PT-2024-36416 · Unknown · Dcat-Admin

Name of the Vulnerable Software and Affected Versions: Dcat Admin version 2.2.0-beta Description: The issue is a cross-site scripting XSS vulnerability. It affects the /admin/articles/create endpoint. Recommendations: For Dcat Admin version 2.2.0-beta, consider disabling access to the...

PT-2024-69: Cross-Site Scripting (XSS) in custom properties in PhpSpreadsheet

The vulnerability was identified in PhpSpreadsheet, versions = 3.0.0, = 2.0.0, = 2.2.0, = 3.0.0, = 2.0.0, = 2.2.0, = 2.3.4 to 2.3.5 or higher Additional information: Security advisory Researcher: Aleksey Solovev Positive Technologies...

PT-2024-36829 · Tcpdf +2 · Tcpdf +2

Name of the Vulnerable Software and Affected Versions: tc-lib-pdf-font versions prior to 2.6.4 TCPDF versions prior to 6.8.0 Description: The issue is related to the mishandling of fonts, specifically the misparsing of FontBBox for Type 1 and TrueType fonts. This problem affects the management of...

PT-2024-17822 · Code Projects · Code-Projects Travel Management System

Name of the Vulnerable Software and Affected Versions: code-projects Travel Management System version 1.0 Description: A critical issue affects the processing of the file /subcat.php, where the manipulation of the catid argument leads to sql injection. The attack can be initiated remotely. The...

PT-2024-10245

Name of the Vulnerable Software and Affected Versions MySQL Server versions 8.0.40 and prior MySQL Server versions 8.4.3 and prior MySQL Server versions 9.1.0 and prior Description The vulnerability in the MySQL Server product of Oracle MySQL, specifically in the InnoDB component, is related to...

PT-2024-10247 · Oracle +6 · Mysql Server +5

Name of the Vulnerable Software and Affected Versions: MySQL Server versions 8.0.39 and prior MySQL Server versions 8.4.2 and prior MySQL Server versions 9.0.1 and prior Description: The issue allows a high-privileged attacker with network access via multiple protocols to compromise MySQL Server...

PT-2025-19714

Name of the Vulnerable Software and Affected Versions Output Messenger versions prior to 2.0.63 Description Output Messenger is affected by a directory traversal issue caused by improper file path handling. Remote attackers can use ../ sequences in parameters to access sensitive files outside the...

PT-2024-10252 · Oracle +6 · Mysql Server +5

Name of the Vulnerable Software and Affected Versions: MySQL Server versions 8.0.39 and prior MySQL Server versions 8.4.2 and prior MySQL Server versions 9.0.1 and prior Description: The issue is related to insufficient input validation in the Server: Optimizer component of Oracle MySQL Server...

PT-2024-10261 · Oracle +8 · Mysql Server +7

Name of the Vulnerable Software and Affected Versions: MySQL Server versions 8.0.40 and prior MySQL Server versions 8.4.3 and prior MySQL Server versions 9.1.0 and prior Description: The issue is related to an unbounded resource allocation in the MySQL Server product, specifically in the Server:...

BIT-KAFKA-2024-56128 Apache Kafka: SCRAM authentication vulnerable to replay attacks when used without encryption

Incorrect Implementation of Authentication Algorithm in Apache Kafka's SCRAM implementation. Issue Summary: Apache Kafka's implementation of the Salted Challenge Response Authentication Mechanism SCRAM did not fully adhere to the requirements of RFC 5802 1. Specifically, as per RFC 5802, the serv...

PT-2024-36782 · Redcap · Redcap

Name of the Vulnerable Software and Affected Versions: REDCap versions 14.9.6 through 15.0.0 Description: The issue is related to a security flaw in the Notes section of calendar events in REDCap, exposing users to a Cross-Site Request Forgery CSRF attack. An attacker can exploit this by luring...

PT-2024-34639 · Ibm · Ibm I

Name of the Vulnerable Software and Affected Versions: IBM i versions 7.3 through 7.5 Description: The issue is related to server-side request forgery SSRF, which may allow an authenticated attacker to send unauthorized requests from the system. This could potentially lead to network enumeration ...

CGA-HMVH-96M2-WCRJ

Bulletin has no description...

PT-2024-17761 · Emlog Pro · Emlog Pro

Name of the Vulnerable Software and Affected Versions: Emlog Pro versions up to 2.4.1 Description: A vulnerability was found in Emlog Pro, affecting unknown code of the file /admin/user.php. The manipulation of the keyword argument leads to cross-site scripting. The attack can be initiated...

PT-2024-53: Reading arbitrary files via API in PT Application Inspector (PT AI)

The vulnerability was identified in PT Application Inspector PT AI, versions 4.4.0 - 4.9.0 inlusevely. The discovered vulnerability allows an attacker with network access to PT AI to read source code files of other users' projects. The vulnerability can be used for privilege escalation...

Delta Electronics DTM Soft

RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as: Minimize network exposure for all control...

Tibbo AggreGate Network Manager

RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to achieve code execution on the affected device. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as: Minimize network...

Hitachi Energy RTU500 series CMU

RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to cause a denial-of-service condition. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. CISA reminds organizations to perform...

CVE-2024-56128

A flaw was found in Apache Kafka's implementation of the Salted Challenge Response Authentication Mechanism SCRAM, which did not fully adhere to the requirements of RFC 5802. Specifically, as per RFC 5802, the server must verify that the nonce sent by the client in the second message matches the...

CVE-2024-56128

Incorrect Implementation of Authentication Algorithm in Apache Kafka's SCRAM implementation. Issue Summary: Apache Kafka's implementation of the Salted Challenge Response Authentication Mechanism SCRAM did not fully adhere to the requirements of RFC 5802 1. Specifically, as per RFC 5802, the serv...