PT-2024-19196 · Elspec · Elspec G5 Digital Fault Recorder

Name of the Vulnerable Software and Affected Versions: Elspec G5 digital fault recorder versions 1.1.4.15 and before Description: An issue was discovered in the Elspec G5 digital fault recorder where the shadow file is world readable. Recommendations: For Elspec G5 digital fault recorder versions...

PT-2024-19193 · Elspec · Elspec G5 Digital Fault Recorder

Name of the Vulnerable Software and Affected Versions: Elspec G5 digital fault recorder versions 1.1.4.15 and before Description: An issue was discovered that allows unauthenticated directory listing to occur. The web interface can be abused by an attacker to gain a better understanding of the...

PT-2024-22478 · Freeimage +1 · Freeimage +1

Name of the Vulnerable Software and Affected Versions: FreeImage version 3.19.0 Description: The issue allows a local attacker to cause a denial of service DoS via the opj j2k read mct function when reading images in J2K format. Recommendations: For FreeImage version 3.19.0, consider disabling th...

PT-2024-19187 · Elspec · Elspec G5 Digital Fault Recorder

Name of the Vulnerable Software and Affected Versions: Elspec G5 digital fault recorder versions 1.1.4.15 and before Description: The issue concerns weak permissions of the SQLite database file. Recommendations: For Elspec G5 digital fault recorder versions 1.1.4.15 and before, consider restricti...

PT-2024-21475 · Unknown · Campcodes Online Job Finder System

Name of the Vulnerable Software and Affected Versions: Campcodes Online Job Finder System version 1.0 Description: A critical issue has been found in the system. The problem lies in an unknown function of the file /admin/vacancy/index.php, where manipulation of the id argument leads to SQL...

PT-2024-22723 · Ninja Team · Ninjateam Database For Contact Form 7

Name of the Vulnerable Software and Affected Versions: NinjaTeam Database for Contact Form 7 versions 3.0.6 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for Stored XSS. This means that an attacker can inject malicious...

PT-2024-21390 · Netentsec · Netentsec Ns-Asg Application Security Gateway

Name of the Vulnerable Software and Affected Versions: Netentsec NS-ASG Application Security Gateway version 6.3 Description: A critical issue has been found in the processing of the file "/admin/singlelogin.php". The manipulation of the loginId argument leads to SQL injection. The attack may be...

PT-2024-21353 · Meta4 · Meta4 Hr

Name of the Vulnerable Software and Affected Versions: Meta4 HR versions 819.001.022 and earlier Description: A Cross-Site Scripting issue has been identified. The endpoint "/sitetest/english/dumpenv.jsp" is vulnerable to an XSS attack via the lang query. For example, the URL...

VulnCheck KEV: CVE-2024-29138

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Joachim Jensen Restrict User Access – Membership Plugin with Force restrict-user-access.This issue affects Restrict User Access – Membership Plugin with Force: from n/a through = 2.5...

PT-2024-15328 · Axis Communications · Axis Os

Name of the Vulnerable Software and Affected Versions: AXIS OS versions prior to the patched version Description: The VAPIX APIs, specifically the "mediaclip.cgi" and "playclip.cgi" endpoints, were found to be vulnerable to file globbing, which could lead to a resource exhaustion attack. This iss...

PT-2024-22440 · Shenzhen Libituo Technology Co. · Lbt-T300-Mini1

Name of the Vulnerable Software and Affected Versions: Shenzhen Libituo Technology Co., Ltd LBT-T300-mini1 version 1.2.9 Description: A buffer overflow issue was discovered via the lan ipaddr parameters at the "/apply.cgi" API endpoint. Recommendations: For version 1.2.9, consider restricting...

CVE-2024-27085 Denial of service through invites in Discourse

Discourse is an open source platform for community discussion. In affected versions users that are allowed to invite others can inject arbitrarily large data in parameters used in the invite route. The problem has been patched in the latest version of Discourse. Users are advised to upgrade. User...

PT-2024-22389 · Gpac +2 · Gpac +2

Name of the Vulnerable Software and Affected Versions: gpac version 2.3-DEV-rev921-g422b78ecf-master Description: The issue is related to an out of boundary read vulnerability via the gf dash setup period function in the media tools/dash client.c file at line 6374. This vulnerability can allow a...

PT-2024-13998 · Sirv · Sirv

Name of the Vulnerable Software and Affected Versions: Sirv versions through 7.1.2 Description: The issue is related to a Missing Authorization vulnerability in Sirv. This vulnerability affects Sirv from version n/a through 7.1.2. Recommendations: For versions through 7.1.2, update to a version...

PT-2024-20301 · Gnuboard · Gnuboard

Name of the Vulnerable Software and Affected Versions: Gnuboard g6 versions before Github commit 58c737a263ac0c523592fd87ff71b9e3c07d7cf5 Description: A Cross Site Scripting XSS issue allows remote attackers to execute arbitrary code via the wr content parameter. This enables attackers to inject...

PT-2024-20586 · Unknown · Surya2Developer Hostel Management Service

Name of the Vulnerable Software and Affected Versions: Surya2Developer Hostel Management Service version 1.0 Description: A vulnerability has been found in the HTTP POST Request Handler component, specifically in the file /check availability.php. The manipulation of the oldpassword argument leads...

PT-2024-22428 · Greykite · Greykite

Name of the Vulnerable Software and Affected Versions: greykite version 1.0.0 Description: The issue allows attackers to execute arbitrary code via uploading a crafted file, exploiting an arbitrary file upload vulnerability in the load obj function at /templates/pickle utils.py. Recommendations:...

PT-2024-20561 · Mha Sistemas · Mha Sistemas Armhazena

Name of the Vulnerable Software and Affected Versions: MHA Sistemas arMHAzena version 9.6.0.0 Description: A problematic vulnerability has been found in the Cadastro Page component, allowing for cross-site scripting through the manipulation of the Query argument. This issue can be exploited...

PT-2024-15834

Name of the Vulnerable Software and Affected Versions Arcserve Unified Data Protection versions 8.1 through 9.2 Description A denial of service issue exists in the ASNative.dll component. Recommendations For versions 8.1 through 9.2, consider restricting access to the ASNative.dll component to...

PT-2024-22522 · Dedecms · Dedecms

Name of the Vulnerable Software and Affected Versions: DedeCMS version 5.7 Description: A Cross-Site Request Forgery CSRF issue was found in DedeCMS. The vulnerability can be exploited via the "/dede/diy add.php" API endpoint. Recommendations: For DedeCMS version 5.7, update to a version that...