CVE-2024-37155 OpenCTI May Bypass Introspection Restriction

OpenCTI is an open source platform allowing organizations to manage their cyber threat intelligence knowledge and observables. Prior to version 6.1.9, the regex validation used to prevent Introspection queries can be bypassed by removing the extra whitespace, carriage return, and line feed...

PAN-OS: Privilege Escalation (PE) Vulnerability in the Web Management Interface

A privilege escalation vulnerability in Palo Alto Networks PAN-OS software allows a PAN-OS administrator with access to the management web interface to perform actions on the firewall with root privileges. This issue is applicable to PAN-OS 10.1, PAN-OS 10.2, PAN-OS 11.0, PAN-OS 11.1, and PAN-OS...

Cross-Site Scripting (XSS)

studio-42/elfinder is vulnerable to persistent Cross-site Scripting XSS. The vulnerability is due to a filename restriction bypass, allowing attackers to inject malicious scripts...

PT-2024-35257 · Unknown · Reconstruction

Name of the Vulnerable Software and Affected Versions: ReConstruction versions 1.4.7 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Reflected XSS. Recommendations: For versions...

PT-2024-30574 · Glpi +2 · Glpi +2

Name of the Vulnerable Software and Affected Versions: GLPI versions 0.80 through 10.0.16 Description: The issue allows an unauthenticated user to use an application endpoint to check if an email address corresponds to a valid GLPI user. Recommendations: For versions 0.80 through 10.0.16, update ...

CVE-2020-25720

A vulnerability was found in Samba where a delegated administrator with permission to create objects in Active Directory can write to all attributes of the newly created object, including security-sensitive attributes, even after the object's creation. This issue occurs because the administrator...

PT-2025-13827 · NetGear · Netgear Wnr854T

Name of the Vulnerable Software and Affected Versions: Netgear WNR854T version 1.5.2 Description: The issue allows an attacker to send a specially crafted request to "post.cgi", updating the wan hostname parameter in nvram, which can lead to command injection and force a reboot. Recommendations:...

PT-2025-13825 · NetGear · Netgear Wnr854T

Name of the Vulnerable Software and Affected Versions: Netgear WNR854T version 1.5.2 Description: The issue concerns a stack-based buffer overflow in the M-SEARCH Host header of the UPNP service, located at /usr/sbin/upnp. Recommendations: For Netgear WNR854T version 1.5.2, consider disabling the...

GHSA-Q297-5FF8-HC92 FitNesse Path Traversal

Improper limitation of a pathname to a restricted directory 'Path Traversal' issue exists in FitNesse releases prior to 20241026. If this vulnerability is exploited, an attacker may be able to know whether a file exists at a specific path, and/or obtain some part of the file contents under specif...

PT-2024-27964

Name of the Vulnerable Software and Affected Versions GLPI versions 9.2.0 through 10.0.15 Description The issue allows unauthorized download of documents from the API without appropriate rights. Recommendations Upgrade to version 10.0.16 to resolve the issue. As a temporary workaround, consider...

The vulnerability of Siemens SINEC Security Monitor, a network security monitoring application, arises from an improper restriction on the path name to the restricted directories. This allows attackers to create files in arbitrary directories.

The vulnerability of the Siemens SINEC Security Monitor network security monitoring application is related to an incorrect restriction on the path name to the restricted directories. Exploiting this vulnerability could allow a malicious actor to create files in arbitrary directories remotely...

PT-2024-16852 · Zzcms · Zzcms

Name of the Vulnerable Software and Affected Versions: ZZCMS version 2023 Description: A critical issue affects some unknown functionality of the file /admin/ad list.php?action=pass of the component Keyword Filtering. The manipulation of the keyword argument leads to SQL injection. The attack may...

PT-2024-16351

Name of the Vulnerable Software and Affected Versions Dataprom Informatics Personnel Attendance Control Systems PACS / Access Control Security Systems ACSS versions prior to 2024 Description The issue is related to an Origin Validation Error, which allows traffic injection. This affects the...

PT-2024-16490 · WordPress · Postx

Name of the Vulnerable Software and Affected Versions: PostX plugin for WordPress versions up to, and including, 4.1.16 Description: The issue is related to a missing capability check on the install required plugin callback function, allowing authenticated attackers with Subscriber-level access a...

PT-2024-34484 · Unknown · Flightpath

Name of the Vulnerable Software and Affected Versions: FlightPath version 7.5 Description: The issue allows authenticated remote attackers with administrative rights to inject arbitrary JavaScript in the web browser of a user. This is achieved by including a malicious payload into the Last Name...

PT-2024-9633 · Adobe · Experience Manager

Name of the Vulnerable Software and Affected Versions: Adobe Experience Manager versions 6.5.21 and earlier Description: The issue is related to a stored Cross-Site Scripting XSS vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious...

CVE-2024-52371 WordPress Global Gateway e4 plugin <= 2.0 - Arbitrary File Deletion vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in DonnellC Global Gateway e4 | Payeezy Gateway | globe-gateway-e4.This issue affects Global Gateway e4 | Payeezy Gateway |: from n/a through = 2.0...

PT-2024-16062 · WordPress · Simple File List

Name of the Vulnerable Software and Affected Versions: Simple File List WordPress plugin versions prior to 6.1.13 Description: The issue is related to a Reflected Cross-Site Scripting flaw. It occurs because the plugin does not properly sanitise and escape a generated URL before outputting it bac...

PT-2024-10429 · Ibm · Ibm Sterling B2B Integrator

Name of the Vulnerable Software and Affected Versions: IBM Sterling B2B Integrator versions 6.0.0.0 through 6.1.2.5 IBM Sterling B2B Integrator versions 6.2.0.0 through 6.2.0.1 Description: The issue is related to the dashboard UI of IBM Sterling B2B Integrator, where an authenticated user could...

PT-2024-34422 · Unknown · Kashipara E-Learning Management System Project

Name of the Vulnerable Software and Affected Versions: kashipara E-learning Management System Project version 1.0 Description: A SQL Injection issue was found in the /admin/class.php file via the class name parameter. This allows for potential exploitation. Recommendations: For kashipara E-learni...