PT-2024-36727 · Mudler · Localai

Name of the Vulnerable Software and Affected Versions: mudler/LocalAI versions up to and including 2.15.0 Description: A Cross-Site Request Forgery CSRF vulnerability exists, allowing attackers to trick victims into deleting installed models by crafting a malicious HTML page. This can cause the...

PT-2024-22858 · Unknown · Volmarg Personal Management System

Name of the Vulnerable Software and Affected Versions: Volmarg Personal Management System version 1.4.64 Description: The issue concerns stored cross site scripting XSS via the upload of an SVG file that contains embedded JavaScript code. This allows for the potential execution of malicious scrip...

PT-2024-37696 · Directus · Directus

Name of the Vulnerable Software and Affected Versions: Directus version 10.13.0 Description: The issue allows an authenticated external attacker to modify presets created by the same user to assign them to another user. This is possible because the application only validates the user parameter in...

PT-2024-28378 · Yzmcms · Yzmcms

Name of the Vulnerable Software and Affected Versions: yzmcms version 7.1 Description: A cross-site scripting XSS vulnerability in the Publish Article function allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into a published article. Recommendations: For...

PT-2024-27738 · 14Finger · 14Finger

Name of the Vulnerable Software and Affected Versions: 14Finger version 1.1 Description: Insecure permissions in the component "/api/admin/user" of 14Finger allow attackers to access all user information via a crafted GET request. The username and other sensitive information can be accessed throu...

PT-2024-37680 · Unknown · Y Project Ruoyi

Name of the Vulnerable Software and Affected Versions: y project RuoYi versions up to 4.7.9 Description: A vulnerability was found in the function isJsonRequest of the component Content-Type Handler. The manipulation of the argument HttpHeaders.CONTENT TYPE leads to cross site scripting. The atta...

PT-2024-6615

Name of the Vulnerable Software and Affected Versions: Certifi versions 2021.05.30 through 2024.07.03 Description: The issue is related to the insufficient validation of data when processing the GLOBALTRUST root certificate, which may allow a remote attacker to compromise the integrity of protect...

PT-2024-28047

Name of the Vulnerable Software and Affected Versions yt-dlp versions prior to 2024.07.01 youtube-dl versions prior to 2024-07-03 Description The issue concerns command-line audio/video downloaders yt-dlp and youtube-dl. Prior to the fixed versions, these tools do not limit the extensions of...

PT-2024-27235 · Splunk · Splunk Cloud Platform +1

Name of the Vulnerable Software and Affected Versions: Splunk Enterprise versions prior to 9.2.2 Splunk Enterprise versions prior to 9.1.5 Splunk Enterprise versions prior to 9.0.10 Splunk Cloud Platform versions prior to 9.1.2312.200 Splunk Cloud Platform versions prior to 9.1.2308.207...

PT-2024-28057 · Nix +3 · Nix +3

Name of the Vulnerable Software and Affected Versions: Nix versions prior to 2.23.1 Nix versions prior to 2.22.2 Nix versions prior to 2.21.3 Nix versions prior to 2.20.7 Nix versions prior to 2.19.5 Nix versions prior to 2.18.4 Description: Nix is a package manager for Linux and other Unix syste...

PT-2024-36578 · WordPress · Simple Photoswipe

Name of the Vulnerable Software and Affected Versions: Simple Photoswipe WordPress plugin version 0.1 Description: The issue concerns a lack of authorization checks when updating settings, potentially allowing any authenticated user to modify them. Recommendations: For Simple Photoswipe WordPress...

PT-2024-4547 · Synology · Synology Router Manager

Name of the Vulnerable Software and Affected Versions: Synology Router Manager versions prior to 1.2.5-8227-11 Synology Router Manager versions prior to 1.3.1-9346-8 Description: The issue is related to the AirPrint functionality in Synology Router Manager, where code is loaded without integrity...

Johnson Controls Illustra Essentials Gen 4 (Update A)

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 6.8 ATTENTION : Exploitable remotely/low attack complexity Vendor : Johnson Controls, Inc. Equipment : Illustra Essentials Gen 4 Vulnerability : Insertion of Sensitive Information into Log File 2. RISK EVALUATION Successful exploitation of this vulnerability...

Johnson Controls Illustra Essentials Gen 4 (Update A)

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 6.8 ATTENTION : Exploitable remotely Vendor : Johnson Controls, Inc. Equipment : Illustra Essentials Gen 4 Vulnerability : Storing Passwords in a Recoverable Format 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an authenticated...

PT-2024-37379 · Unknown · Gaizhenbiao/Chuanhuchatgpt

Name of the Vulnerable Software and Affected Versions: gaizhenbiao/chuanhuchatgpt version 20240410 Description: A path traversal issue allows any user to delete other users' chat histories and any files ending in .json on the target system. This can lead to a denial of service, as users are unabl...

PT-2024-37290

Name of the Vulnerable Software and Affected Versions: pytorch-lightning version 2.2.4 Description: A path traversal issue exists in the "/v1/runs" API endpoint, allowing attackers to exploit this vulnerability when extracting tar.gz files. This can be used to deploy malicious tar.gz plugins that...

MAL-2024-2946 Malicious code in recommendations-fe (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in recommendations-fe (npm)

--- -= Per source details. Do not edit below this line.=-...

PT-2024-33912 · Ipswitch · Whatsup Gold

Name of the Vulnerable Software and Affected Versions: WhatsUp Gold versions prior to 2023.1.3 Description: The issue allows an authenticated user with certain permissions to upload an arbitrary file, which can lead to remote code execution RCE using the...

PT-2024-4541

Name of the Vulnerable Software and Affected Versions VMware ESXi affected versions not specified Description VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory AD permissions can gain full access to an ESXi host that was previously...