PT-2024-12872

Name of the Vulnerable Software and Affected Versions Atos Unify OpenScape Voice Trace Manager versions prior to V8 R0.9.11 Description An issue was discovered in the administration component of Atos Unify OpenScape Voice Trace Manager, allowing unauthenticated Stored Cross-Site Scripting XSS via...

PT-2024-1571 · Composer +4 · Composer +4

Name of the Vulnerable Software and Affected Versions: Composer versions prior to 2.7.0 Composer versions prior to 2.2.23 Description: The vulnerability is related to the inclusion of functions from an untrusted controlled area in the Composer dependency manager for PHP. Under certain conditions,...

PT-2024-12887 · Axigen · Axigen

Name of the Vulnerable Software and Affected Versions: Axigen versions 10.3.3.0 through 10.3.3.59 Axigen versions 10.4.0 through 10.4.19 Axigen versions 10.5.0 through 10.5.5 Description: The issue is a Cross Site Scripting XSS vulnerability that allows authenticated attackers to execute arbitrar...

PT-2024-20239 · Unknown · Novel-Plus

Name of the Vulnerable Software and Affected Versions: Novel-Plus versions 4.3.0-RC1 and prior Description: A SQL injection issue exists, allowing an attacker to pass specially crafted offset, limit, and sort parameters to perform SQL injection via the "/novel/userFeedback/list" API endpoint...

PT-2024-20347 · Mailjet · Mailjet Module For Prestashop

Name of the Vulnerable Software and Affected Versions: Mailjet module for PrestaShop versions prior to 3.5.1 Description: A guest can download technical information without restriction in the Mailjet module for PrestaShop. Recommendations: For versions prior to 3.5.1, update to version 3.5.1 or...

PT-2024-2745 · Jetbrains · Jetbrains Teamcity +1

Name of the Vulnerable Software and Affected Versions: JetBrains TeamCity versions prior to 2023.11.3 Description: The issue is related to path traversal in JetBrains TeamCity, allowing an attacker to read data within JAR archives. This can be exploited by a remote attacker. The vulnerability is...

Important: nss

Issue Overview: A vulnerability was found in SQLite SQLite3 up to 3.43.0 and classified as critical. This issue affects the function sessionReadRecord of the file ext/session/sqlite3session.c of the component make alltest Handler. The manipulation leads to heap-based buffer overflow. It is...

PT-2024-13339 · Ibm · Ibm Powervm Hypervisor

Name of the Vulnerable Software and Affected Versions: IBM PowerVM Hypervisor versions FW950.00 through FW950.90 IBM PowerVM Hypervisor versions FW1020.00 through FW1020.40 IBM PowerVM Hypervisor versions FW1030.00 through FW1030.30 Description: The issue allows a system administrator to obtain...

PT-2024-19276 · Phpmyfaq · Phpmyfaq

Name of the Vulnerable Software and Affected Versions: phpMyFAQ versions prior to 3.2.5 Description: The 'sharing FAQ' functionality in phpMyFAQ allows any unauthenticated actor to misuse the application to send arbitrary emails to a large range of targets. The front-end of this functionality...

CVE-2015-10129

A vulnerability was found in planet-freo up to 20150116 and classified as problematic. Affected by this issue is some unknown functionality of the file admin/inc/auth.inc.php. The manipulation of the argument auth leads to incorrect comparison. The attack may be launched remotely. The complexity ...

PT-2024-10741 · Unknown · Mpedraza2020 Intranet Del Monterroso

Name of the Vulnerable Software and Affected Versions: mpedraza2020 Intranet del Monterroso versions up to 4.50.0 Description: A critical issue was found in the file config/cargos.php, where the manipulation of the dni profe argument leads to sql injection. The estimated number of potentially...

PT-2024-20695 · Xenforo · Xenforo

Name of the Vulnerable Software and Affected Versions: XenForo versions prior to 2.2.14 Description: The issue allows Directory Traversal with write access by an authenticated user who has permissions to administer styles. This is possible when using a ZIP archive for Styles Import...

PT-2024-3100

Name of the Vulnerable Software and Affected Versions AntiSamy versions prior to 1.7.5 Description The issue is related to a mutation XSS mXSS vulnerability in AntiSamy caused by flawed parsing of the HTML being sanitized. This vulnerability can be exploited when the preserveComments directive is...

PT-2024-19617

Name of the Vulnerable Software and Affected Versions eyoucms version 1.6.5 Description A Cross Site Scripting XSS issue exists in the func parameter, allowing a remote attacker to execute arbitrary code via a crafted URL. Recommendations For eyoucms version 1.6.5, consider restricting access to...

PT-2024-1516

Name of the Vulnerable Software and Affected Versions Vinchin Backup & Recovery version 7.2 Description The issue is related to the use of default root credentials in Vinchin Backup & Recovery. This could allow a remote attacker to gain elevated privileges to the level of a root user by connectin...

PT-2024-14249 · Unknown · Epiphyt Embed Privacy

Name of the Vulnerable Software and Affected Versions: Epiphyt Embed Privacy versions 1.8.0 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as 'Cross-site Scripting', which allows Stored XSS. This means that an attacker can...

PT-2024-19640 · Eyoucms · Eyoucms

Name of the Vulnerable Software and Affected Versions: eyoucms version 1.6.5 Description: The issue is related to a Cross Site Scripting vulnerability in the num parameter, allowing a remote attacker to run arbitrary code via a crafted URL. Recommendations: For eyoucms version 1.6.5, consider...

PT-2024-14017 · Ibm · Ibm Powersc

Name of the Vulnerable Software and Affected Versions: IBM PowerSC versions 1.3 through 2.1 Description: The issue is related to the use of single-factor authentication in IBM PowerSC, which can lead to an unnecessary risk of compromise compared to the benefits of a dual-factor authentication...

PT-2024-14234 · Unknown · Aam Advanced Access Manager

Name of the Vulnerable Software and Affected Versions: AAM Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More versions through 6.9.18 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as 'Cross-site...

CVE-2023-5390

An attacker could potentially exploit this vulnerability, leading to files being read from the Honeywell Experion ControlEdge VirtualUOC and ControlEdge UOC. This exploit could be used to read files from the controller that may expose limited information from the device. Honeywell recommends...