PT-2024-1306

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 2.8.1 Description The issue is related to the deserialization mechanism in Apache Airflow, allowing a potential attacker to poison the XCom data by bypassing the protection of the enable xcom pickling=False...

PT-2024-1421 · Jenkins +1 · Jenkins Gitlab Branch Source Plugin +2

Name of the Vulnerable Software and Affected Versions: Jenkins GitLab Branch Source Plugin versions 684.vea fa 7c1e2fe3 and earlier Description: The issue is related to a cross-site request forgery CSRF vulnerability. This vulnerability allows attackers to connect to an attacker-specified URL. Th...

PT-2024-1194

Name of the Vulnerable Software and Affected Versions Hitron Systems DVR HVR-4781 versions 1.03 through 4.02 Description The issue is related to the use of default credentials in the Hitron Systems DVR HVR-4781, which can be exploited by a remote attacker to cause a denial of service by utilizing...

PT-2024-13541 · Quest Analytics Llc · Iqcrm

Name of the Vulnerable Software and Affected Versions: Quest Analytics LLC IQCRM version 2023.9.5 Description: The issue allows a remote attacker to execute arbitrary code via a crafted request to the "Common.svc WSDL" page. This is a SQL Injection vulnerability. Recommendations: For Quest...

PT-2024-19557

Name of the Vulnerable Software and Affected Versions Hitron Systems DVR LGUVR-8H versions 1.02 through 4.02 Description The issue is related to improper input validation, which can allow an attacker to cause a network attack if the default admin ID and password are used. Recommendations For...

PT-2024-15806 · European Chemicals Agency · Iuclid

Name of the Vulnerable Software and Affected Versions: European Chemicals Agency IUCLID version 7.10.3 Description: A critical vulnerability was found in the European Chemicals Agency IUCLID, affecting an unknown function of the file iuclid6.exe of the component Desktop Installer. The manipulatio...

PT-2024-20040

Name of the Vulnerable Software and Affected Versions LlamaHub aka llama-hub versions prior to 0.0.67 Description The OpenAPI and ChatGPT plugin loaders in LlamaHub allow attackers to execute arbitrary code because safe load is not used for YAML. This issue enables attackers to execute arbitrary...

CVE-2024-23331

Vite is a frontend tooling framework for javascript. The Vite dev server option server.fs.deny can be bypassed on case-insensitive file systems using case-augmented versions of filenames. Notably this affects servers hosted on Windows. This bypass is similar to CVE-2023-34092 -- with surface area...

CVE-2024-23331 Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem

Vite is a frontend tooling framework for javascript. The Vite dev server option server.fs.deny can be bypassed on case-insensitive file systems using case-augmented versions of filenames. Notably this affects servers hosted on Windows. This bypass is similar to CVE-2023-34092 -- with surface area...

CVE-2022-45083

Deserialization of Untrusted Data vulnerability in ProfilePress Membership Team Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress.This issue affects Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User...

CVE-2022-45083

Deserialization of Untrusted Data vulnerability in ProfilePress Membership Team Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress.This issue affects Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User...

Deserialization of untrusted data

Deserialization of Untrusted Data vulnerability in ProfilePress Membership Team Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress.This issue affects Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User...

CVE-2022-45083 WordPress ProfilePress Plugin <= 4.3.2 is vulnerable to PHP Object Injection

Deserialization of Untrusted Data vulnerability in ProfilePress Membership Team Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress.This issue affects Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User...

PT-2024-14327

Name of the Vulnerable Software and Affected Versions YonBIP version 3 23.05 Description The issue is an arbitrary file read vulnerability. It occurs via the CommonServletDispatcher component in the nc.bs.framework.comn.serv package. Recommendations For YonBIP version 3 23.05, consider restrictin...

PT-2024-15776 · Byzoro · Byzoro Smart S150 Management Platform

Name of the Vulnerable Software and Affected Versions: Byzoro Smart S150 Management Platform version V31R02B15 Description: A vulnerability has been found in the Byzoro Smart S150 Management Platform, affecting an unknown part of the file /log/download.php of the component Backup File Handler. Th...

PT-2024-15796 · Unknown · Hecheng Leadshop

Name of the Vulnerable Software and Affected Versions: Hecheng Leadshop versions up to 1.4.20 Description: A critical issue was found in Hecheng Leadshop, affecting an unknown function of the file /web/leadshop.php. The manipulation of the install argument leads to deserialization. It is possible...

PT-2024-15786 · Foru Cms · Foru Cms

Name of the Vulnerable Software and Affected Versions: ForU CMS versions up to 2020-06-23 Description: A critical issue has been found in ForU CMS, affecting some unknown functionality of the file cms admin.php. The manipulation of the a name argument leads to sql injection. The exploit has been...

CVE-2022-45083: Deserialization of Untrusted Data

Deserialization of Untrusted Data vulnerability in ProfilePress Membership Team Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress.This issue affects Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User...

PT-2024-14326

Name of the Vulnerable Software and Affected Versions YonBIP version 3 23.05 Description An arbitrary file upload vulnerability in the doAction method of nccloud.web.arcp.taskmonitor.action.ArcpUploadAction allows attackers to execute arbitrary code via uploading a crafted file. Recommendations F...

PT-2024-15785 · Foru Cms · Foru Cms

Name of the Vulnerable Software and Affected Versions: ForU CMS versions up to 2020-06-23 Description: A problematic issue was found in ForU CMS, affecting an unknown functionality of the file channel.php. The manipulation of the c cmodel argument leads to file inclusion. This issue can be...