PT-2024-41081 · Spring · Spring Framework

Name of the Vulnerable Software and Affected Versions: Spring Framework affected versions not specified Description: The issue is related to the org.springframework.web.multipart package of the Spring Web module in the Spring Framework, which is associated with incorrect restriction of the path...

PT-2024-17160 · Engenius · Engenius Ens500-Ac +2

Name of the Vulnerable Software and Affected Versions: EnGenius ENH1350EXT, ENS500-AC, and ENS620EXT versions up to 20241118 Description: A critical issue affects an unknown function of the file /admin/network/wifi schedule. The manipulation of the argument wifi schedule day em 5 leads to command...

PT-2024-17176 · Unknown · Cph2 Echarge Firmware

Name of the Vulnerable Software and Affected Versions: cph2 echarge firmware versions through 2.0.4 Description: The issue affects devices that communicate with the eCharge cloud infrastructure over an insecure channel, as peer verification is disabled. This allows remote unauthenticated users,...

Astra Linux – Vulnerability in dovecot

Having a large number of address headers From, To, Cc, Bcc, etc. can lead to excessive CPU usage. With 100,000 header lines, CPU usage reaches 12 seconds; in a production environment, parsing 500,000 header lines takes 18 minutes. This issue can be triggered by external actors sending emails to...

PT-2024-16935 · WordPress · Pdf Invoices & Packing Slips Generator For Woocommerce

Name of the Vulnerable Software and Affected Versions: PDF Invoices & Packing Slips Generator for WooCommerce plugin for WordPress versions up to, and including, 2.2.1 Description: The issue arises from the use of add query arg without proper escaping on the URL, leading to Reflected Cross-Site...

PT-2024-16614 · WordPress · Jobboardwp

Name of the Vulnerable Software and Affected Versions: JobBoardWP – Job Board Listings and Submissions plugin for WordPress versions up to, and including, 1.3.0 Description: The issue is related to Reflected Cross-Site Scripting due to the use of add query arg and remove query arg without proper...

PT-2024-12038 · Opentext · Opentext Imanager

Name of the Vulnerable Software and Affected Versions: OpenText iManager version 3.2.6.0000 Description: A possible command injection issue has been discovered in the iManager GET parameter of OpenText iManager. Recommendations: For OpenText iManager version 3.2.6.0000, consider restricting acces...

PT-2024-16570 · Codeastrology · The Product Table For Woocommerce

Name of the Vulnerable Software and Affected Versions: The Product Table for WooCommerce by CodeAstrology plugin for WordPress versions up to, and including, 3.5.1 Description: The issue allows unauthenticated attackers to expose sensitive information via the var dump table parameter. This makes ...

PT-2024-34515 · Kia · Kia Seltos

Name of the Vulnerable Software and Affected Versions: KIA Seltos vehicle instrument cluster version 1.0 Description: An issue in the KIA Seltos vehicle instrument cluster allows attackers to control or disrupt CAN communication between the instrument cluster and CAN bus. The findings are dispute...

WordPress Anonymous Restricted Content plugin <= 1.6.5 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure vulnerability

Unauthenticated Content Restriction Bypass to Sensitive Information Exposure vulnerability discovered by Francesco Carlucci in WordPress Plugin Anonymous Restricted Content versions = 1.6.5...

CVE-2024-11089 Anonymous Restricted Content <= 1.6.5 - Unauthenticated Content Restriction Bypass to Sensitive Information Exposure

The Anonymous Restricted Content plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.6.5 via the WordPress core search feature. This makes it possible for unauthenticated attackers to extract sensitive data from posts that have been...

CVE-2024-11089

CVE-2024-11089 refers to the WordPress plugin Anonymous Restricted Content (WordPress.org) and is an unauthenticated exposure vulnerability. All versions up to and including 1.6.5 allow an attacker to use the WordPress core search feature to retrieve sensitive information from posts that were res...

PT-2024-35725 · Totolink · Totolink A810R

Name of the Vulnerable Software and Affected Versions: TOTOLINK A810R version 4.1.2cu.5182 B20201026 Description: The issue is related to a Buffer Overflow in the infostat.cgi component. Recommendations: For TOTOLINK A810R version 4.1.2cu.5182 B20201026, consider restricting access to the...

GoCast NAT parameter OS command injection vulnerability

Talos Vulnerability Report TALOS-2024-1961 GoCast NAT parameter OS command injection vulnerability November 21, 2024 CVE Number CVE-2024-29224 SUMMARY An OS command injection vulnerability exists in the NAT parameter of GoCast 1.1.3. A specially crafted HTTP request can lead to arbitrary command...

PT-2024-17119 · Idccms · Idccms

Name of the Vulnerable Software and Affected Versions: idcCMS version 1.60 Description: A problematic issue was found in idcCMS, affecting the GetCityOptionJs function of the file /inc/classProvCity.php. The manipulation of the idName argument leads to cross-site scripting. This issue can be...

PT-2024-38033 · Unknown · Smart Doctor

Name of the Vulnerable Software and Affected Versions: Smart Doctor versions through 21.11.2024 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS attacks. The vendor was contacted...

openSUSE Security Advisory (SUSE-SU-2024:3999-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Versa Networks Versa Director insecure default PostgreSQL configuration

RISK EVALUATION Versa Networks Versa Director, by default, configures PostgreSQL to listen on all network interfaces using database credentials shared by multiple installations. From Advising Vulnerability In Versa Director: "This combination allows an unauthenticated attacker to access and...

Moodle Lesson activity password bypass through PHP loose comparison

A flaw was found in Moodle. When restricting access to a lesson activity with a password, certain passwords could be bypassed or less secure due to a loose comparison in the password-checking logic. This issue only affected passwords set to "magic hash" values...

PT-2024-10088 · Oracle · Eloqua

Name of the Vulnerable Software and Affected Versions: Eloqua versions 7.X- through 7.X-1.15 Description: The issue is related to the deserialization of untrusted data in Drupal Eloqua, allowing object injection. This can be exploited by a remote attacker to execute arbitrary code. The estimated...