PT-2024-18628 · Zhicms · Zhicms

Name of the Vulnerable Software and Affected Versions: ZhiCms version 4.0 Description: A critical vulnerability was found in the function index of the file app/manage/controller/setcontroller.php. The manipulation of the argument sitename leads to code injection. It is possible to launch the atta...

PT-2024-18665 · Session · Session

Name of the Vulnerable Software and Affected Versions: Session version 1.17.5 Description: The application is vulnerable to Local File Read via chat attachments, allowing internal application files and public files from the user's device to be obtained without the user's consent. Recommendations:...

PT-2024-15529 · Recipes · Recipes

Name of the Vulnerable Software and Affected Versions: Recipes version 1.5.10 Description: The application is vulnerable to Server-Side Request Forgery SSRF, allowing arbitrary HTTP requests to be made through the server. Recommendations: For Recipes version 1.5.10, as a temporary workaround,...

PT-2024-20504 · Unknown · W3Speedster

Name of the Vulnerable Software and Affected Versions: W3SPEEDSTER versions prior to 7.20 Description: A Cross-Site Request Forgery CSRF issue affects the software, allowing unauthorized actions to be performed on behalf of a user. Recommendations: For versions prior to 7.20, update to version 7....

PT-2024-21168 · Blesta · Blesta

Name of the Vulnerable Software and Affected Versions: Blesta versions prior to 5.9.2 Description: A path traversal vulnerability in the "/path/to/uploads/" directory allows attackers to takeover user accounts and execute arbitrary code. Recommendations: For versions prior to 5.9.2, update to...

PT-2024-19632

Name of the Vulnerable Software and Affected Versions Projectworlds Visitor Management System version 1.0 Description A SQL injection issue allows a remote attacker to escalate privileges via the name parameter in the "myform.php" endpoint. This enables the attacker to potentially gain unauthoriz...

PT-2024-20556

Name of the Vulnerable Software and Affected Versions Apache Superset versions prior to 3.0.4 Apache Superset versions 3.1.0 through 3.1.0 Description The issue allows users with custom roles that include can write on dataset and without all data access permissions to create virtual datasets to...

PT-2024-21380 · Piwigo · Piwigo

Name of the Vulnerable Software and Affected Versions: Piwigo versions prior to 14.2.0 Description: An issue exists within Piwigo allowing a malicious user to take over the application. This exploit involves chaining a Cross Site Request Forgery vulnerability to issue a Stored Cross Site Scriptin...

PT-2024-6047

Name of the Vulnerable Software and Affected Versions Clojure versions 1.12.0-alpha5 through 1.20 Clojure versions 1.7.0 through 1.11.1 Description The issue is related to the deserialization of untrusted data, which can allow an attacker to cause a denial of service DoS via the...

PT-2024-15123 · WordPress · Acurax

Name of the Vulnerable Software and Affected Versions: Acurax plugin for WordPress versions up to, and including, 2.6 Description: The issue allows authenticated attackers to extract sensitive data, such as names and email addresses of subscribed visitors, due to Sensitive Information Exposure...

PT-2024-21152 · Unknown · Prestasalesmanager +1

Name of the Vulnerable Software and Affected Versions: PrestaShop module "Account Manager | Sales Representative & Dealers | CRM" prestasalesmanager versions up to 9.0 Description: A guest can download personal information without restriction by performing a path traversal attack in the affected...

PT-2024-14283 · Apache · Apache James

Name of the Vulnerable Software and Affected Versions: Apache James versions prior to 3.8.1 and 3.7.5 Description: A lenient behavior in line delimiter handling might create a difference of interpretation between the sender and the receiver, which can be exploited by an attacker to forge an SMTP...

Improving Security with Wallarm’s NIST CSF 2.0 Dashboard

Ensuring the security of web applications and APIs is more critical than ever. With threats becoming increasingly prevalent and sophisticated, organizations need to employ comprehensive security measures to protect their digital assets. The NIST Cybersecurity Framework CSF 2.0 stands at the...

PT-2024-21413 · Unknown · School Task Manager

Name of the Vulnerable Software and Affected Versions: School Task Manager version 1.0 Description: A SQL Injection issue allows a remote attacker to obtain sensitive information via a crafted payload to the "delete-task.php" component. This enables unauthorized access to data. Recommendations: F...

PT-2024-12943 · Unknown · Student Enrollment In Php

Name of the Vulnerable Software and Affected Versions: Student Enrollment In PHP version 1.0 Description: An arbitrary file upload vulnerability in the Update/Edit Student's Profile Picture function allows attackers to execute arbitrary code via uploading a crafted PHP file. This issue enables...

PT-2024-19593 · Tencent · Tencent Blueking Cmdb

Name of the Vulnerable Software and Affected Versions: Tencent Blueking CMDB versions 3.2.x through 3.9.x Description: The issue is related to Server-Side Request Forgery SSRF via the event subscription function, located at the /service/subscription.go endpoint. This allows attackers to access...

PT-2024-13841 · Indo Sol · Indo-Sol Profinet-Inspektor Nt

Name of the Vulnerable Software and Affected Versions: Indo-Sol PROFINET-INspektor NT versions 2.4.0 and earlier Description: A command injection issue in the gedtupdater service of the firmware allows remote attackers to execute arbitrary system commands with root privileges. This is achieved vi...

PT-2024-21200 · Joomunited · Joomunited Wp Media Folder

Name of the Vulnerable Software and Affected Versions: JoomUnited WP Media folder versions n/a through 5.7.2 Description: The issue is related to an Unrestricted Upload of File with Dangerous Type vulnerability in the JoomUnited WP Media folder. This vulnerability allows for the upload of files...

PT-2024-19386 · Apache · Apache Answer

Name of the Vulnerable Software and Affected Versions: Apache Answer versions through 1.2.1 Description: The issue affects Apache Answer, allowing a logged-in user to cause a Pixel Flood Attack by uploading large pixel files, which can cause the server to run out of memory. This can be done by...

Mozilla Releases Security Updates for Firefox and Thunderbird

Mozilla released security updates to address vulnerabilities in Firefox, Firefox ESR, and Thunderbird. A cyber threat actor could exploit one of these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review the following Mozilla Security Advisorie...