PT-2024-22548

Name of the Vulnerable Software and Affected Versions Unit4 Financials by Coda versions prior to 2023Q4 Description The issue is related to an incorrect access control authorization bypass, allowing an authenticated user to modify the password of any user of the application via a crafted request...

PT-2024-20034 · Draytek · Draytek Vigor 3910

Name of the Vulnerable Software and Affected Versions: Draytek Vigor3910 version 4.3.2.5 Description: A Directory Traversal issue was discovered in the process post function. When sending a certain POST request, it calls the function and exports information. Recommendations: For Draytek Vigor3910...

CVE-2024-24683

The CVE-2024-24683 entry affects Apache Hop Engine, specifically the Hop Server component. The vulnerability stems from improper input handling: when the Hop Server writes links to the PrepareExecutionPipelineServlet page, the id parameter is not properly escaped, creating a potential for exploit...

PT-2024-18471 · WordPress · Simple Ajax Chat

Name of the Vulnerable Software and Affected Versions: The Simple Ajax Chat WordPress plugin versions prior to 20240223 Description: The issue concerns the reflection of unsanitized input to other users, specifically when visitors use malicious names in the chat. This allows for potential malicio...

PT-2024-22714

Name of the Vulnerable Software and Affected Versions HT Easy GA4 Google Analytics 4 versions 1.1.7 and earlier Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker...

PT-2024-22756

Name of the Vulnerable Software and Affected Versions Themefic Tourfic versions prior to 2.11.8 Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. Recommendations For versions prior to 2.11.8...

PT-2024-2472 · Apache · Apache Wicket

Name of the Vulnerable Software and Affected Versions: Apache Wicket versions 9.1.0 through 9.16.0 Apache Wicket milestone releases for the 10.0 series Description: The issue is related to a bypass of the CSRF protection in Apache Wicket due to an error in the evaluation of the fetch metadata...

PT-2024-22761 · Unknown · Pdf Embedder

Name of the Vulnerable Software and Affected Versions: PDF Embedder versions n/a through 4.6.4 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can inject...

PT-2024-15475 · WordPress · Travelpayouts: All Travel Brands In One Place

Name of the Vulnerable Software and Affected Versions: Travelpayouts: All Travel Brands in One Place WordPress plugin versions 1.1.15 and earlier Description: The issue is related to insufficient validation on the travelpayouts redirect variable, making it possible for unauthenticated attackers t...

PT-2024-16994 · Devklan · Alma Blog

Name of the Vulnerable Software and Affected Versions: Devklan's Alma Blog versions 2.1.10 and earlier Description: The issue is related to improper access control, which could allow an unauthenticated user to access the application's functionalities without the need for credentials...

PT-2024-15247 · WordPress · System Dashboard

Name of the Vulnerable Software and Affected Versions: The System Dashboard WordPress plugin versions prior to 2.8.10 Description: The issue concerns a lack of sanitization and escaping of certain parameters in the plugin, which could allow administrators in multisite WordPress configurations to...

Avalanche 6.4.3 Security Hardening and CVEs addressed

Avalanche 6.4.3 has addressed some new security hardening and vulnerabilities in our Q1 2024 release. We are not aware of any exploitation of these vulnerabilities at the time of disclosure. To address the security vulnerabilities listed below, it is highly recommended to download the Avalanche...

PT-2024-2906 · Ivanti · Ivanti Avalanche

Name of the Vulnerable Software and Affected Versions: Ivanti Avalanche versions prior to 6.4.3 Description: The issue is related to a Path Traversal vulnerability in the web component of Ivanti Avalanche. This vulnerability can be exploited by a remote authenticated attacker to execute arbitrary...

PT-2024-2926 · Ivanti · Ivanti Avalanche

Name of the Vulnerable Software and Affected Versions: Ivanti Avalanche versions prior to 6.4.3 Description: A Path Traversal vulnerability in the web component of Ivanti Avalanche allows a remote authenticated attacker to execute arbitrary commands as SYSTEM. The issue is related to incorrect...

PT-2024-2920 · Ivanti · Ivanti Avalanche

Name of the Vulnerable Software and Affected Versions: Ivanti Avalanche versions prior to 6.4.3 Description: A Null Pointer Dereference issue in the WLAvalancheService component allows an authenticated remote attacker to perform denial of service attacks. The vulnerability is related to pointer...

PT-2024-2918 · Ivanti · Ivanti Avalanche

Name of the Vulnerable Software and Affected Versions: Ivanti Avalanche versions prior to 6.4.3 Description: The issue is related to a Path Traversal vulnerability in the web component of Ivanti Avalanche. This vulnerability allows a remote authenticated attacker to delete specific types of files...

PT-2024-2909

Name of the Vulnerable Software and Affected Versions Ivanti Avalanche versions prior to 6.4.3 Description The issue is related to a Path Traversal vulnerability in the web component of Ivanti Avalanche. This vulnerability allows a remote authenticated attacker to execute arbitrary commands as...

PT-2024-20490 · Apache · Apache Hop Engine

Name of the Vulnerable Software and Affected Versions: Apache Hop Engine versions prior to 2.8.0 Description: The issue is related to improper input validation in the Apache Hop Engine, specifically affecting the Hop Server component. When the Hop Server writes links to the...

PT-2024-2915 · Ivanti · Ivanti Avalanche

Name of the Vulnerable Software and Affected Versions: Ivanti Avalanche versions prior to 6.4.3 Description: The issue is related to a Path Traversal vulnerability in the web component of Ivanti Avalanche. This vulnerability is due to incorrect restriction of a pathname to a restricted directory...

PT-2024-15812 · WordPress · Enjoy Social Feed

Name of the Vulnerable Software and Affected Versions: Enjoy Social Feed plugin for WordPress website versions through 6.2.2 Description: The issue concerns a lack of authorization and CSRF protection in various functions hooked to admin init, allowing unauthenticated users to call them and unlin...