PT-2024-26157 · WordPress · Sticky Buttons

Name of the Vulnerable Software and Affected Versions: The Sticky Buttons WordPress plugin versions prior to 3.2.4 Description: The issue is related to the lack of CSRF checks in some bulk actions, which could allow attackers to make logged-in admins perform unwanted actions, such as deleting...

PT-2024-30533 · Unknown · Adive Framework

Name of the Vulnerable Software and Affected Versions: Adive Framework version 2.0.8 Description: The issue is related to insufficient encoding of user-controlled inputs, resulting in a persistent Cross-Site Scripting XSS vulnerability. This vulnerability can be exploited via the...

PT-2024-30279 · Hubbank · Hubbank

Name of the Vulnerable Software and Affected Versions: HubBank version 1.0.2 Description: The issue is related to a SQL injection vulnerability that could allow an attacker to send a specially crafted SQL query to the database through different endpoints, such as "/admin/view users.php?id=1",...

PT-2024-30276 · Hubbank · Hubbank

Name of the Vulnerable Software and Affected Versions: HubBank version 1.0.2 Description: The issue allows a registered user to upload malicious PHP files via upload document fields, resulting in webshell execution. This is a critical unrestricted file upload vulnerability. Recommendations: For...

PT-2024-30290 · Hubbank · Hubbank

Name of the Vulnerable Software and Affected Versions: HubBank version 1.0.2 Description: The issue is related to a SQL injection vulnerability that could allow an attacker to send a specially crafted SQL query to the database through different endpoints, such as "/user/transaction.php?id=1",...

PT-2024-25309 · Unknown · Crelly Slider

Name of the Vulnerable Software and Affected Versions: Crelly Slider versions 1.4.5 and earlier Description: The issue is related to an Authorization Bypass Through User-Controlled Key vulnerability. This allows for authorization bypass, potentially compromising system security. Recommendations:...

PT-2024-30201 · Tenda · Tenda A301

Name of the Vulnerable Software and Affected Versions: Tenda A301 version 15.13.08.12 multi TDE01 Description: A critical issue affects the function formAddMacfilterRule of the file /goform/setBlackRule. The manipulation of the argument deviceList leads to stack-based buffer overflow. The attack...

PT-2024-14091

Name of the Vulnerable Software and Affected Versions QNAP QTS versions prior to 5.1.4.2596 build 20231128 QNAP QTS versions prior to 4.5.4.2627 build 20231225 QNAP QuTS hero versions prior to h5.1.3.2578 build 20231110 QNAP QuTS hero versions prior to h4.5.4.2626 build 20231225 QNAP QuTScloud...

PT-2024-3428 · Linksys · Linksys E5600

Name of the Vulnerable Software and Affected Versions: Linksys E5600 version 1.1.0.26 Description: The issue is related to a command injection vulnerability via the ipurl parameter at the "/API/info" form endpoint. This vulnerability is associated with the lack of neutralization of special elemen...

PT-2024-22392 · Unknown · Puneethreddyhc Event Management

Name of the Vulnerable Software and Affected Versions: PuneethReddyHC Event Management version 1.0 Description: The issue allows attackers to run arbitrary SQL commands via the event id parameter in a crafted POST request to the "/event-management-master/backend/register.php" API endpoint. This...

PT-2024-23405 · WordPress · Bannerlid

Name of the Vulnerable Software and Affected Versions: Bannerlid WordPress plugin versions 1.1.0 and earlier Description: The issue is related to Reflected Cross-Site Scripting, which could be used against high privilege users such as administrators. This occurs because the plugin does not escape...

PT-2024-23683 · Yealink · Yealink Vp59 Teams Editions

Name of the Vulnerable Software and Affected Versions: Yealink VP59 Teams Editions version 91.15.0.118 Description: An issue in the factory reset procedure of Yealink VP59 Teams Editions allows a physically proximate attacker to gain control of an account. Recommendations: For Yealink VP59 Teams...

PT-2024-5203

Name of the Vulnerable Software and Affected Versions: Docker Engine versions prior to v27.1.1 Docker Engine versions 19.03 and later, excluding v19.03.x Docker CE versions prior to v27.1.1 Description: A security vulnerability has been detected in certain versions of Docker Engine, which could...

PT-2024-5973 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 15.6 through 17.0.5 GitLab CE/EE versions 17.1 through 17.1.3 GitLab CE/EE versions 17.2 through 17.2.1 Description: An issue in GitLab CE/EE allows disclosure of limited information of an exported group or project to...

April 23, 2024—KB5036980 (OS Builds 22621.3527 and 22631.3527) Preview

None None...

PT-2024-23851 · Synapse +2 · Synapse +2

Name of the Vulnerable Software and Affected Versions: Synapse versions prior to 1.105.1 Description: A remote Matrix user with malicious intent, sharing a room with Synapse instances, can dispatch specially crafted events to exploit a weakness in the V2 state resolution algorithm. This can induc...

PT-2024-40393 · Dbt-Core +1 · Dbt-Core +1

Name of the Vulnerable Software and Affected Versions: dbt-core versions 1.6.0 through 1.6.12 dbt-core versions 1.7.0 through 1.7.12 Description: The issue is related to a recursion error in the sqlparse library used by dbt-core. This error can be triggered by parsing a specific SQL query, such a...

PT-2024-5034

Name of the Vulnerable Software and Affected Versions: Bouncy Castle Java BC Java versions 1.78 and earlier Bouncy Castle Java LTS BC Java LTS versions 2.73.6 and earlier Bouncy Castle FIPS Java API BC-FJA versions 1.0.2.5 and earlier Bouncy Castle C .Net versions 2.3.1 and earlier Bamboo Data...

PT-2024-33781 · Gitlab · Gitlab Ce/Ee

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 16.1.0 through 16.11.4 GitLab CE/EE versions 17.0.0 through 17.0.2 GitLab CE/EE versions 17.1.0 Description: An issue has been discovered in GitLab CE/EE that allowed for a CSRF attack on GitLab's GraphQL API, leading to...

PT-2024-4515 · Uriparser +6 · Uriparser +6

Name of the Vulnerable Software and Affected Versions: uriparser versions 0.9.7 and earlier Description: An issue in the ComposeQueryEngine function of UriQuery.c in uriparser is related to an integer overflow, which can occur via long keys or values and result in a buffer overflow. This can...