PT-2024-24313 · Samsung · Samsung Magician

Name of the Vulnerable Software and Affected Versions: Samsung Magician version 8.0.0 Description: An issue in Samsung Magician allows an attacker to escalate privileges via arbitrary file permission writes. This can occur because symlinks are used during the installation process. The attacker mu...

PT-2024-11570 · Nuki · Nuki Smart Lock 2.0 +3

Name of the Vulnerable Software and Affected Versions: Nuki Smart Lock 3.0 versions 3.0 through 3.3.4 Nuki Smart Lock 2.0 versions 2.0 through 2.12.3 Nuki Bridge v1 versions 1.0 through 1.21.9 Nuki Bridge v2 versions 2.0 through 2.13.1 Description: An issue was discovered on certain Nuki Home...

PT-2024-26774 · WordPress · The Letterpress

Name of the Vulnerable Software and Affected Versions: The LetterPress WordPress plugin versions 1.2.2 and earlier Description: The issue is related to the lack of CSRF checks in some areas, allowing attackers to perform unwanted actions on logged-in users via CSRF attacks, such as deleting...

PT-2024-12219 · Phpok · Phpok

Name of the Vulnerable Software and Affected Versions: phpok version 6.4.003 Description: The issue concerns SQL injection in the index f function located in phpok64/framework/api/call control.php. This allows for potential exploitation of the SQL injection vulnerability. Recommendations: For php...

PT-2024-25798 · Unknown · Trix Editor

Name of the Vulnerable Software and Affected Versions: Trix editor versions prior to 2.1.1 Trix editor versions prior to 2.1.4 Description: The Trix editor is vulnerable to arbitrary code execution when copying and pasting content from the web or other documents with markup into the editor. This...

PT-2024-25679

Name of the Vulnerable Software and Affected Versions Werkzeug versions prior to 3.0.3 Description The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact wit...

PT-2025-7547

Name of the Vulnerable Software and Affected Versions XWiki versions prior to 15.10.11 XWiki versions prior to 16.4.1 XWiki versions prior to 16.5.0RC1 Description XWiki Platform is susceptible to a remote code execution RCE vulnerability. An unauthenticated attacker can execute arbitrary code by...

PT-2024-25119 · Unknown · Crmeb Java

Name of the Vulnerable Software and Affected Versions: crmeb java version 1.3.4 Description: The issue is related to a Server-Side Request Forgery SSRF in the mergeList method of the ImageMergeController class. This allows for potential exploitation. No information is provided about the estimated...

PT-2024-31657 · Delta Electronics · Diaenergie

Name of the Vulnerable Software and Affected Versions: Delta Electronics DIAEnergie versions 1.10.1.8610 and prior Description: A vulnerability exists when CEBC.exe processes a 'RecalculateHDMWYC' message, which is split into 4 fields using the '' character as the separator. An unauthenticated...

PT-2024-18213 · WordPress · Print Labels With Barcodes

Name of the Vulnerable Software and Affected Versions: The Print Labels with Barcodes plugin for WordPress versions up to, and including, 3.4.6 Description: The issue allows for unauthorized access, modification, and loss of data due to an improper capability check on 42 separate AJAX functions...

CISA and Partners Release Fact Sheet on Defending OT Operations Against Ongoing Pro-Russia Hacktivist Activity

Today, CISA, in collaboration with U.S. and international partners, published a joint fact sheet, Defending OT Operations Against Ongoing Pro-Russia Hacktivist Activity. This fact sheet provides information and mitigations associated with cyber operations conducted by pro-Russia hacktivists who...

PT-2024-26157 · WordPress · Sticky Buttons

Name of the Vulnerable Software and Affected Versions: The Sticky Buttons WordPress plugin versions prior to 3.2.4 Description: The issue is related to the lack of CSRF checks in some bulk actions, which could allow attackers to make logged-in admins perform unwanted actions, such as deleting...

PT-2024-30533 · Unknown · Adive Framework

Name of the Vulnerable Software and Affected Versions: Adive Framework version 2.0.8 Description: The issue is related to insufficient encoding of user-controlled inputs, resulting in a persistent Cross-Site Scripting XSS vulnerability. This vulnerability can be exploited via the...

PT-2024-30279 · Hubbank · Hubbank

Name of the Vulnerable Software and Affected Versions: HubBank version 1.0.2 Description: The issue is related to a SQL injection vulnerability that could allow an attacker to send a specially crafted SQL query to the database through different endpoints, such as "/admin/view users.php?id=1",...

PT-2024-30276 · Hubbank · Hubbank

Name of the Vulnerable Software and Affected Versions: HubBank version 1.0.2 Description: The issue allows a registered user to upload malicious PHP files via upload document fields, resulting in webshell execution. This is a critical unrestricted file upload vulnerability. Recommendations: For...

PT-2024-30290 · Hubbank · Hubbank

Name of the Vulnerable Software and Affected Versions: HubBank version 1.0.2 Description: The issue is related to a SQL injection vulnerability that could allow an attacker to send a specially crafted SQL query to the database through different endpoints, such as "/user/transaction.php?id=1",...

PT-2024-25309 · Unknown · Crelly Slider

Name of the Vulnerable Software and Affected Versions: Crelly Slider versions 1.4.5 and earlier Description: The issue is related to an Authorization Bypass Through User-Controlled Key vulnerability. This allows for authorization bypass, potentially compromising system security. Recommendations:...

PT-2024-30201 · Tenda · Tenda A301

Name of the Vulnerable Software and Affected Versions: Tenda A301 version 15.13.08.12 multi TDE01 Description: A critical issue affects the function formAddMacfilterRule of the file /goform/setBlackRule. The manipulation of the argument deviceList leads to stack-based buffer overflow. The attack...

PT-2024-14091

Name of the Vulnerable Software and Affected Versions QNAP QTS versions prior to 5.1.4.2596 build 20231128 QNAP QTS versions prior to 4.5.4.2627 build 20231225 QNAP QuTS hero versions prior to h5.1.3.2578 build 20231110 QNAP QuTS hero versions prior to h4.5.4.2626 build 20231225 QNAP QuTScloud...

PT-2024-3428 · Linksys · Linksys E5600

Name of the Vulnerable Software and Affected Versions: Linksys E5600 version 1.1.0.26 Description: The issue is related to a command injection vulnerability via the ipurl parameter at the "/API/info" form endpoint. This vulnerability is associated with the lack of neutralization of special elemen...