PT-2024-7928

Name of the Vulnerable Software and Affected Versions Action Pack versions 3.1.0 through 6.1.7.8 Action Pack versions 7.0.0 through 7.0.8.4 Action Pack versions 7.1.0 through 7.1.4.0 Action Pack versions 7.2.0 through 7.2.1.0 Description The issue is related to a possible ReDoS vulnerability in t...

PT-2024-26561 · Unknown · Opensis Community Edition

Name of the Vulnerable Software and Affected Versions: OpenSis Community Edition versions 8.0 through 9.1 Description: The issue is related to SQL injection due to a lack of sanitization. An authenticated user can perform SQL injection because the application directly appends an arbitrary value...

PT-2024-9864 · Adobe · Connect

Name of the Vulnerable Software and Affected Versions: Adobe Connect versions 12.6, 11.4.7 and earlier Description: The issue is related to a reflected Cross-Site Scripting XSS vulnerability. If an attacker convinces a victim to visit a URL referencing a vulnerable page, malicious JavaScript...

PT-2024-33061

Name of the Vulnerable Software and Affected Versions Cloudlog version 2.6.15 Description The issue concerns an SQL injection vulnerability in Cloudlog's Oqrs.php request form, which can be exploited via the station id or callsign variables. This vulnerability allows attackers to manipulate the S...

PT-2024-36385

Name of the Vulnerable Software and Affected Versions: watchOS versions prior to 11.2 visionOS versions prior to 2.2 tvOS versions prior to 18.2 macOS Sequoia versions prior to 15.2 Safari versions prior to 18.2 iOS versions prior to 18.2 iPadOS versions prior to 18.2 Description: Processing...

PT-2024-6805

Name of the Vulnerable Software and Affected Versions DOMPurify versions prior to 2.5.0 DOMPurify versions prior to 3.1.3 Description The issue is related to insufficient input validation in the DOMPurify JavaScript library, which can lead to a cross-site scripting XSS attack. This vulnerability...

PT-2024-39890 · 07Flycms +1 · 07Flycms +1

Name of the Vulnerable Software and Affected Versions: 07FLYCMS version 1.3.8 07FLY-CMS version 1.3.8 07FlyCRM version 1.3.8 Description: A critical issue was found in the uploadFile function of the Module Plug-In Handler component, located in the file...

PT-2024-10152 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions 15.2 through 17.4.6 GitLab versions 17.5 through 17.5.4 GitLab versions 17.6 through 17.6.2 Description: The issue is related to a problem in GitLab that allows for a Cross-Site Request Forgery CSRF attack. This can be exploit...

PT-2024-31947 · Unknown · Modsecurity

Name of the Vulnerable Software and Affected Versions: ModSecurity versions 3.0.12 and earlier Description: A buffer overflow in ModSecurity allows attackers to cause a Denial of Service DoS via a crafted input inserted into the name parameter. The issue is disputed by the supplier as it cannot b...

Microsoft Releases October 2024 Security Updates

Microsoft released security updates to address vulnerabilities in multiple products. A cyber threat actor could exploit some of these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review the following and apply necessary updates: Microsoft...

Schneider Electric EcoStruxure Power Monitoring Expert (PME) (Update B)

GENERAL SECURITY RECOMMENDATIONS We strongly recommend the following industry cybersecurity best practices. https://www.se.com/us/en/download/document/7EN52-0390/ Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network. Install...

PT-2024-7146

Name of the Vulnerable Software and Affected Versions .NET versions prior to 8.0.9 .NET versions prior to 6.0.34 .NET Framework affected versions not specified Visual Studio affected versions not specified Description The issue is related to algorithmic complexity in the .NET platform, .NET...

PT-2024-31842 · Bluecms · Bluecms

Name of the Vulnerable Software and Affected Versions: BlueCMS version 1.6 Description: The issue allows for Arbitrary File Deletion through the file name parameter in an "/admin/database.php?act=del" request. This flaw can be exploited to delete files arbitrarily. Recommendations: For BlueCMS...

PT-2024-39682 · Unknown · Esafenet Cdg

Name of the Vulnerable Software and Affected Versions: ESAFENET CDG V5 Description: A critical issue affects an unknown functionality of the file /MultiServerBackService?path=1. The manipulation of the fileId argument leads to SQL injection. The attack may be launched remotely. The exploit has be...

PT-2024-29430 · Cadclick · Cadclick

Name of the Vulnerable Software and Affected Versions: CADClick versions 1.11.0 and earlier Description: A SQL Injection issue in "ccHandler.aspx" allows remote attackers to execute arbitrary SQL commands via the bomid parameter. This enables attackers to potentially access or manipulate sensitiv...

PT-2024-7508 · Mitel · Mitel Micollab

Name of the Vulnerable Software and Affected Versions: Mitel MiCollab versions prior to 9.8 SP1 FP2 9.8.1.201 Description: A vulnerability in the AWV Conferencing component could allow an unauthenticated attacker to perform unauthorized data-access attacks due to missing authentication mechanisms...

PT-2024-31897

Name of the Vulnerable Software and Affected Versions: itsourcecode Sports Management System Project version 1.0 Description: The issue is related to a SQL Injection vulnerability in the delete category function of the sports scheduling/player.php file, which can be exploited via the id argument...

PT-2024-7108 · Jenkins +1 · Jenkins +1

Name of the Vulnerable Software and Affected Versions: Jenkins versions 2.478 and earlier Jenkins LTS versions 2.462.2 and earlier Description: The issue is related to the lack of protection for sensitive data in Jenkins. Specifically, Jenkins does not redact multi-line secret values in error...

PT-2024-7431 · Draytek · Draytek Vigor 3910

Name of the Vulnerable Software and Affected Versions: DrayTek Vigor3910 versions through 4.3.2.6 Description: The issue is related to a buffer overflow vulnerability in the /cgi-bin/v2x00.cgi and /cgi-bin/cgiwcg.cgi CGI endpoints of the DrayTek Vigor3910 devices' web interface. This vulnerabilit...

PT-2024-21075 · Infinera · Infinera Tnms

Name of the Vulnerable Software and Affected Versions: Infinera TNMS Transcend Network Management System version 19.10.3 Description: The issue is related to an insecure default configuration of the internal SFTP server on Linux servers, which allows a remote attacker to access files and...