CVE-2024-36265 Apache Submarine Server Core: authorization bypass

UNSUPPORTED WHEN ASSIGNED Incorrect Authorization vulnerability in Apache Submarine Server Core. This issue affects Apache Submarine Server Core: from 0.8.0. An attacker can bypass authentication by sending specially crafted REST requests. As this project is retired, we do not plan to release a...

CVE-2024-2461

If exploited an attacker could traverse the file system to access files or directories that would otherwise be inaccessible...

PT-2024-27322 · Dell · Dell Openmanage Server Administrator

Name of the Vulnerable Software and Affected Versions: Dell OpenManage Server Administrator versions 11.0.1.0 and prior Description: The issue is a Local Privilege Escalation vulnerability via XSL Hijacking. A local low-privileged malicious user could potentially exploit this vulnerability and...

ROS-20240607-04

Vulnerability of the virNetClientIOEventLoop method of the Libvirt virtualization management library is related to incorrect execution of the data pointer to the structure virNetClientIOEventLoop in the virNetClientIOEventLoop method virNetClientIOIOEventData. Exploitation of the vulnerability...

PT-2024-26889 · WordPress · Music Store

Name of the Vulnerable Software and Affected Versions: Music Store - WordPress eCommerce versions prior to 1.1.14 Description: A SQL injection issue allows a remote authenticated attacker with administrative privileges to execute arbitrary SQL commands, potentially obtaining or altering informati...

DRUPAL-CONTRIB-2024-020

The Email Contact module provides email field display formatters that can display the field as a link to the contact form, or as an inline contact form. The module does not sufficiently handle restricted entity or field access to the mail sending form, when the "Email contact link" formatter is...

PT-2024-28414 · WordPress · Element Pack Elementor Addons

Name of the Vulnerable Software and Affected Versions: The Element Pack Elementor Addons plugin for WordPress versions up to, and including, 5.6.3 Description: The issue arises from the plugin not properly checking all variations of an administrator's email, allowing unauthenticated attackers to...

PT-2024-25731 · Smanga · Smanga

Name of the Vulnerable Software and Affected Versions: smanga version 3.2.7 Description: The issue is related to a path traversal vulnerability. It occurs because the file parameter at the "PHP/get file flow.php" interface is not properly filtered, allowing for arbitrary file reading...

PT-2024-32543 · WordPress · Shiftcontroller Employee Shift Scheduling

Name of the Vulnerable Software and Affected Versions: ShiftController Employee Shift Scheduling plugin versions up to, and including, 4.9.57 Description: The ShiftController Employee Shift Scheduling plugin is vulnerable to PHP Object Injection via deserialization of untrusted input via the hc3...

CVE-2024-34365

UNSUPPORTED WHEN ASSIGNED Improper Input Validation vulnerability in Apache Karaf Cave.This issue affects all versions of Apache Karaf Cave. As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to th...

PT-2024-25751 · Sourcecodester · Sourcecodester Human Resource Management System

Name of the Vulnerable Software and Affected Versions: Sourcecodester Human Resource Management System version 1.0 Description: The issue is related to Insecure Permissions, which can result in privilege escalation. Recommendations: For Sourcecodester Human Resource Management System version 1.0,...

PT-2024-23618 · Unknown · Cloud Based Customer Service Management Platform

Name of the Vulnerable Software and Affected Versions: Cloud based customer service management platform version 1.0.0 Description: The issue allows a local attacker to execute arbitrary code via a crafted payload to the "Login.asp" component. This is related to a SQL Injection vulnerability...

PT-2024-19351 · Ibm · Ibm Txseries For Multiplatforms

Name of the Vulnerable Software and Affected Versions: IBM TXSeries for Multiplatforms version 8.2 Description: The issue allows web pages to be stored locally, which can then be read by another user on the system. Recommendations: For IBM TXSeries for Multiplatforms version 8.2, consider...

The vulnerability in the iTop web tool for managing IT services arises from an incorrect limitation on the path to the restricted access catalog, allowing a perpetrator to disclose protected information.

The vulnerability of the iTop IT service management web tool is related to an incorrect limitation on the path name to the restricted access catalog. Exploiting this vulnerability could allow a malicious actor to disclose protected information...

GHSA-3MPF-RCC7-5347 Hono vulnerable to Restricted Directory Traversal in serveStatic with deno

Summary When using serveStatic with deno, it is possible to directory traverse where main.ts is located. My environment is configured as per this tutorial https://hono.dev/getting-started/deno PoC bash $ tree . ├── deno.json ├── deno.lock ├── main.ts ├── README.md └── static └── a.txt source jsx...

ROS-20240423-07

The aiohttp HTTP client vulnerability is related to an incorrect restriction of the path name to a directory with restricted access. Exploitation of the vulnerability could allow an attacker acting remotely to gain unauthorized access to protected information The aiohttp HTTP client vulnerability...

The vulnerability of the Avalanche device management system, related to incorrect restrictions on the path name to the restricted access catalog, allows a perpetrator to execute arbitrary commands with SYSTEM privileges.

The vulnerability of the Avalanche device management system is related to incorrect restrictions on the path name to the restricted access catalog. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands with SYSTEM privileges remotely...

PT-2024-23492 · Unknown · Inandrei-Tatar Nora-Firebase-Common

Name of the Vulnerable Software and Affected Versions: inandrei-tatar nora-firebase-common versions 1.0.41 through 1.12.2 Description: The issue allows a remote attacker to execute arbitrary code via a crafted script to the updateState parameter of the updateStateInternal method. This enables the...

PT-2024-18039 · WordPress · Element Pack Elementor Addons

Name of the Vulnerable Software and Affected Versions: The Element Pack Elementor Addons plugin for WordPress versions up to, and including, 5.6.0 Description: The issue is related to Stored Cross-Site Scripting via the tab link attribute of the Panel Slider widget due to insufficient input...

CVE-2024-26879

In the Linux kernel, the following vulnerability has been resolved: clk: meson: Add missing clocks to axgclkregmaps Some clocks were missing from axgclkregmaps, which caused kernel panic during cat /sys/kernel/debug/clk/clksummary 57.349402 Unable to handle kernel NULL pointer dereference at...