PT-2024-20969 · Ruvaroa · Ruvaroa

Name of the Vulnerable Software and Affected Versions: RuvarOA versions 6.01 through 12.01 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the email attach id parameter at the "/LHMail/AttachDown.aspx" API endpoint. Recommendations: For...

PT-2024-31849 · Dedecms · Dedecms

Name of the Vulnerable Software and Affected Versions: DedeCMS version 5.7 Description: A problematic issue has been found in DedeCMS, affecting the processing of the file /src/dede/sys multiserv.php. This leads to cross-site request forgery, which can be initiated remotely. The exploit has been...

PT-2024-31821 · Dedecms · Dedecms

Name of the Vulnerable Software and Affected Versions: DedeCMS version 5.7 Description: A issue was found in the processing of the file /src/dede/tpl.php, which can lead to cross-site request forgery. The attack may be initiated remotely. Recommendations: For DedeCMS version 5.7, consider...

PT-2024-20976 · Ruvaroa · Ruvaroa

Name of the Vulnerable Software and Affected Versions: RuvarOA versions 6.01 through 12.01 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the template id parameter at the "/SysManage/wf template child field list.aspx" API endpoint...

PT-2024-25477 · Mp-Spdz · Mp-Spdz

Name of the Vulnerable Software and Affected Versions: MP-SPDZ version 0.3.8 Description: A stack overflow was discovered in the function OTExtensionWithMatrix::extend in /OT/OTExtensionWithMatrix.cpp. This issue allows attackers to cause a Denial of Service DoS via a crafted message...

PT-2024-31839 · Dedecms · Dedecms

Name of the Vulnerable Software and Affected Versions: DedeCMS version 5.7 Description: A vulnerability was found in DedeCMS, affecting an unknown functionality of the file /src/dede/mytag edit.php. This issue leads to cross-site request forgery and can be launched remotely. Recommendations: For...

PT-2024-25131 · J2Eefast · J2Eefast

Name of the Vulnerable Software and Affected Versions: J2EEFAST version 2.7.0 Description: A SQL injection issue was discovered via the sql filter parameter in the authRoleList function. This allows for potential exploitation. No information is provided about the estimated number of affected...

PT-2024-25136 · J2Eefast · J2Eefast

Name of the Vulnerable Software and Affected Versions: J2EEFAST version 2.7.0 Description: The issue is related to a SQL injection vulnerability. It occurs via the sql filter parameter in the getDeptList function. This allows for potential exploitation. Recommendations: For J2EEFAST version 2.7.0...

PT-2024-25945 · Syracuse · Avantra Server

Name of the Vulnerable Software and Affected Versions: Avantra Server versions 24.0.0 through 24.0.6 Avantra Server versions 24.1.0 through 24.1.0 Description: The issue concerns the mishandling of dashboard security. If a user can create a dashboard with an auto-login user, data disclosure may...

PT-2024-25920 · Unknown · Rukovoditel

Name of the Vulnerable Software and Affected Versions: Rukovoditel versions prior to 3.5.3 Description: The issue allows for XSS via the user photo parameter to My Page. This can potentially lead to malicious script execution. Recommendations: For versions prior to 3.5.3, update to version 3.5.3 ...

PT-2024-3701 · Glpi +2 · Glpi +2

Name of the Vulnerable Software and Affected Versions: GLPI versions prior to 10.0.15 Description: The issue concerns a SQL injection vulnerability that can be exploited by an authenticated user through the map search function. This vulnerability allows a remote attacker to disclose protected...

PT-2024-21430 · WordPress · Barcode Scanner/Inventory Manager

Name of the Vulnerable Software and Affected Versions: The Barcode Scanner and Inventory manager. POS Point of Sale – scan barcodes & create orders with barcode reader. plugin for WordPress versions up to, and including, 1.5.4 Description: The issue is related to blind SQL Injection via the...

PT-2024-22940 · WordPress · Svs Pricing Tables

Name of the Vulnerable Software and Affected Versions: SVS Pricing Tables plugin for WordPress versions up to, and including, 1.0.4 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the savePricingTable function. This allows...

PT-2024-18481 · WordPress · Icon Widget

Name of the Vulnerable Software and Affected Versions: Icon Widget plugin for WordPress versions up to, and including, 1.3.0 Description: The issue is related to Stored Cross-Site Scripting via the plugin's shortcodes due to insufficient input sanitization and output escaping on user-supplied...

PT-2024-3206 · Mitel · Mitel 6900 Series +2

Name of the Vulnerable Software and Affected Versions: Mitel 6800 Series and 6900 Series SIP Phones versions through 6.3 SP3 HF4 Mitel 6900w Series SIP Phone versions through 6.3.3 Mitel 6970 Conference Unit versions through 5.1.1 SP8 Description: A buffer overflow attack can be conducted by an...

PT-2024-25229

Name of the Vulnerable Software and Affected Versions kubevirt versions 1.2.0 and earlier Description The issue allows a local attacker to execute arbitrary code via a crafted command to get the token component. This can be done by sending a crafted command to the /kubevirt.io/kubevirt API...

PT-2024-20685 · Tvrock · Tvrock

Name of the Vulnerable Software and Affected Versions: TvRock version 0.9t8a Description: A denial-of-service DoS issue exists, where receiving a specially crafted request by a remote attacker or having a user click a specially crafted request may lead to an abnormal end ABEND. The developer of...

PT-2024-10854 · Minerbabe · Minerbabe

Name of the Vulnerable Software and Affected Versions: Minerbabe versions through V4.16 Description: The issue allows man-in-the-middle attacks due to SSH host keys being baked into the installation image. This makes it trivial to identify all public IPv4 nodes using Shodan.io. Recommendations: F...

PT-2024-4456 · Adobe · Experience Manager

Name of the Vulnerable Software and Affected Versions: Adobe Experience Manager versions 6.5.20 and earlier Description: The issue is related to insufficient protection of the web page structure, which can be exploited by a remote attacker to execute arbitrary code. A stored Cross-Site Scripting...

PT-2024-10725 · Easymine · Easymine

Name of the Vulnerable Software and Affected Versions: easyMINE versions prior to 2019-12-05 Description: The issue allows man-in-the-middle attacks due to SSH host keys being baked into the installation image. This makes it trivial to identify all public IPv4 nodes using Shodan.io...