Access Control Bypass

Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to Access Control Bypass due to improper access control mechanisms. A low-privileged attacker can bypass security measures and impact confidentiality without requiring user...

CVE-2024-45720 Apache Subversion: Command line argument injection on Windows platforms

On Windows platforms, a "best fit" character encoding conversion of command line arguments to Subversion's executables e.g., svn.exe, etc. may lead to unexpected command line argument interpretation, including argument injection and execution of other programs, if a specially crafted command line...

PT-2025-2097 · Drupal · Drupal

Name of the Vulnerable Software and Affected Versions: Drupal Block permissions versions 1.0.0 through 1.2.0 Description: The issue is related to an incorrect authorization mechanism in the Block permissions module of the Drupal CMS system. This can allow a remote attacker to impact the...

PT-2024-31: Reflected Cross-Site Scripting (Reflected XSS) in Passwork

The vulnerability was identified in Passwork version 6.4.0. The application does not process the data received from the user, which is necessary for safety use during web page formation. An attacker can inject a malicious script into the request parameters and conduct social engineering attack on...

PT-2024-32: Stored Cross-Site Scripting (Stored XSS) in Passwork

The vulnerability was identified in Passwork version 6.4.0. The application does not process the data received from the user, which is necessary for safety use during web page formation. Discovered vulnerability allows an attacker to execute arbitrary JavaScript code in victim's browser...

PT-2024-34: Server Side Request Forgery (SSRF) in Passwork

The vulnerability was identified in Passwork version 6.4.0. The discovered vulnerability can be exploited by an attacker to send requests to both external nodes and servers with limited access, which leads to disclosure of sentisive data, denial of service, etc. Also, exploitation of the...

PT-2024-29: Path Traversal in Passwork

The vulnerability was identified in Passwork version 6.4.0. The discovered vulnerability can be exploited by an attacker to gain access to local files and directories on the server, which are not avaliable by the logic of the application. Vulnerability status: Confirmed by vendor Date of...

PT-2024-38619 · Progress · Telerik Reporting

Name of the Vulnerable Software and Affected Versions: In Progress Telerik Reporting versions prior to 2024 Q3 18.2.24.924 Description: A command injection attack is possible through improper neutralization of hyperlink elements. This issue arises due to the improper handling of hyperlink element...

Vulnerabilities fixed in Microsoft Office

Microsoft has fixed vulnerabilities in Office components. A malicious person could exploit the vulnerabilities to execute arbitrary code with the victim's privileges, potentially gaining access to sensitive data in the victim's context. Successful exploitation requires the malicious party to tric...

PT-2024-39001 · Schneider Electric · Zelio Soft 2

Name of the Vulnerable Software and Affected Versions: Zelio Soft 2 versions prior to 5.4.2.2 Description: A Use After Free vulnerability exists that could cause arbitrary code execution, denial of service, and loss of confidentiality and integrity when an application user opens a malicious Zelio...

Intel® TDX Module Software Advisory

Summary: A potential security vulnerability in Intel® Trust Domain Extensions TDX Module firmware may allow information disclosure. Intel is releasing firmware updates to mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2024-27457 Description: Improper check for unusual or...

PT-2025-11523 · Dell · Os10

Name of the Vulnerable Software and Affected Versions: Dell SmartFabric OS10 Software versions 10.5.4.x through 10.6.0.x Description: The issue is related to an Improper Neutralization of Special Elements used in a Command, also known as 'Command Injection'. This could allow a high privileged...

PT-2024-7354

The Ivanti Cloud Services Appliance CSA is affected by an OS command injection issue in its admin web console, prior to version 5.0.2. This allows a remote authenticated attacker with admin privileges to obtain remote code execution. The vulnerable versions are all Ivanti CSA versions before 5.0....

PT-2024-10440 · Ibm · Ibm Security Verify Governance

Name of the Vulnerable Software and Affected Versions: IBM Security Verify Governance 10.0.2 Identity Manager Description: The issue is related to the transmission of user credentials in clear text by the Identity Manager component, which could be obtained by an attacker using man-in-the-middle...

PT-2024-7759 · Cacti · Cacti

Name of the Vulnerable Software and Affected Versions: Cacti versions prior to 1.2.28 Description: The issue arises from the improper sanitization of the consolenewsection parameter when saving external links in links.php, which is then stored in the database and reflected back to the user in...

PT-2024-32556 · WordPress · Wp-Downloadmanager

Name of the Vulnerable Software and Affected Versions: WP-DownloadManager versions 1.68.8 and earlier Description: The issue is related to an Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This problem allows Reflected XSS. Recommendations: Fo...

PT-2024-30893 · Unknown · Temegum Gum Elementor Addon

Name of the Vulnerable Software and Affected Versions: TemeGUM Gum Elementor Addon versions 1.3.6 and earlier Description: The issue affects TemeGUM Gum Elementor Addon, allowing Stored XSS due to improper neutralization of input during web page generation. This is a Cross-site Scripting...

PT-2024-30895 · Viala · Viala

Name of the Vulnerable Software and Affected Versions: viala versions 1.3.1 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Reflected XSS attacks. Recommendations: For versions...

PT-2024-30899 · Elementor · Nicheaddons Restaurant & Cafe Addon For Elementor

Name of the Vulnerable Software and Affected Versions: NicheAddons Restaurant & Cafe Addon for Elementor versions 1.5.5 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS,...

PT-2024-32588 · Unknown · Paul Bearne Author Avatars List/Block

Name of the Vulnerable Software and Affected Versions: Paul Bearne Author Avatars List/Block versions 2.1.21 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS, which allows Stored XSS. This means an...