PT-2024-31657 · Delta Electronics · Diaenergie

Name of the Vulnerable Software and Affected Versions: Delta Electronics DIAEnergie versions 1.10.1.8610 and prior Description: A vulnerability exists when CEBC.exe processes a 'RecalculateHDMWYC' message, which is split into 4 fields using the '' character as the separator. An unauthenticated...

PT-2024-18213 · WordPress · Print Labels With Barcodes

Name of the Vulnerable Software and Affected Versions: The Print Labels with Barcodes plugin for WordPress versions up to, and including, 3.4.6 Description: The issue allows for unauthorized access, modification, and loss of data due to an improper capability check on 42 separate AJAX functions...

CISA and Partners Release Fact Sheet on Defending OT Operations Against Ongoing Pro-Russia Hacktivist Activity

Today, CISA, in collaboration with U.S. and international partners, published a joint fact sheet, Defending OT Operations Against Ongoing Pro-Russia Hacktivist Activity. This fact sheet provides information and mitigations associated with cyber operations conducted by pro-Russia hacktivists who...

PT-2024-26157 · WordPress · Sticky Buttons

Name of the Vulnerable Software and Affected Versions: The Sticky Buttons WordPress plugin versions prior to 3.2.4 Description: The issue is related to the lack of CSRF checks in some bulk actions, which could allow attackers to make logged-in admins perform unwanted actions, such as deleting...

PT-2024-30533

Name of the Vulnerable Software and Affected Versions Adive Framework version 2.0.8 Description The issue is related to insufficient encoding of user-controlled inputs, resulting in a persistent Cross-Site Scripting XSS vulnerability. This vulnerability can be exploited via the...

PT-2024-30279

Name of the Vulnerable Software and Affected Versions HubBank version 1.0.2 Description The issue is related to a SQL injection vulnerability that could allow an attacker to send a specially crafted SQL query to the database through different endpoints, such as "/admin/view users.php?id=1",...

PT-2024-30276 · Hubbank · Hubbank

Name of the Vulnerable Software and Affected Versions: HubBank version 1.0.2 Description: The issue allows a registered user to upload malicious PHP files via upload document fields, resulting in webshell execution. This is a critical unrestricted file upload vulnerability. Recommendations: For...

PT-2024-30290 · Hubbank · Hubbank

Name of the Vulnerable Software and Affected Versions: HubBank version 1.0.2 Description: The issue is related to a SQL injection vulnerability that could allow an attacker to send a specially crafted SQL query to the database through different endpoints, such as "/user/transaction.php?id=1",...

PT-2024-25309 · Unknown · Crelly Slider

Name of the Vulnerable Software and Affected Versions: Crelly Slider versions 1.4.5 and earlier Description: The issue is related to an Authorization Bypass Through User-Controlled Key vulnerability. This allows for authorization bypass, potentially compromising system security. Recommendations:...

PT-2024-30201 · Tenda · Tenda A301

Name of the Vulnerable Software and Affected Versions: Tenda A301 version 15.13.08.12 multi TDE01 Description: A critical issue affects the function formAddMacfilterRule of the file /goform/setBlackRule. The manipulation of the argument deviceList leads to stack-based buffer overflow. The attack...

PT-2024-22392 · Unknown · Puneethreddyhc Event Management

Name of the Vulnerable Software and Affected Versions: PuneethReddyHC Event Management version 1.0 Description: The issue allows attackers to run arbitrary SQL commands via the event id parameter in a crafted POST request to the "/event-management-master/backend/register.php" API endpoint. This...

PT-2024-23405 · WordPress · Bannerlid

Name of the Vulnerable Software and Affected Versions: Bannerlid WordPress plugin versions 1.1.0 and earlier Description: The issue is related to Reflected Cross-Site Scripting, which could be used against high privilege users such as administrators. This occurs because the plugin does not escape...

PT-2024-3428 · Linksys · Linksys E5600

Name of the Vulnerable Software and Affected Versions: Linksys E5600 version 1.1.0.26 Description: The issue is related to a command injection vulnerability via the ipurl parameter at the "/API/info" form endpoint. This vulnerability is associated with the lack of neutralization of special elemen...

PT-2024-14091

Name of the Vulnerable Software and Affected Versions QNAP QTS versions prior to 5.1.4.2596 build 20231128 QNAP QTS versions prior to 4.5.4.2627 build 20231225 QNAP QuTS hero versions prior to h5.1.3.2578 build 20231110 QNAP QuTS hero versions prior to h4.5.4.2626 build 20231225 QNAP QuTScloud...

PT-2024-5203

Name of the Vulnerable Software and Affected Versions: Docker Engine versions prior to v27.1.1 Docker Engine versions 19.03 and later, excluding v19.03.x Docker CE versions prior to v27.1.1 Description: A security vulnerability has been detected in certain versions of Docker Engine, which could...

PT-2024-23683 · Yealink · Yealink Vp59 Teams Editions

Name of the Vulnerable Software and Affected Versions: Yealink VP59 Teams Editions version 91.15.0.118 Description: An issue in the factory reset procedure of Yealink VP59 Teams Editions allows a physically proximate attacker to gain control of an account. Recommendations: For Yealink VP59 Teams...

PT-2024-23851 · Synapse +2 · Synapse +2

Name of the Vulnerable Software and Affected Versions: Synapse versions prior to 1.105.1 Description: A remote Matrix user with malicious intent, sharing a room with Synapse instances, can dispatch specially crafted events to exploit a weakness in the V2 state resolution algorithm. This can induc...

PT-2024-5973 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 15.6 through 17.0.5 GitLab CE/EE versions 17.1 through 17.1.3 GitLab CE/EE versions 17.2 through 17.2.1 Description: An issue in GitLab CE/EE allows disclosure of limited information of an exported group or project to...

April 23, 2024—KB5036980 (OS Builds 22621.3527 and 22631.3527) Preview

None None...

PT-2024-40393 · Dbt-Core +1 · Dbt-Core +1

Name of the Vulnerable Software and Affected Versions: dbt-core versions 1.6.0 through 1.6.12 dbt-core versions 1.7.0 through 1.7.12 Description: The issue is related to a recursion error in the sqlparse library used by dbt-core. This error can be triggered by parsing a specific SQL query, such a...