PT-2024-2637

Name of the Vulnerable Software and Affected Versions pgAdmin versions 8.4 and earlier Description pgAdmin is susceptible to a Remote Code Execution RCE vulnerability stemming from improper restriction of the path name to an accessible directory. Successful exploitation allows a remote attacker t...

PT-2024-10791 · Unknown · Zoneminder

Name of the Vulnerable Software and Affected Versions: ZoneMinder versions prior to 1.34.21 Description: The issue allows remote attackers to execute arbitrary code, escalate privileges, and obtain sensitive information via the PHP SELF component in the classic/views/download.php file. This is a...

PT-2024-21957 · Inotec Sicherheitstechnik · Inotec Sicherheitstechnik Webserver Cps220/64

Name of the Vulnerable Software and Affected Versions: INOTEC Sicherheitstechnik WebServer CPS220/64 version 3.3.19 Description: The issue allows a remote attacker to read arbitrary files via absolute path traversal. For example, using the "/cgi-bin/display?file=/etc/passwd" URI, an attacker can...

PT-2024-22787

Name of the Vulnerable Software and Affected Versions Collabora Online versions prior to 23.05.10.1 Description A stored cross-site scripting issue was found in Collabora Online, a collaborative online office suite based on LibreOffice. An attacker could create a document with an XSS payload in...

PT-2024-22921

Name of the Vulnerable Software and Affected Versions Dolibarr ERP CRM versions up to 19.0.0 Description The issue is related to a lack of sanitization during the installation process, allowing an attacker with adjacent access to the network to execute arbitrary code via a specifically crafted...

PT-2024-23622 · Bento4 · Bento4

Name of the Vulnerable Software and Affected Versions: Bento4 version 1.6.0-641-2-g1529b83 Description: An issue was discovered in Bento4, leading to a Denial of Service DoS. The issue is a heap-use-after-free in AP4 SubStream::AP4 SubStream at Ap4ByteStream.cpp, as demonstrated by mp42ts...

PT-2024-23623 · Bento4 · Bento4

Name of the Vulnerable Software and Affected Versions: Bento4 version 1.6.0-641-2-g1529b83 Description: An issue was discovered in Bento4, leading to a Denial of Service DoS. The issue is a heap-use-after-free in Ap4Sample.h in the AP4 Sample::GetOffset function, as demonstrated by mp42ts...

PT-2024-17724 · WordPress · My Calendar

Name of the Vulnerable Software and Affected Versions: My Calendar WordPress plugin versions prior to 3.4.24 Description: The issue allows users with a role as low as Subscriber to perform Cross-Site Scripting attacks, depending on the permissions set by the admin. This is due to the plugin not...

PT-2024-23220 · Mbed Tls · Mbed Tls

Name of the Vulnerable Software and Affected Versions: Mbed TLS versions 3.3.0 through 3.5.2 Description: A malicious client can cause information disclosure or a denial of service due to a stack buffer over-read in a TLS 1.3 server via a TLS 3.1 ClientHello. This occurs because of a buffer...

PT-2024-6069

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.4.59 and earlier Description The issue is related to an encoding problem in the mod proxy component of the Apache HTTP Server, which can allow an attacker to send request URLs with incorrect encoding to backend...

PT-2024-4677

Name of the Vulnerable Software and Affected Versions: Apache HTTP Server versions 2.4.59 and earlier Description: A null pointer dereference in the mod proxy module of Apache HTTP Server allows an attacker to crash the server via a malicious request. This issue can be exploited by a remote...

PT-2024-4250

Name of the Vulnerable Software and Affected Versions Pillow versions prior to 10.3.0 Description A buffer overflow exists in the imagingcms.c file of the Pillow library due to the use of strcpy instead of strncpy. This issue can allow an attacker to impact the confidentiality, integrity, and...

PT-2024-5104

Name of the Vulnerable Software and Affected Versions: Apache HTTP Server versions 2.4.59 and earlier Description: The issue is related to a potential Server-Side Request Forgery SSRF in the mod rewrite module of the Apache HTTP Server. This allows an attacker to cause unsafe RewriteRules to...

PT-2024-19563 · WordPress · Themify

Name of the Vulnerable Software and Affected Versions: Themify WordPress plugin versions prior to 1.4.4 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for example in...

PT-2024-22347 · Casaos · Casaos

Name of the Vulnerable Software and Affected Versions: CasaOS versions prior to 0.4.7 Description: The Casa OS Login page has a username enumeration issue. An attacker can enumerate usernames by observing the application's response. If the username is incorrect, the application returns "User does...

PT-2024-23491 · Scientech It Solution · Appointment Calendar

Name of the Vulnerable Software and Affected Versions: Scientech It Solution Appointment Calendar versions through 2.9.6 Description: The issue affects the Appointment Calendar, allowing for Reflected XSS due to improper neutralization of input during web page generation. Recommendations: For...

PT-2024-14297 · Heimdal · Heimdal

Name of the Vulnerable Software and Affected Versions: Heimdall versions prior to 2.5.7 Description: The issue concerns a flaw in the Icon Handler that could lead to privilege escalation. This could potentially be exploited through a local network attack. There is currently no known exploit for...

PT-2024-23484 · Dd Rating · Dd Rating

Name of the Vulnerable Software and Affected Versions: DD Rating versions 1.7.1 and earlier Description: The issue is related to improper neutralization of input during web page generation, which leads to a Cross-site Scripting XSS vulnerability, specifically Stored XSS. Recommendations: For DD...

PT-2024-23482 · Unknown · Wppdf.Org Responsive Flipbook

Name of the Vulnerable Software and Affected Versions: wppdf.Org Responsive flipbook versions 1.0.0 and earlier Description: The issue is related to improper neutralization of input during web page generation, which leads to a Stored Cross-site Scripting XSS vulnerability. This allows for the...

PT-2024-23473 · Whizzy · Whizzy

Name of the Vulnerable Software and Affected Versions: Whizzy versions 1.1.18 and earlier Description: The issue is related to an Authorization Bypass Through User-Controlled Key vulnerability. Recommendations: For versions 1.1.18 and earlier, update to a version that contains a fix for this issu...