PT-2024-13857 · Broadcom · Apiida Api Gateway Manager

Name of the Vulnerable Software and Affected Versions: APIIDA API Gateway Manager for Broadcom Layer7 version 2023.2 Description: The APIIDA API Gateway Manager for Broadcom Layer7 is affected by a Cross Site Scripting XSS issue. This allows for malicious scripts to be injected into the website,...

Juniper Releases Security Advisory for Juniper Secure Analytics

Juniper released a security advisory to address multiple vulnerabilities affecting Juniper Secure Analytics. A cyber threat actor could exploit one of these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review the Juniper advisory JSA75636link ...

PT-2024-1578 · WordPress · Post Smtp Mailer/Email Log

Name of the Vulnerable Software and Affected Versions: The POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress versions up to, and including, 2.8.7 Description: The issue is related to Stored Cross-Site Scripting via the device header...

PT-2024-13253 · Unknown · A-World Oirase Beer Waiting Line

Name of the Vulnerable Software and Affected Versions: A-WORLD OIRASE BEER waiting Line version 13.6.1 Description: An issue in the software allows attackers to send crafted notifications via leakage of the channel access token. This can potentially lead to unauthorized access and manipulation of...

PT-2024-13278 · Hcl · Hcl Dryice Myxalytics

Name of the Vulnerable Software and Affected Versions: HCL DRYiCE MyXalytics affected versions not specified Description: The issue allows file upload capability through a path traversal vulnerability. Certain endpoints permit users to manipulate the path, including the file name, where these fil...

PT-2024-41142 · Mimetex +1 · Mimetex +1

Name of the Vulnerable Software and Affected Versions: forkosh Mime Tex versions prior to 1.77 Description: An issue in forkosh Mime Tex allows an attacker to execute arbitrary code via a crafted script. Recommendations: For versions prior to 1.77, update to version 1.77 or later to resolve the...

Upgraded Q -> 2 from #49 [1704028025372]

Judge has assessed an item in Issue 49 as 2 risk. The relevant finding follows: L-05 Some tokens revert on 0 amount transfer ParticlePositionManager::liquidatePosition: File: protocol/ParticlePositionManager.sol 376: // reward liquidator 377: TransferHelper.safeTransfercloseCache.tokenFrom,...

CVE-2018-25096

MdAlAmin-aol Own Health Record is affected across versions 0.1-alpha through 0.3.1-alpha. The vulnerability arises from a flaw in processing of the file includes/logout.php that enables cross-site request forgery. The attack can be initiated remotely. A fix is available: upgrade to version 0.4-al...

PT-2024-5293 · Zoho · Zoho Manageengine Adaudit Plus

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine ADAudit Plus versions 7260 and below Description: The issue is related to information disclosure in Zoho ManageEngine ADAudit Plus, a Windows Active Directory management and reporting tool. Exploitation of this issue may all...

PT-2023-9660 · FFmpeg +4 · Ffmpeg +4

Name of the Vulnerable Software and Affected Versions: FFmpeg versions n5.1 to n6.1 Description: The issue is related to an Off-by-one Error vulnerability in the libavfilter/avf showspectrum.c component of the FFmpeg library. This vulnerability allows attackers to cause a Denial of Service DoS vi...

PT-2023-31838 · Pixelemu · Terraclassifieds – Simple Classifieds Plugin

Name of the Vulnerable Software and Affected Versions: TerraClassifieds – Simple Classifieds Plugin versions 2.0.3 and earlier Description: The issue is related to an Unrestricted Upload of File with Dangerous Type vulnerability in the Pixelemu TerraClassifieds – Simple Classifieds Plugin. This...

PT-2023-31673 · Repute Infosystems · Bookingpress

Name of the Vulnerable Software and Affected Versions: Repute Infosystems BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin versions 1.0.0 through 1.0.72 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special...

PT-2023-35674 · Git +1 · Libxml2

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a heap-use-after-free READ 8 crash. The crash state involves the functions xmlStaticCopyNode, xmlDocCopyNode, and...

PT-2024-1381

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.10 Description The issue is related to the smb2 get data area len function in the fs/smb/server/smb2misc.c file of the KSMBD file system in the Linux kernel. It is associated with an out-of-bounds access in t...

PT-2023-8030 · Apache · Apache Ofbiz

Name of the Vulnerable Software and Affected Versions: Apache OFBiz versions prior to 18.12.11 Description: The issue is related to insufficient validation of incoming requests, allowing a remote attacker to perform a Server-Side Request Forgery SSRF attack by sending a specially crafted HTTP...

PT-2023-25642 · St · St54-Android-Packages-Apps-Nfc

Name of the Vulnerable Software and Affected Versions: ST ST54-android-packages-apps-Nfc package version 130-20230215-23W07p0 and earlier Description: The issue is related to an out-of-bounds read in the ST ST54-android-packages-apps-Nfc package for Android. Recommendations: For versions prior to...

Hospital Management System 4.0 XSS / Shell Upload / SQL Injection Vulnerabilities

Hospital Management System versions 4.0 and below suffer from cross site scripting, remote shell upload, and remote SQL injection vulnerabilities. Description: Mutiple vulnerabilties were discovered in Hospital Management System Affected CMS: Hospital Management System Affected Version: unread...

PYSEC-2023-265

Apache Airflow, in versions prior to 2.8.0, contains a security vulnerability that allows an authenticated user with limited access to some DAGs, to craft a request that could give the user write access to various DAG resources for DAGs that the user had no access to, thus, enabling the user to...

PT-2023-8379 · Apache · Apache Airflow

Name of the Vulnerable Software and Affected Versions: Apache Airflow versions 2.6.0 through 2.7.3 Description: The issue is related to a stored XSS vulnerability that allows a DAG author to add unbounded and not-sanitized JavaScript in the parameter description field of the DAG. This JavaScript...

borrower can prevent liquidity provider from withdrawing their liquidity

Lines of code Vulnerability details Description When a liquidity provider wants to withdraw their liquidity they can call ParticlePositionManager::reclaimLiquidity. This will prevent any renewals: ParticlePositionManager::addPremium: File: protocol/ParticlePositionManager.sol 508: // check LP...