CTEM 101 - Go Beyond Vulnerability Management with Continuous Threat Exposure Management

In a world of ever-expanding jargon, adding another FLA Four-Letter Acronym to your glossary might seem like the last thing you'd want to do. But if you are looking for ways to continuously reduce risk across your environment while making significant and consistent improvements to security postur...

PT-2024-2247

Name of the Vulnerable Software and Affected Versions: Microsoft Windows versions prior to March 2024 Patch Tuesday Windows Server 2019 10.0.17763.2300 Description: A vulnerability exists in the Windows Error Reporting Service that allows attackers to gain SYSTEM-level privileges. The...

PT-2024-19066 · Unknown · Skysea Client View

Name of the Vulnerable Software and Affected Versions: SKYSEA Client View versions from Ver.16.100 prior to Ver.19.2 Description: An improper access control vulnerability exists in a specific folder of the software. This vulnerability can be exploited by a user who can log in to the PC where the...

PT-2024-4332 · Unknown · Daily Expenses Management System

Name of the Vulnerable Software and Affected Versions: Daily Expenses Management System version 1.0 Description: The Daily Expenses Management System contains a time-based blind SQL injection vulnerability in the 'add-expense.php' page. An attacker can exploit the item parameter in a POST request...

PT-2024-2614 · Apache · Apache Pulsar

Name of the Vulnerable Software and Affected Versions: Apache Pulsar versions 2.7.1 through 2.10.5 Apache Pulsar versions 2.11.0 through 2.11.3 Apache Pulsar versions 3.0.0 through 3.0.2 Apache Pulsar versions 3.1.0 through 3.1.2 Apache Pulsar version 3.2.0 Description: The issue is related to...

PT-2024-2476 · Moodle · Moodle

Name of the Vulnerable Software and Affected Versions: Moodle version 3.10.9 Description: A Cross-Site Scripting XSS issue exists due to inadequate protection of the webpage structure when handling the lang parameter in the "/?lang=" URL parameter. This could allow a remote attacker to read,...

PT-2024-2416 · Parisneo +1 · Lollms-Webui +1

Name of the Vulnerable Software and Affected Versions: parisneo/lollms-webui version v9.8 Description: The issue is related to the missing client id parameter in lollms binding infos, leading to security vulnerabilities. Specifically, the endpoints "/reload binding", "/install binding", "/reinsta...

Fedora: Security Advisory for xalan-j2 (FEDORA-2024-129d8ca6fc)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Apple Releases Security Updates for iOS and iPadOS

Apple released security updates to address vulnerabilities in iOS and iPadOS. A cyber threat actor could exploit one of these vulnerabilities to obtain sensitive information. CISA encourages users and administrators to review the following security releases and apply the necessary updates: iOS 17...

PT-2024-20249 · Setor Informatica · Setor Informatica Sil

Name of the Vulnerable Software and Affected Versions: Setor Informatica SIL version 3.1 Description: A Cross Site Scripting XSS issue allows attackers to run arbitrary code via the hmessage parameter. This enables attackers to execute malicious scripts on the affected system. Recommendations: Fo...

PT-2024-2135 · Cisco · Cisco Small Business 500 Series Wireless Access Points +2

Name of the Vulnerable Software and Affected Versions: Cisco Small Business 100, 300, and 500 Series Wireless Access Points affected versions not specified Description: The issue exists due to insufficient validation of user-supplied input in the web-based management interface, allowing an...

PT-2024-21948

Name of the Vulnerable Software and Affected Versions ChatGPT versions affected versions not specified Description A server-side request forgery SSRF vulnerability exists in the pictureproxy.php file of ChatGPT, specifically within commit f9f4bbc. This flaw allows attackers to force the applicati...

PT-2024-3887

Name of the Vulnerable Software and Affected Versions Django versions 3.2 through 3.2.24 Django versions 4.2 through 4.2.10 Django versions 5.0 through 5.0.2 Description The issue is related to a potential regular expression denial-of-service in the django.utils.text.Truncator.words method. This...

PT-2024-10425 · FFmpeg +5 · Ffmpeg +5

Name of the Vulnerable Software and Affected Versions: FFmpeg version n6.1.1 Description: The issue is related to a heap use-after-free in the av hwframe ctx init function. This could allow a remote attacker to impact data integrity. Recommendations: For FFmpeg version n6.1.1, consider disabling...

ASB-A-314790498

Bulletin has no description...

PT-2024-2301 · Linksys · Linksys E2000

Name of the Vulnerable Software and Affected Versions: Linksys E2000 version Ver.1.0.06 build 1 Description: The issue is related to a flaw in the authentication procedure of the Linksys E2000 router, which can be exploited to bypass authentication and gain full access to the device. This can...

PT-2024-20652 · Dell · Dell Secure Connect Gateway (Scg) Policy Manager

Name of the Vulnerable Software and Affected Versions: Dell Secure Connect Gateway SCG Policy Manager, all versions Description: The issue is related to an improper authorization vulnerability. An attacker with low privileges on an adjacent network could potentially exploit this, leading to...

PT-2024-18627 · Zhicms · Zhicms

Name of the Vulnerable Software and Affected Versions: ZhiCms version 4.0 Description: A critical issue has been found in ZhiCms, affecting the getindexdata function of the file app/index/controller/mcontroller.php. The manipulation of the key argument leads to SQL injection. The attack may be...

PT-2024-18626 · Panabit · Panabit Panalog

Name of the Vulnerable Software and Affected Versions: Panabit Panalog version 202103080942 Description: A critical vulnerability was found in Panabit Panalog, affecting unknown code of the file /Maintain/sprog upstatus.php. The manipulation of the id argument leads to SQL injection. The attack c...

PT-2024-20275 · Unknown · Crmeb Java

Name of the Vulnerable Software and Affected Versions: crmeb java versions prior to 1.3.4 Description: The issue allows attackers to execute arbitrary SQL commands by sending a crafted GET request to the "api/front/spread/people" endpoint. This enables attackers to manipulate the database,...