PT-2024-18703 · Helpdesk · Helpdesk

Name of the Vulnerable Software and Affected Versions: HelpDeskZ versions 2.0.2 and earlier Description: A Cross-Site Scripting XSS issue has been found in HelpDeskZ. This issue could allow an attacker to send a specially crafted JavaScript payload within the email field and partially take contro...

PT-2024-21669 · Apache · Apache Archiva

Name of the Vulnerable Software and Affected Versions: Apache Archiva affected versions not specified Description: The issue is related to an Incorrect Authorization vulnerability in Apache Archiva, where a setting to disable user registration can be bypassed. Since Apache Archiva has been retire...

PT-2024-2130 · Apache · Apache Airflow

Name of the Vulnerable Software and Affected Versions: Apache Airflow versions prior to 2.8.2 Description: The issue is related to incorrect default permissions in Apache Airflow, allowing authenticated Ops and Viewers users to view all information on audit logs, including dag names and usernames...

PT-2024-14625 · Unknown · Mongo-Express

Name of the Vulnerable Software and Affected Versions: mongo-express version 1.0.2 Description: The issue allows for Cross-Site Request Forgery CSRF attacks, as demonstrated by the deletion of a Collection through the /admin endpoint. Recommendations: For mongo-express version 1.0.2, consider...

PT-2024-22157 · Sirv · Sirv Image Optimizer

Name of the Vulnerable Software and Affected Versions: Sirv Image Optimizer, Resizer and CDN versions through 7.2.0 Description: A Missing Authorization issue affects the Image Optimizer, Resizer and CDN – Sirv. Recommendations: For versions through 7.2.0, update to a version that contains a fix...

PT-2024-2030 · Mattermost · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost versions prior to v8.1.9 Description: The issue is related to inadequate access control in Mattermost, allowing remote attackers to gain unauthorized access to files in archived channels. Specifically, members can access files...

PT-2024-18395 · Mattermost · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost versions prior to v8.1.9 Description: Mattermost fails to check the invite guest permission when inviting guests of other teams to a team, allowing a member with permissions to add other members but not to add guests to add a guest...

PT-2024-18394 · Mattermost · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost versions prior to 8.1.9 Description: Mattermost fails to check if compliance export is enabled when fetching posts of public channels, allowing a user that is not a member of the public channel to fetch the posts, which will not be...

PT-2024-20584 · Espocrm · Espocrm

Name of the Vulnerable Software and Affected Versions: EspoCRM versions prior to 8.1.2 Description: The issue allows an attacker to inject arbitrary IP or domain in the "Password Change" page, potentially redirecting the victim to a malicious page. This could lead to credential stealing or other...

CVE-2024-24773 Apache Superset: Improper validation of SQL statements allows for unauthorized access to data

Improper parsing of nested SQL statements on SQLLab would allow authenticated users to surpass their data authorization scope. This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1. Users are recommended to upgrade to version 3.1.1, which fixes the issue...

PT-2024-2299 · Apache · Apache Ofbiz

Name of the Vulnerable Software and Affected Versions: Apache OFBiz versions prior to 18.12.12 Description: The issue is related to a possible path traversal in Apache OFBiz, allowing authentication bypass. This can be exploited by a remote attacker to bypass the authentication process...

PT-2024-13295 · Couchbase · Couchbase Server

Name of the Vulnerable Software and Affected Versions: Couchbase Server versions through 7.2.2 Description: An issue was discovered in Couchbase Server where a data reader may cause a denial of service because of the OOM killer, leading to the application exiting. Recommendations: For versions...

PT-2024-21901

Name of the Vulnerable Software and Affected Versions Zimbra Collaboration ZCS version 9.0 Zimbra Collaboration ZCS version 10.0 Description An issue exists in the CalendarInvite feature of the Zimbra webmail classic user interface due to improper input validation when handling the calendar heade...

PT-2024-20550

Name of the Vulnerable Software and Affected Versions Apache Superset versions prior to 3.0.4 Apache Superset versions 3.1.0 through 3.1.0 Description A guest user could exploit a chart data REST API and send arbitrary SQL statements that, on error, could leak information from the underlying...

PT-2024-13529 · Unknown · Perfmatters

Name of the Vulnerable Software and Affected Versions: Perfmatters versions 2.1.6 and earlier Description: The issue is related to a Missing Authorization vulnerability in Perfmatters. Recommendations: For Perfmatters versions 2.1.6 and earlier, update to a version later than 2.1.6 to resolve the...

Intel® NUC Software Advisory

Summary: Potential security vulnerabilities in some Intel® NUC software installers may allow escalation of privilege or denial of service. Intel is releasing software updates to mitigate these potential vulnerabilities. Vulnerability Details: CVEID: CVE-2023-32272 Description: Uncontrolled search...

CVE-2023-51747 SMTP smuggling in Apache James

Apache James prior to versions 3.8.1 and 3.7.5 is vulnerable to SMTP smuggling. A lenient behaviour in line delimiter handling might create a difference of interpretation between the sender and the receiver which can be exploited by an attacker to forge an SMTP envelop, allowing for instance to...

CVE-2023-50379 Apache Ambari: authenticated users could perform command injection to perform RCE

Malicious code injection in Apache Ambari in prior to 2.7.8. Users are recommended to upgrade to version 2.7.8, which fixes this issue. Impact: A Cluster Operator can manipulate the request by adding a malicious code injection and gain a root over the cluster main host...

PT-2024-20244 · Likeshop · Likeshop

Name of the Vulnerable Software and Affected Versions: Likeshop versions prior to 2.5.7 Description: The issue allows attackers to run arbitrary SQL commands via the function DistributionMemberLogic::getFansLists. This enables attackers to potentially extract or modify sensitive data...

PT-2024-14172 · Apache · Apache James

Name of the Vulnerable Software and Affected Versions: Apache James versions prior to 3.7.5 and 3.8.0 Description: The issue concerns the exposure of a JMX endpoint on localhost, which is subject to pre-authentication deserialisation of untrusted data. Given a deserialisation gadget, this could b...