CVE-2024-23537 Apache Fineract: Under certain circumstances, this vulnerability allowed users, without specific permissions, to escalate their privileges to any role.

Improper Privilege Management vulnerability in Apache Fineract.This issue affects Apache Fineract: 1.8.5. Users are recommended to upgrade to version 1.9.0, which fixes the issue...

PT-2024-23614 · Qdrant · Qdrant

Name of the Vulnerable Software and Affected Versions: Qdrant versions 1.6.1 through 1.8.2 Description: A critical issue affects some unknown processing of the file lib/collection/src/collection/snapshots.rs of the component Full Snapshot REST API, leading to path traversal. The manipulation of...

PT-2024-23385 · Realmag777 · Wpcs

Name of the Vulnerable Software and Affected Versions: WPCS versions 1.2.0.1 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the realmag777 WPCS. This issue allows an attacker to perform unintended actions on a user's account. Recommendations: For versions 1.2.0.1 and...

PT-2024-23121 · Unknown · Electron Packager

Name of the Vulnerable Software and Affected Versions: Electron Packager versions prior to 18.3.1 Description: A random segment of 1-10kb of Node.js heap memory allocated either side of a known buffer will be leaked into the final executable. This memory could contain sensitive information such a...

PT-2024-23387 · Unknown · Woocs – Woocommerce Currency Switcher

Name of the Vulnerable Software and Affected Versions: WOOCS – WooCommerce Currency Switcher versions 1.4.1.7 and earlier Description: A Cross-Site Request Forgery CSRF issue has been identified. This type of issue allows an attacker to trick a user into performing unintended actions on a web...

CVE-2024-25955

Dell vApp Manager, versions prior to 9.2.4.9 contain a Command Injection Vulnerability. An authorized attacker could potentially exploit this vulnerability leading to an execution of an inserted command. Dell recommends customers to upgrade at the earliest opportunity...

PT-2024-22803 · Kimai · Kimai

Name of the Vulnerable Software and Affected Versions: Kimai versions prior to 2.13.0 Description: The permission view other timesheet performs differently for the Kimai UI and the API, thus returning unexpected data through the API. When setting the view other timesheet permission to true, on th...

PT-2024-2508 · Dell · Dell Powerscale Onefs

Name of the Vulnerable Software and Affected Versions: Dell PowerScale OneFS versions 8.2.2.x through 9.7.0.x Description: The issue is related to the cleartext transmission of sensitive information. A local low privileged attacker could potentially exploit this, leading to escalation of...

PT-2024-8692

Name of the Vulnerable Software and Affected Versions Apache Kafka Clients versions 2.3.0 through 3.7.1 Description The issue is related to improper privilege management in Apache Kafka Clients, allowing attackers to access arbitrary contents of the disk and environment variables. This can be...

PT-2024-23058 · Reviewx · Reviewx

Name of the Vulnerable Software and Affected Versions: ReviewX versions 1.6.22 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can inject maliciou...

PT-2024-22826 · Synology · Synology Surveillance Station

Name of the Vulnerable Software and Affected Versions: Synology Surveillance Station versions prior to 9.2.0-9289 Synology Surveillance Station versions prior to 9.2.0-11289 Description: The issue is related to an SQL Injection vulnerability in the SnapShot.CountByCategory webapi component. This...

PT-2024-23150

Name of the Vulnerable Software and Affected Versions HasTheme WishSuite versions 1.3.7 and earlier Description The issue is related to improper neutralization of input during web page generation, which allows stored cross-site scripting XSS. This means that an attacker can inject malicious scrip...

PT-2024-17933 · Grafana · Grafana

Name of the Vulnerable Software and Affected Versions: Countdown Timer for Elementor WordPress plugin versions prior to 1.3.7 Description: The issue concerns the Countdown Timer for Elementor WordPress plugin, where versions prior to 1.3.7 do not properly sanitise and escape some parameters when...

PT-2024-23061 · WordPress · Wp Change Email Sender

Name of the Vulnerable Software and Affected Versions: WP Change Email Sender versions prior to 1.3.0 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can inje...

PT-2024-22829 · Synology · Synology Surveillance Station

Name of the Vulnerable Software and Affected Versions: Synology Surveillance Station versions prior to 9.2.0-9289 Synology Surveillance Station versions prior to 9.2.0-11289 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used...

CVE-2024-29735 Apache Airflow: Potentially harmful permission changing by log task handler

Improper Preservation of Permissions vulnerability in Apache Airflow.This issue affects Apache Airflow from 2.8.2 through 2.8.3. Airflow's local file task handler in Airflow incorrectly set permissions for all parent folders of log folder, in default configuration adding write access to Unix...

PT-2024-19358 · Ibm · Ibm Integration Bus For Z/Os +1

Name of the Vulnerable Software and Affected Versions: IBM App Connect Enterprise versions 11.0.0.1 through 11.0.0.23 IBM App Connect Enterprise versions 12.0.1.0 through 12.0.9.0 IBM Integration Bus for z/OS versions 10.1 through 10.1.0.2 Description: The issue concerns the storage of potentiall...

PT-2024-2712 · Adtran · Adtran Netvanta 3120

Name of the Vulnerable Software and Affected Versions: AdTran NetVanta 3120 version 18.01.01.00.E Description: The issue is related to the TELNET service of AdTran NetVanta 3120 devices, which is enabled by default and has default credentials for a root-level account. This is associated with...

PT-2024-23244 · Appscreo · Easy Social Share Buttons

Name of the Vulnerable Software and Affected Versions: Appscreo Easy Social Share Buttons versions n/a through 9.4 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables potential...

PT-2024-19243 · Snp Digital · Salesking

Name of the Vulnerable Software and Affected Versions: SalesKing versions 1.6.15 and earlier Description: The issue is related to a Missing Authorization vulnerability in SNP Digital SalesKing. Recommendations: For versions 1.6.15 and earlier, update to a version later than 1.6.15 to resolve the...