PT-2024-28817

Name of the Vulnerable Software and Affected Versions Bazaar versions prior to 1.4.3 Description An issue in the component /api/swaggerui/static of Bazaar allows unauthenticated attackers to execute a directory traversal. Recommendations For versions prior to 1.4.3, update to version 1.4.3 or lat...

PT-2024-37946 · Unknown · Sourcecodester Record Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Record Management System version 1.0 Description: A critical issue has been found in the SourceCodester Record Management System, affecting the file view info user.php. The manipulation of the id argument leads to SQL injection...

PT-2024-28620 · WordPress · Cooked

Name of the Vulnerable Software and Affected Versions: Cooked plugin for WordPress versions up to, and including, 1.7.15.4 Description: The issue is related to Cross-Site Request Forgery CSRF due to missing or incorrect nonce validation on the AJAX action handler. This could allow an attacker to...

PT-2024-5158 · Ivanti · Ivanti Endpoint Manager Mobile

Name of the Vulnerable Software and Affected Versions: Ivanti Endpoint Manager Mobile EPMM versions prior to 12.1.0.1 Description: The issue is related to an insufficient authorization vulnerability in the web component of EPMM. This vulnerability allows an unauthorized attacker within the networ...

PT-2024-26439 · Tenda · Tenda I29

Name of the Vulnerable Software and Affected Versions: Tenda i29V1.0 version 1.0.0.5 Description: The issue is related to a hardcoded password for the root user. This means that the password is embedded directly into the software, potentially allowing unauthorized access. Recommendations: For Ten...

PT-2024-28340 · Seacms · Seacms

Name of the Vulnerable Software and Affected Versions: SeaCMS version 12.9 Description: The issue concerns an Arbitrary File Read vulnerability. It is exploited via the admin safe.php file. Recommendations: For SeaCMS version 12.9, consider restricting access to the admin safe.php file until a...

PT-2024-5582 · Manageengine · Zoho Manageengine Exchange Reporter Plus

Name of the Vulnerable Software and Affected Versions: ManageEngine Exchange Reporter Plus versions 5717 and below Description: The issue is related to the lack of protection against SQL query structure attacks in the reports module of ManageEngine Exchange Reporter Plus. This can allow a remote...

PT-2024-5141 · Ibm · Ibm Sterling Partner Engagement Manager

Name of the Vulnerable Software and Affected Versions: IBM Sterling Partner Engagement Manager version 6.2.2 Description: The issue is related to the mechanism of forming error reports in IBM Sterling Partner Engagement Manager, which could allow a local attacker to obtain sensitive information...

PT-2024-5575 · Pimcore · Pimcore Admin Classic Bundle

Name of the Vulnerable Software and Affected Versions: Pimcore Admin Classic Bundle versions prior to 1.3.10 Pimcore Admin Classic Bundle versions prior to 1.4.6 Pimcore Admin Classic Bundle versions prior to 1.5.2 Description: Navigating to "/admin/index/statistics" with a logged in Pimcore user...

PT-2024-5174 · Unknown · Tailoring Management System

Name of the Vulnerable Software and Affected Versions: Tailoring Management System version 1.0 Description: A critical issue has been identified in the Tailoring Management System, affecting the setgeneral.php file. This issue is related to the lack of protection against SQL query structure...

PT-2024-28908 · Publiccms · Publiccms

Name of the Vulnerable Software and Affected Versions: PublicCMS version 4.0.202302.e Description: The issue is related to a Server-Side Request Forgery SSRF that can be exploited via the component /admin/ueditor?action=catchimage. This allows an attacker to forge requests from the server...

PT-2024-5324 · Ibm · Ibm Datacap Navigator

Name of the Vulnerable Software and Affected Versions: IBM Datacap Navigator versions 9.1.5 through 9.1.9 Description: The issue is related to the storage of critical information in plain clear text, which can be accessed by a local user. This could allow an attacker to gain unauthorized access t...

PT-2024-28784 · Unknown · Sourcecodester Poultry Farm Management System

Name of the Vulnerable Software and Affected Versions: Sourcecodester Poultry Farm Management System version 1.0 Description: The issue is related to an Unauthenticated Remote Code Execution RCE vulnerability. This vulnerability can be exploited via the productimage parameter at the...

PT-2024-7862 · Microsoft · Windows Dwm Core Library +3

Name of the Vulnerable Software and Affected Versions: Windows DWM Core Library versions prior to the fixed version Description: The issue is related to an elevation of privilege vulnerability in the Windows DWM Core Library, which can be exploited to allow an attacker to gain system-level...

PT-2024-37773 · Zmops · Argusdbm

Name of the Vulnerable Software and Affected Versions: zmops ArgusDBM version 0.1.0 Description: A critical issue was found in the getDefaultClassLoader function of the CalculateAlarm.java file, part of the AviatorScript Handler component. This issue leads to deserialization and can be exploited...

PT-2024-7171 · Unknown · Soplanning

Name of the Vulnerable Software and Affected Versions: SOPlanning versions prior to 1.45 Description: A Cross-Site Scripting XSS issue exists due to the lack of proper validation of user input via the /soplanning/www/process/xajax server.php endpoint, affecting multiple parameters. This could all...

PT-2024-4729 · Webmin +1 · Webmin +1

Name of the Vulnerable Software and Affected Versions: Webmin versions prior to 2.003 Description: The issue is related to improper handling of insufficient permissions or privileges in the ajaxterm module of Webmin. This could allow an unauthorized user to hijack a console session, potentially...

PT-2024-15190 · WordPress · Advanced File Manager Shortcodes

Name of the Vulnerable Software and Affected Versions: Advanced File Manager Shortcodes plugin for WordPress versions up to, and including, 2.5.3 Description: The issue allows authenticated attackers with contributor access or above to upload arbitrary files on the affected site's server, which m...

PT-2024-12344 · Easyappointments +1 · Alextselegidis/Easyappointments +1

Name of the Vulnerable Software and Affected Versions: Software affected versions not specified Description: A BOLA vulnerability in the "POST /appointments" endpoint allows a low-privileged user to create an appointment for any user in the system, including administrators. This results in...

PT-2024-5735 · Webmin +1 · Webmin +1

Name of the Vulnerable Software and Affected Versions: Webmin versions prior to 2.003 Description: A cross-site request forgery vulnerability exists in the ajaxterm module. If exploited, unintended operations may be performed when a user views a malicious page while logged in, potentially allowin...