PT-2024-17599 · Unknown · Concrete Cms

Name of the Vulnerable Software and Affected Versions: Concrete CMS version 9 before 9.2.5 Description: The issue concerns stored XSS in file tags and description attributes. Administrator-entered file attributes are not sufficiently sanitized in the Edit Attributes page, allowing a rogue...

PT-2024-21085 · Git +1 · Min

Name of the Vulnerable Software and Affected Versions: Min versions prior to 1.31.0 Description: The issue arises from local files not being correctly treated as unique security origins, allowing them to improperly request cross-origin resources. For example, a local file may request other local...

PT-2024-20876 · Code Projects · Code-Projects Cinema Seat Reservation System

Name of the Vulnerable Software and Affected Versions: Code-projects Cinema Seat Reservation System version 1.0 Description: The issue allows SQL Injection via the id parameter at "/Cinema-Reservation/booking.php?id=1". This means an attacker could potentially inject malicious SQL code by...

PT-2024-20872 · Sourcecodester · Sourcecodester Student Attendance Management System

Name of the Vulnerable Software and Affected Versions: Sourcecodester Event Student Attendance System version 1.0 Description: The issue allows SQL Injection via the student parameter. This could potentially lead to unauthorized access or manipulation of database content. There is no information...

PT-2024-20753 · Mediawiki · Managewiki

Name of the Vulnerable Software and Affected Versions: ManageWiki affected versions not specified Description: ManageWiki is a MediaWiki extension that allows users to manage wikis. The issue arises because Special:ManageWiki does not properly escape interface messages on the columns and help key...

PT-2024-12056 · Unknown · October Cms

Name of the Vulnerable Software and Affected Versions: October CMS version 3.2.0 Description: A Cross Site Scripting issue allows a local attacker to execute arbitrary code via the file type .mp3. Recommendations: For October CMS version 3.2.0, update to a version that fixes this issue to prevent...

PT-2024-1929 · Unknown · Mysql Server +1

Name of the Vulnerable Software and Affected Versions: LaborOfficeFree version 19.10 Description: The issue is related to weak password requirements in LaborOfficeFree, which can be exploited to perform a brute force attack. This allows an attacker to easily discover the root password of the MySQ...

PT-2024-14984

Name of the Vulnerable Software and Affected Versions MİA-MED versions prior to 1.0.7 Description The issue is related to an Authorization Bypass Through User-Controlled Key vulnerability, allowing authentication abuse. This vulnerability enables potential attackers to bypass authentication...

PT-2024-20320 · Zentao · Zentao

Name of the Vulnerable Software and Affected Versions: Zentao versions 18.0 through 18.10 Description: A remote code execution issue was discovered in Zentao, affecting its checkConnection method. The vulnerability can be exploited via the /app/zentao/module/repo/model.php endpoint, allowing for...

PT-2024-12819 · Easyemail · Easyemail

Name of the Vulnerable Software and Affected Versions: EasyEmail versions prior to 4.12.2 Description: A Cross Site Scripting XSS issue allows a local attacker to execute arbitrary code via the user input parameters. The researcher claims this issue is present in all versions prior to and later...

CentOS 8 : cups-filters (CESA-2023:3425)

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2023:3425 advisory. - cups-filters contains backends, filters, and other software required to get the cups printing service working on operating systems other than macos. If you us...

PT-2024-12314 · Ibm · Ibm Security Verify Access

Name of the Vulnerable Software and Affected Versions: IBM Security Verify Access versions 10.0.0.0 through 10.0.6.1 Description: The issue is related to the use of insecure protocols in some instances, which could allow an attacker on the network to take control of the server. Recommendations: F...

PT-2024-20229 · Jsherp · Jsherp

Name of the Vulnerable Software and Affected Versions: jshERP version 3.3 Description: The issue concerns a SQL Injection vulnerability. Specifically, the findInOutMaterialCount function in com.jsh.erp.controller.DepotHeadController does not adequately filter the column and order parameters,...

PT-2024-20776 · Liferay · Liferay Dxp +1

Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.2.0 through 7.3.6 Liferay DXP 7.3 before service pack 3 Liferay DXP 7.2 before fix pack 13 Description: The Document and Media widget in Liferay Portal does not limit resource consumption when generating a preview...

PT-2024-20233 · Unknown · Novel-Plus

Name of the Vulnerable Software and Affected Versions: Novel-Plus versions 4.3.0-RC1 and prior Description: A SQL injection issue exists, allowing an attacker to perform SQL injection by passing crafted offset, limit, and sort parameters via the "/novel/author/list" API endpoint. Recommendations:...

PT-2024-20240 · Unknown · Novel-Plus

Name of the Vulnerable Software and Affected Versions: Novel-Plus versions 4.3.0-RC1 and prior Description: A SQL injection vulnerability exists, allowing an attacker to pass specially crafted offset, limit, and sort parameters to perform SQL injection via the "/novel/bookContent/list" API...

PT-2024-13397 · Enhancesoft · Osticket

Name of the Vulnerable Software and Affected Versions: Enhancesoft osTicket version 1.18.0 Description: The issue is related to a Cross Site Scripting vulnerability in the sanitize function, allowing a remote attacker to escalate privileges via a crafted support ticket. This vulnerability is also...

PT-2024-20241 · Unknown · Novel-Plus

Name of the Vulnerable Software and Affected Versions: Novel-Plus versions 4.3.0-RC1 and prior Description: An arbitrary file download issue exists, allowing an attacker to download files by passing specially crafted filePath and fileName parameters to the fileDownload function in the...

PT-2024-12066 · Dell · Dell Power Manager

Name of the Vulnerable Software and Affected Versions: Dell Power Manager versions prior to 3.14 Description: The issue is related to an Improper Authorization vulnerability in the DPM service. A low-privileged malicious user could potentially exploit this vulnerability to elevate privileges on t...

PT-2024-17641 · Beijing Baichuo · Smart S40 Management Platform

Name of the Vulnerable Software and Affected Versions: Beijing Baichuo Smart S40 Management Platform versions up to 20240126 Description: A critical issue has been found in the Smart S40 Management Platform, affecting some unknown functionality of the file /useratte/web.php of the component Impor...