version 9.1.0u.6681 B20230703, consider restricting...

PT-2024-35608 · Unknown · Dolibarr Erp/Crm

Name of the Vulnerable Software and Affected Versions: Dolibarr ERP - CRM version 9.0.1 Description: The issue allows a remote attacker to send a specially crafted SQL query to the system and retrieve all the information stored in the database through the parameters viewstatut in...

PT-2024-15898 · WordPress · Schema App Structured Data

Name of the Vulnerable Software and Affected Versions: The Schema App Structured Data plugin for WordPress versions prior to 2.1.1 Description: The issue allows authenticated attackers with subscriber access or higher to update or delete post metadata due to a missing capability check on the...