PT-2024-21421 · Codiad · Codiad

Name of the Vulnerable Software and Affected Versions: Codiad version 2.8.4 Description: The issue allows reflected XSS via the type parameter in the "components/market/dialog.php" endpoint. This can lead to remote execution. There is no information about the estimated number of potentially...

PT-2024-20867

Name of the Vulnerable Software and Affected Versions REBUILD version 3.5 Description The issue allows a remote attacker to obtain sensitive information and execute arbitrary code. This is achieved via the FileDownloader.java and the proxyDownload and URL parameters. Recommendations For REBUILD...

PT-2024-21653 · Frappe · Frappe

Name of the Vulnerable Software and Affected Versions: Frappe versions prior to 14.66.3 Frappe versions prior to 15.16.0 Description: Frappe is a full-stack web application framework. The issue allows file permission to be bypassed using certain endpoints, granting less privileged users permissio...

PT-2025-18295 · Xwiki · Xwiki

Name of the Vulnerable Software and Affected Versions: XWiki versions 15.9-rc-1 through 15.10.8 XWiki versions 16.0.0-rc-1 through 16.2.0 Description: XWiki is a generic wiki platform. The required rights analysis does not consider TextAreas with default content type, allowing a user to put...

Implementations of UDP-based application protocols are vulnerable to network loops

Overview A novel traffic-loop vulnerability has been identified against certain implementations of UDP-based applications protocols. An unauthenticated attacker can use maliciously-crafted packets against a UDP-based vulnerable implementation of application protocols e.g., DNS, NTP, TFTP that can...

PT-2024-2427

Name of the Vulnerable Software and Affected Versions Moby versions prior to 23.0.11 Moby versions prior to 25.0.4 Moby versions prior to 26.0.0 Description The issue is related to the networking implementation in Moby, which allows for the creation of custom networks with their own IP address...

PT-2024-15871 · WordPress · Innovs Hr Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Innovs HR WordPress plugin versions 1.0.3.4 and earlier Description: The issue concerns a lack of CSRF checks in some places within the Innovs HR WordPress plugin, which could allow attackers to make logged-in users perform unwanted actions v...

PT-2024-5776

Name of the Vulnerable Software and Affected Versions Apache ZooKeeper versions prior to 3.9.2 Apache ZooKeeper versions prior to 3.8.4 Description The issue is related to information disclosure in persistent watchers handling in Apache ZooKeeper due to missing ACL check. It allows an attacker to...

PT-2024-21068 · Delinea · Delinea Pam Secret Server

Name of the Vulnerable Software and Affected Versions: Delinea PAM Secret Server version 11.4 Description: The issue allows a user with access to the Report functionality to gain unauthorized access to remote sessions created by legitimate users. Recommendations: For Delinea PAM Secret Server...

PT-2024-13382 · Epmm · Epmm

Name of the Vulnerable Software and Affected Versions: EPMM versions prior to 12.1.0.0 Description: An SQL Injection issue in a web component of EPMM allows an authenticated user with appropriate privilege to access or modify data in the underlying database. Recommendations: For versions prior to...

CPU hardware utilizing speculative execution may be vulnerable to speculative race conditions

Overview A Speculative Race Condition SRC vulnerability that impacts modern CPU architectures supporting speculative execution has been discovered. CPU hardware utilizing speculative execution that are vulnerable to Spectre v1 are likely affected. An unauthenticated attacker can exploit this...

PT-2024-2438 · Apache +3 · Apache Commons Configuration +3

Name of the Vulnerable Software and Affected Versions: Apache Commons Configuration versions 2.0 through 2.10.0 Atlassian Confluence Data Center versions 7.17.0 through 8.9.0 Atlassian Confluence Server versions 7.17.0 through 8.5.8 Description: The issue is related to an out-of-bounds write...

PT-2024-2562 · Argo Cd · Argo Cd

Name of the Vulnerable Software and Affected Versions: Argo CD versions 1.2.0-rc1 through 2.10.2 Argo CD versions 1.2.0-rc1 through 2.9.7 Argo CD versions 1.2.0-rc1 through 2.8.11 Description: The issue is related to improper validation in Argo CD, a declarative, GitOps continuous delivery tool f...

PT-2024-12941 · Unknown · Student Enrollment In Php

Name of the Vulnerable Software and Affected Versions: Student Enrollment in PHP version 1.0 Description: The issue allows attackers to execute arbitrary code through the Student Search function, which is vulnerable to SQL injection. This enables attackers to run malicious code, potentially leadi...

PT-2024-12942 · Unknown · Student Enrollment In Php

Name of the Vulnerable Software and Affected Versions: Student Enrollment In PHP version 1.0 Description: The issue is related to an arbitrary file upload vulnerability in the Add Student's Profile Picture function. This vulnerability allows attackers to execute arbitrary code by uploading a...

PT-2024-10423 · Dcmtk +4 · Dcmtk +4

Name of the Vulnerable Software and Affected Versions: DCMTK versions prior to 3.6.9 Description: The issue is related to a segmentation fault in the dcmdata component of the DCMTK library, which can be triggered by an invalid DIMSE message. This can potentially allow a remote attacker to cause a...

ROS-2-1926

2.1926 Denial of Service in Libxml2 CVE-2021-3541 1. Vulnerability Description: The vulnerability allows a remote attacker to perform a denial of service DoS attack. The vulnerability exists due to insufficient validation of user input. A remote attacker can pass specially crafted input data to a...

PT-2024-2557 · Vinchin · Vinchin Backup & Recovery

Name of the Vulnerable Software and Affected Versions: Vinchin Backup and Recovery versions 7.2 and earlier Description: The issue is related to the getVerifydiyResult function, which is vulnerable to Authenticated Remote Code Execution RCE. This vulnerability can be exploited by a remote attacke...

CVE-2024-28098 Apache Pulsar: Improper Authorization For Topic-Level Policy Management

The vulnerability allows authenticated users with only produce or consume permissions to modify topic-level policies, such as retention, TTL, and offloading settings. These management operations should be restricted to users with the tenant admin role or super user role. This issue affects Apache...

Microsoft Releases Security Updates for Multiple Products

Microsoft has released security updates to address vulnerabilities in multiple products. A cyber threat actor could exploit some of these vulnerabilities to take control of an affected system. CISA encourages users and administrators to review the following and apply the necessary updates:...