CVE-2024-32113 Apache OFBiz: Path traversal leading to RCE

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Apache OFBiz.This issue affects Apache OFBiz: before 18.12.13. Users are recommended to upgrade to version 18.12.13, which fixes the issue...

PT-2024-25913

Name of the Vulnerable Software and Affected Versions libxml2 versions prior to 2.11.8 libxml2 versions 2.12.x prior to 2.12.7 Description An issue was discovered in xmllint, which is part of libxml2. The problem arises when formatting error messages with xmllint --htmlout, resulting in a buffer...

PT-2024-16523 · WordPress +1 · Ssl Zen Wordpress Plugin +1

Name of the Vulnerable Software and Affected Versions: SSL Zen WordPress plugin versions prior to 4.6.0 Description: The issue arises because the SSL Zen WordPress plugin relies solely on .htaccess to prevent access to the site's generated private keys. This poses a problem for servers that do no...

PT-2024-22492 · Brocade · Brocade Sannav

Name of the Vulnerable Software and Affected Versions: Brocade SANnav versions prior to 2.3.0a Description: The PostgreSQL implementation in Brocade SANnav is vulnerable to an incorrect local authentication flaw. An attacker accessing the VM where Brocade SANnav is installed can gain access to...

PT-2024-21429

Name of the Vulnerable Software and Affected Versions Apache InLong versions 1.7.0 through 1.11.0 Description The issue is related to the deserialization of untrusted data, allowing attackers to bypass security using malicious parameters. Recommendations For Apache InLong versions 1.7.0 through...

PT-2024-7008

Name of the Vulnerable Software and Affected Versions DOMPurify versions prior to 2.5.4 DOMPurify versions prior to 3.1.3 Description The issue is related to the DOMPurify library, which is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML, and SVG. It has been discovered that...

CVE-2024-4596 Kimai Session information disclosure

A vulnerability was found in Kimai up to 2.15.0 and classified as problematic. Affected by this issue is some unknown functionality of the component Session Handler. The manipulation of the argument PHPSESSIONID leads to information disclosure. The attack may be launched remotely. The complexity ...

CVE-2024-4583

A vulnerability classified as problematic was found in Faraday GM8181 and GM828x up to 20240429. Affected by this vulnerability is an unknown functionality of the component Request Handler. The manipulation leads to information disclosure. The attack can be launched remotely. The exploit has been...

CVE-2024-4582

The CVE-2024-4582 entry concerns Faraday GM8181 and GM828x devices, where an unknown function in the NTP Service is vulnerable to command injection via manipulation of the ntp_srv argument. This enables remote attack capability and, per the description, exploits have been disclosed publicly and u...

PT-2024-7445 · Samsung · Samsung Android

Name of the Vulnerable Software and Affected Versions: Samsung Android mobile devices affected versions not specified Samsung Android mobile devices versions prior to SMR May-2024 Release 1 Description: The issue is related to weaknesses in the authentication procedure of the bootloader component...

PT-2024-18779 · Samsung · Samsung Internet

Name of the Vulnerable Software and Affected Versions: Samsung Internet versions prior to 25.0.0.41 Description: The issue is related to improper privilege management, allowing local attackers to bypass protection for cookies. This enables them to access sensitive information without proper...

PT-2024-31804 · Faraday · Faraday Gm828X +1

Name of the Vulnerable Software and Affected Versions: Faraday GM8181 and GM828x up to 20240429 Description: A problematic issue has been found, affecting some unknown functionality of the file /command port.ini. This leads to information disclosure and can be exploited remotely. The issue has be...

PT-2024-25831 · Unknown · Post Grid Master

Name of the Vulnerable Software and Affected Versions: Post Grid Master versions 3.4.7 and earlier Description: The issue is related to a Missing Authorization vulnerability in AddonMaster Post Grid Master. Recommendations: For Post Grid Master versions 3.4.7 and earlier, update to a version late...

PT-2024-25464 · Emlog Pro · Emlog Pro

Name of the Vulnerable Software and Affected Versions: emlog pro versions 2.3.0 through 2.3.2 Description: An arbitrary file upload issue exists at admin/views/plugin.php, allowing a remote attacker to submit a special request and upload a malicious file to execute arbitrary code. Recommendations...

PT-2024-25541 · Michael Nelson · Print My Blog

Name of the Vulnerable Software and Affected Versions: Print My Blog versions 3.26.2 and earlier Description: The issue is related to a Missing Authorization vulnerability in Michael Nelson Print My Blog. Recommendations: For versions 3.26.2 and earlier, update to a version later than 3.26.2 to...

PT-2024-3315 · Linksys · Linksys E5600

Name of the Vulnerable Software and Affected Versions: Linksys E5600 version 1.1.0.26 Description: The issue is related to a command injection vulnerability in the /API/info endpoint of the Linksys E5600 router's firmware. This vulnerability is caused by the failure to neutralize special elements...

PT-2024-25926 · Open5Gs · Open5Gs

Name of the Vulnerable Software and Affected Versions: Open5GS versions prior to 2.7.1 Description: The issue is related to a reachable assertion that can cause an AMF crash via NAS messages from a UE. This occurs in the gmm state authentication function in amf/gmm-sm.c when the condition != OGS...

CVE-2024-34063 Degraded secret zeroization capabilities in vodozemac

vodozemac is an implementation of Olm and Megolm in pure Rust. Versions 0.5.0 and 0.5.1 of vodozemac have degraded secret zeroization capabilities, due to changes in third-party cryptographic dependencies the Dalek crates, which moved secret zeroization capabilities behind a feature flag and...

PT-2024-25677 · Pterodactyl · Pterodactyl Wings

Name of the Vulnerable Software and Affected Versions: Pterodactyl Wings versions prior to 1.11.12 Description: The issue allows an attacker to gain arbitrary file write and read access on a node if the Wings token is leaked, either by viewing the node configuration or posting it accidentally...

PT-2024-26962 · WordPress · Responsive Contact Form Builder & Lead Generation Plugin

Name of the Vulnerable Software and Affected Versions: The Responsive Contact Form Builder & Lead Generation Plugin WordPress plugin versions 1.8.9 and earlier Description: The issue concerns the lack of sanitization and escaping of some settings in the plugin, which could allow high-privilege...