PT-2024-17213 · WordPress · Cookie Consent For Wp

Name of the Vulnerable Software and Affected Versions: Cookie Consent for WP – Cookie Consent, Consent Log, Cookie Scanner, Script Blocker for GDPR, CCPA & ePrivacy plugin for WordPress versions up to, and including, 3.6.5 Description: The issue concerns unauthorized modification of data due to a...

PT-2024-16319 · WordPress · Ai Engine

Name of the Vulnerable Software and Affected Versions: AI Engine WordPress plugin versions prior to 2.6.5 Description: The issue concerns a failure to properly sanitize and escape a parameter from one of the plugin's RESP API endpoints before using it in a SQL statement. This allows administrator...

PT-2024-16335 · WordPress · Paid Membership Plugin

Name of the Vulnerable Software and Affected Versions: Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content WordPress plugin versions prior to 4.15.15 Description: The issue concerns the Paid Membership Plugin, Ecommerce, User Registration Form,...

PT-2024-39734 · WordPress · Luckywp Table Of Contents

Name of the Vulnerable Software and Affected Versions: LuckyWP Table of Contents versions prior to 2.1.7 Description: The issue concerns the LuckyWP Table of Contents WordPress plugin, which does not properly sanitise and escape some of its settings. This could allow high privilege users, such as...

CVE-2024-50585 Reflected Cross-Site Scripting

Users who click on a malicious link or visit a website under the control of an attacker can be infected with arbitrary JavaScript which is running in the context of the "Numerix License Server Administration System Login" nlslogin.jsp page. The vulnerability can be triggered by sending a speciall...

CVE-2024-50585 Reflected Cross-Site Scripting

Users who click on a malicious link or visit a website under the control of an attacker can be infected with arbitrary JavaScript which is running in the context of the "Numerix License Server Administration System Login" nlslogin.jsp page. The vulnerability can be triggered by sending a speciall...

PT-2024-9581 · Gitlab · Gitlab Ce/Ee

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 16.1 through 17.4.6 GitLab CE/EE versions 17.5 through 17.5.4 GitLab CE/EE versions 17.6 through 17.6.2 Description: An issue was discovered in GitLab CE/EE where the injection of Network Error Logging NEL headers in the...

PT-2024-17616 · Dromara · Dromara Ujcms

Name of the Vulnerable Software and Affected Versions: Dromara UJCMS versions up to 9.6.3 Description: A problematic vulnerability has been found in Dromara UJCMS, affecting an unknown part of the file /users/id of the component User ID Handler. The manipulation leads to authorization bypass. It ...

PT-2024-10371

Name of the Vulnerable Software and Affected Versions GStreamer versions prior to 1.24.10 Description GStreamer is a library for constructing graphs of media-handling components. An integer underflow has been detected in the extract cc from data function within qtdemux.c. In the FOURCC c708 case,...

PT-2024-34457 · Silicon · Z-Wave Series 700/800

Name of the Vulnerable Software and Affected Versions: Silicon Labs SiLabs Z-Wave Series 700 and 800 version 7.21.1 Description: The issue is related to insecure permissions in the affected software, allowing attackers to disrupt communications between the controller and the device by repeatedly...

CVE-2024-45493

Summary: CVE-2024-45493 affects MSA FieldServer Gateway versions 5.0.0–6.5.2; a bypass allows an attacker to authenticate with an internal user account from the network, if password known. The issue is fixed in version 7.0.0. Affected product: MSA FieldServer Gateway (FieldServer Gateway) — Field...

PT-2024-34547 · Jepaas · Jepaas

Name of the Vulnerable Software and Affected Versions: JEPAAS version 7.2.8 Description: The issue allows a remote user to submit a specially crafted query via the /je/rbac/rbac/loadLoginCount API endpoint in the dateVal parameter. This could enable an attacker to retrieve all the information...

PT-2024-34455 · Silicon · Z-Wave Series 700/800

Name of the Vulnerable Software and Affected Versions: Silicon Labs SiLabs Z-Wave Series 700 and 800 version 7.21.1 Description: The issue concerns insecure permissions in the software, allowing attackers to create a fake node by supplying crafted packets. Recommendations: For Silicon Labs SiLabs...

PT-2024-9451 · Microsoft · Windows Ip Routing Management Snapin +1

Name of the Vulnerable Software and Affected Versions: Windows IP Routing Management Snapin affected versions not specified Description: The issue is related to a remote code execution vulnerability in the Windows IP Routing Management Snapin. It is caused by incorrect restriction of the path nam...

PT-2024-34456 · Silicon · Z-Wave Series 700 +1

Name of the Vulnerable Software and Affected Versions: Silicon Labs SiLabs Z-Wave Series 700 and 800 version 7.21.1 Description: The issue is related to insecure permissions in the Silicon Labs SiLabs Z-Wave Series 700 and 800, which allows attackers to cause a Denial of Service DoS by repeatedly...

PT-2024-9717 · Adobe · Experience Manager

Name of the Vulnerable Software and Affected Versions: Adobe Experience Manager versions 6.5.21 and earlier Description: The issue is related to a stored Cross-Site Scripting XSS vulnerability that could be exploited by an attacker to inject malicious scripts into vulnerable form fields. This cou...

The vulnerability of the 2N Access Commander access control tool lies in the incorrect limitation of the path name for the restricted access catalog, allowing a intruder to execute arbitrary code.

The vulnerability of the 2N Access Commander access control system lies in the incorrect limitation of the path name to the restricted catalog. Exploiting this vulnerability allows a malicious actor, operating remotely, to execute arbitrary code...

WordPress Simple Restrict plugin <= 1.2.7 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure vulnerability

Unauthenticated Content Restriction Bypass to Sensitive Information Exposure vulnerability discovered by Francesco Carlucci in WordPress Plugin Simple Restrict versions = 1.2.7...

PT-2024-10373

Name of the Vulnerable Software and Affected Versions GStreamer versions prior to 1.24.10 Description A null pointer dereference has been discovered in the id3v2 read synch uint function, located in id3v2.c. If id3v2 read synch uint is called with a null work-hdr.frame data, the pointer guint8 da...

WordPress plugin Lenxel Core for Lenxel(LNX) LMS 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...