PT-2024-17641 · Beijing Baichuo · Smart S40 Management Platform

Name of the Vulnerable Software and Affected Versions: Beijing Baichuo Smart S40 Management Platform versions up to 20240126 Description: A critical issue has been found in the Smart S40 Management Platform, affecting some unknown functionality of the file /useratte/web.php of the component Impor...

PT-2024-1520 · Jetbrains · Jetbrains Teamcity +1

Name of the Vulnerable Software and Affected Versions: JetBrains TeamCity versions 2017.1 through 2023.11.2 Description: The issue is related to an authentication bypass in JetBrains TeamCity, which can lead to remote code execution RCE. This allows an unauthenticated attacker with HTTPS access t...

PT-2024-17638 · Unknown · Tongda Oa 2017

Name of the Vulnerable Software and Affected Versions: Tongda OA 2017 versions up to 11.9 Description: A critical vulnerability was found in Tongda OA 2017. The issue affects an unknown functionality of the file /general/attendance/manage/ask duty/delete.php. The manipulation of the ASK DUTY ID...

PT-2024-20227 · Jsherp · Jsherp

Name of the Vulnerable Software and Affected Versions: jshERP version 3.3 Description: The issue allows an attacker to construct a malicious payload to bypass the protection mechanism of jshERP via the com.jsh.erp.controller.DepotHeadController and the findallocationDetail function of...

PT-2024-2323

Name of the Vulnerable Software and Affected Versions Sharp NEC Displays P403, P463, P553, P703, P801, X554UN, X464UN, X554UNS, X464UNV, X474HB, X464UNS, X554UNV, X555UNS, X555UNV, X754HB, X554HB, E705, E805, E905, UN551S, UN551VS, X551UHD, X651UHD, X841UHD, X981UHD, MD551C8 Description The issue...

Page Restrict <= 2.5.5 - Cross-Site Request Forgery via pr_admin_page

Description The Page Restrict plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.5.5. This is due to missing or incorrect nonce validation on the 'pradminpage' function. This makes it possible for unauthenticated attackers to modify the plugin...

PT-2024-14906 · Canon · Color Imageclass Lbp674C +10

Name of the Vulnerable Software and Affected Versions: Satera LBP670C Series/Satera MF750C Series firmware versions 03.07 and earlier Color imageCLASS LBP674C/Color imageCLASS X LBP1333C/Color imageCLASS MF750C Series/Color imageCLASS X MF1333C Series firmware versions 03.07 and earlier i-SENSYS...

PT-2024-19644 · Symphony +1 · Symphony +1

Name of the Vulnerable Software and Affected Versions: symphony versions 3.6.3 and earlier Description: An issue in the software allows a remote attacker to execute arbitrary code via the log4j component. Recommendations: For versions 3.6.3 and earlier, consider disabling the log4j component unti...

PT-2024-20276 · Xmall · Xmall

Name of the Vulnerable Software and Affected Versions: xmall version 1.1 Description: The issue is a SQL injection vulnerability. It occurs via the orderDir parameter. Recommendations: For xmall version 1.1, as a temporary workaround, consider restricting the use of the orderDir parameter until a...

PT-2024-20381

Name of the Vulnerable Software and Affected Versions Stimulsoft Dashboard.JS versions prior to 2024.1.2 Description A Cross Site Scripting issue allows a remote attacker to execute arbitrary code via a crafted payload to the "search bar component". This enables the attacker to perform unauthoriz...

PT-2024-20622 · Biteship · Plugin Ongkos Kirim Kurir Instant

Name of the Vulnerable Software and Affected Versions: Biteship: Plugin Ongkos Kirim Kurir Instant, Reguler, Kargo versions through 2.2.24 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting. This allows Reflected XS...

PT-2024-2073 · Dataease · Dataease

Name of the Vulnerable Software and Affected Versions: Dataease versions prior to 1.18.15 Dataease versions prior to 2.3.0 Description: A deserialization vulnerability exists in the DataEase datasource, which can be exploited to execute arbitrary code. The location of the vulnerability code is...

PT-2024-13904 · Ibm · Ibm Powersc

Name of the Vulnerable Software and Affected Versions: IBM PowerSC versions 1.3 through 2.1 Description: The issue is related to the use of insecure HTTP methods, which could allow a remote attacker to perform unauthorized file request modification. Recommendations: For versions 1.3 through 2.1,...

PT-2024-14189 · WordPress · Crm Perks Forms – Wordpress Form Builder

Name of the Vulnerable Software and Affected Versions: CRM Perks Forms – WordPress Form Builder versions 1.1.2 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that...

PT-2024-1440 · Kaspersky · Kaspersky Security 8.0 For Linux Mail Server

Name of the Vulnerable Software and Affected Versions: Kaspersky Security 8.0 for Linux Mail Server Description: The issue allows an attacker to potentially force an administrator to click on a malicious link to perform unauthorized actions. This is due to the lack of measures to neutralize speci...

PT-2024-20259 · Unknown · Springboot-Manager

Name of the Vulnerable Software and Affected Versions: springboot-manager version 1.6 Description: The issue is related to Cross Site Scripting XSS via the "/sys/user" API endpoint. This allows for potential malicious script execution. The estimated number of potentially affected devices worldwid...

PT-2024-19642 · Eyoucms · Eyoucms

Name of the Vulnerable Software and Affected Versions: eyoucms version 1.6.5 Description: The issue allows a remote attacker to run arbitrary code via a crafted URL, exploiting a Cross Site Scripting vulnerability in the input parameter. Recommendations: For eyoucms version 1.6.5, consider...

PT-2024-20498

Name of the Vulnerable Software and Affected Versions Page Restrict versions 2.5.5 and earlier Description A Cross-Site Request Forgery CSRF issue has been identified. This type of issue allows an attacker to trick a user into performing unintended actions on a web application that the user is...

WordPress Page Restrict Plugin <= 2.5.5 is vulnerable to Cross Site Request Forgery (CSRF)

Software Page Restrict Type Plugin Vulnerable versions = 2.5.5 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-24702 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 820413371e9a Credits emad Required privilege...

WordPress Restrict Usernames Emails Characters Plugin < 3.1.4 is vulnerable to Cross Site Scripting (XSS)

Software Restrict Usernames Emails Characters Type Plugin Vulnerable versions 3.1.4 Fixed in 3.1.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-6165 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 9c5a313dd81c Credits Yuhan...