The vulnerability of the Desigo Insight building management software lies in the improper restriction on the visible layers of the user interface. This allows a hacker to redirect users to any desired website.

The vulnerability of the Desigo Insight building management software is related to an improper limitation on the visible layers of the user interface. Exploiting this vulnerability could allow a malicious actor to redirect users to any desired website...

ROS-20241203-20

Apache Ivy package manager vulnerability is related to incorrect path name restriction to a directory with a restricted directory. Exploitation of the vulnerability could allow an attacker acting remotely, gain unauthorized access to the file system Apache Ivy package manager vulnerability is...

PT-2024-35763 · Seecms · Seecms

Name of the Vulnerable Software and Affected Versions: Seecms version 4.8 Description: A SQL injection issue was discovered in the SEMCMS SeoAndTag.php page. This issue allows for potential SQL injection attacks. Recommendations: For Seecms version 4.8, consider restricting access to the SEMCMS...

PT-2024-36007 · Unknown · Mobile Security Framework

Name of the Vulnerable Software and Affected Versions: Mobile Security Framework MobSF versions prior to 3.9.7 Description: The issue concerns a server-side request forgery vulnerability. It occurs when the requests.get request in the check url method is set to allow redirects=True, allowing a...

The vulnerability of Kanboard project management software lies in the improper restriction of the path name to the restricted access directory. This allows a hacker to execute arbitrary PHP code on the server and write to files.

The vulnerability of Kanboard project management software relates to incorrect restrictions on the path name to the restricted access catalog. Exploiting this vulnerability allows a malicious actor to execute arbitrary PHP code on the server and write data to files...

PT-2024-36950

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.74 Description A warning was encountered in the Linux kernel where close work was canceled before initialization, resulting in a warning. This issue occurs when smc close cancel work is triggered, such as whe...

CVE-2024-43049 Improper Restriction of Operations within the Bounds of a Memory Buffer in WLAN Windows Host

Memory corruption while invoking IOCTL calls from user space to set generic private command inside WLAN driver...

PT-2024-35305 · Data443 · Data443 Lgpd Framework

Name of the Vulnerable Software and Affected Versions: Data443 LGPD Framework versions n/a through 2.0.2 Description: The issue is related to improper neutralization of input during web page generation, which allows reflected Cross-site Scripting XSS. This enables attackers to inject malicious...

PT-2024-35839 · Unknown · April'S Call Posts

Name of the Vulnerable Software and Affected Versions: April's Call Posts versions n/a through 2.1.1 Description: The issue is related to a Cross-Site Request Forgery CSRF problem that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web...

PT-2024-35960

Name of the Vulnerable Software and Affected Versions: Argo Workflows versions 3.5.7 through 3.5.8 Description: Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. When using --auth-mode=client, archived workflows can be retrieved with ...

PT-2024-35891 · Yahoo · Max Engel Yahoo! Webplayer

Name of the Vulnerable Software and Affected Versions: Max Engel Yahoo! WebPlayer versions n/a through 2.0.6 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can perform actions on behalf of a user without their knowledge or...

PT-2024-35419 · Zzcms · Zzcms

Name of the Vulnerable Software and Affected Versions: ZZCMS version 2023 Description: A SQL injection issue was discovered in the /q/show.php endpoint. This issue allows for potential SQL injection attacks. Recommendations: For ZZCMS version 2023, consider restricting access to the /q/show.php...

PT-2024-35297 · Unknown · Youniq Recommendations

Name of the Vulnerable Software and Affected Versions: Youniq Recommendations versions n/a through 3.0.7 Description: The issue is related to improper neutralization of input during web page generation, also known as 'Cross-site Scripting'. This allows for Reflected XSS. Recommendations: For...

PT-2024-35329 · Udi Dollberg · Add Chat App Button

Name of the Vulnerable Software and Affected Versions: Udi Dollberg Add Chat App Button versions 2.1.5 and earlier Description: The issue is related to improper neutralization of input during web page generation, also known as 'Cross-site Scripting', which allows stored XSS. This enables potentia...

PT-2024-35308 · Leadboxer · Leadboxer

Name of the Vulnerable Software and Affected Versions: LeadBoxer versions prior to 1.2 Description: The issue is related to improper neutralization of input during web page generation, also known as 'Cross-site Scripting', which allows Reflected XSS. This problem affects LeadBoxer, enabling...

PT-2024-17402 · WordPress · Project Manager

Name of the Vulnerable Software and Affected Versions: Project Manager WordPress Plugin affected versions not specified Description: The issue is an authenticated SQL injection vulnerability in the orderby parameter in the "/pm/v2/activites" API endpoint. This vulnerability affects the 'Project...

PT-2024-35344 · Unknown · Tailored Tools

Name of the Vulnerable Software and Affected Versions: Tailored Tools versions 1.8.4 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for stored Cross-site Scripting XSS. This means that an attacker can inject malicious...

PT-2024-35853 · Elementor · Elementor Image Gallery Plugin

Name of the Vulnerable Software and Affected Versions: Elementor Image Gallery Plugin versions 1.0.3 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for stored Cross-site Scripting XSS. This means an attacker can inject...

PT-2024-35852 · Flickdevs · Flickdevs Countdown Timer For Elementor

Name of the Vulnerable Software and Affected Versions: FlickDevs Countdown Timer for Elementor versions 1.3.6 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows stored Cross-site Scripting XSS. This enables attackers to injec...

PT-2024-35886 · WordPress · Sparkle Wp Sparkle Elementor Kit

Name of the Vulnerable Software and Affected Versions: Sparkle WP Sparkle Elementor Kit versions through 2.0.9 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows DOM-Based XSS. This is a Cross-site...