PT-2024-7923

Name of the Vulnerable Software and Affected Versions braces versions prior to 3.0.3 Description The issue is related to uncontrolled resource consumption. If a malicious user sends "imbalanced braces" as input, the parsing will enter a loop, causing the program to allocate heap memory without...

PT-2024-11029 · Nagios · Nagios Cross-Platform Agent

Name of the Vulnerable Software and Affected Versions: Nagios Nagios Cross-Platform Agent NCPA versions prior to 2.4.0 Description: The issue is related to a DOM-based Cross Site Scripting XSS vulnerability in the 'Tail Event Logs' functionality. This vulnerability allows attackers to run arbitra...

Crestron AM-300

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 8.4 ATTENTION : Low attack complexity Vendor : Crestron Equipment : AM-300 Vulnerability : OS Command Injection 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to escalate their privileges to root-level access. 3...

PT-2025-31024 · Snow · Snow

Name of the Vulnerable Software and Affected Versions: snow crate versions prior to 0.9.5 Description: The snow crate, when using stateful TransportState, allows incrementing a nonce, potentially leading to denial of message delivery. Recommendations: Update to snow crate version 0.9.5 or later...

PT-2024-12548

Name of the Vulnerable Software and Affected Versions snapcast versions prior to 0.23.0+dfsg1-1+deb11u1 snapcast versions prior to 0.26.0+dfsg1-1+deb12u1 snapcast version 0.27.0 Description An RCE vulnerability exists in snapcast, a multi-room client-server audio player. Remote attackers can...

PT-2024-19376 · Ministry Of Agriculture · Electronic Delivery Check System

Name of the Vulnerable Software and Affected Versions: Electronic Delivery Check System Ministry of Agriculture, Forestry and Fisheries The Agriculture and Rural Development Project Version versions 14.0.001.002 and earlier Description: The issue is related to the improper restriction of XML...

PT-2024-19452 · Jfinalcms · Jfinalcms

Name of the Vulnerable Software and Affected Versions: JFinalcms version 5.0.0 Description: A Cross Site Scripting XSS issue allows attackers to execute arbitrary code by exploiting the username parameter in the "/admin/login" API endpoint. Recommendations: For JFinalcms version 5.0.0, avoid usin...

PT-2024-13402 · Unknown · Multisigwallet

Name of the Vulnerable Software and Affected Versions: MultiSigWallet version 0xF0C99 Description: A reentrancy issue was found in the executeTransaction function of MultiSigWallet. This issue could potentially be exploited. Recommendations: For MultiSigWallet version 0xF0C99, consider disabling...

PT-2024-13400 · Ncr · Ncr Terminal Handler

Name of the Vulnerable Software and Affected Versions: NCR Terminal Handler version 1.5.1 Description: The issue is related to Cross-Site Request Forgery CSRF that can lead to a one-click account takeover. It is achieved by exploiting multiple vulnerabilities, including an undisclosed function in...

CVE-2024-22404 Permissions bypass in Nextcloud with the files zip app

Nextcloud files Zip app is a tool to create zip archives from one or multiple files from within Nextcloud. In affected versions users can download "view-only" files by zipping the complete folder. It is recommended that the Files ZIP app is upgraded to 1.2.1, 1.4.1, or 1.5.0. Users unable to...

PT-2024-19862 · Fusionpbx · Fusionpbx

Name of the Vulnerable Software and Affected Versions: FusionPBX versions prior to 5.1.0 Description: The issue allows a remote authenticated attacker with administrative privileges to execute an arbitrary script on the web browser of the user logging in to the product. This is achieved through a...

PT-2024-19409 · Vyper · Vyper

Name of the Vulnerable Software and Affected Versions: Vyper versions 0.3.0 through 0.3.9 Description: The concat built-in can write over the bounds of the memory buffer that was allocated for it and thus overwrite existing valid data. The root cause is that the build IR for concat doesn't proper...

VMware Releases Security Advisory for Aria Automation

VMware released a security advisory to address a vulnerability CVE-2023-34063 in Aria Automation. A cyber threat actor could exploit this vulnerability to take control of an affected system. CISA encourages users and administrators to review VMware Security Advisory VMSA-2024-0001link is external...

SFPMonitor.sys KOOB Write vulnerability

SonicWall Capture Client version 3.7.10 and NetExtender Client Windows client 10.2.337 and earlier versions are being installed with sfpmonitor.sys driver. The client applications communicate with the driver through queries. The driver method that handles those queries has Stack-based Buffer...

PT-2024-3204

Name of the Vulnerable Software and Affected Versions Oracle Java SE versions 8u401, 8u401-perf, 11.0.22, 17.0.10, 21.0.2, 22 Oracle GraalVM for JDK versions 17.0.10, 21.0.2, 22 Oracle GraalVM Enterprise Edition versions 20.3.13, 21.3.9 Description The issue is related to a buffer overflow in...

PT-2024-11651 · WordPress · Wp Job Portal

Name of the Vulnerable Software and Affected Versions: WP Job Portal – A Complete Job Board versions n/a through 2.0.1 Description: The issue is related to a Missing Authorization vulnerability in WP Job Portal. This vulnerability affects the WP Job Portal – A Complete Job Board plugin...

Remote code execution

This High severity Remote Code Execution RCE vulnerability was introduced in version 7.13.0 of Confluence Data Center and Server. Remote Code Execution RCE vulnerability, with a CVSS Score of 8.6 and a CVSS Vector of CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N allows an unauthenticated attacker ...

CVE-2024-21674

This High severity Remote Code Execution RCE vulnerability was introduced in version 7.13.0 of Confluence Data Center and Server. Remote Code Execution RCE vulnerability, with a CVSS Score of 8.6 and a CVSS Vector of CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N allows an unauthenticated attacker ...

PT-2024-14933 · Hypr · Hypr Workforce Access

Name of the Vulnerable Software and Affected Versions: HYPR Workforce Access versions prior to 8.7 Description: The issue is related to an Improper Link Resolution Before File Access, also known as 'Link Following', which allows User-Controlled Filename. This affects HYPR Workforce Access on MacO...

PT-2024-11612 · WordPress · Embedsocial Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Seed Social WordPress plugin versions prior to 2.0.4 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for example, in a...