CVE-2024-40853

This issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 18 and iPadOS 18. An attacker may be able to use Siri to enable Auto-Answer Calls...

CVE-2024-44261

This issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 17.7.1 and iPadOS 17.7.1, iOS 18.1 and iPadOS 18.1. An attacker may be able to view restricted content from the lock screen...

CVE-2024-44203

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15. An app may be able to access a user's Photos Library...

CVE-2024-40851

This issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 18.1 and iPadOS 18.1. An attacker with physical access may be able to access contact photos from the lock screen...

CVE-2024-40851

CVE-2024-40851 affects Apple iOS 18.1 and iPadOS 18.1. The issue allowed an attacker with physical access to view contact photos from the lock screen due to insufficient restrictions on options presented on a locked device. Apple fixed this in iOS 18.1 / iPadOS 18.1 via strengthened authenticatio...

CVE-2024-50442

Improper Restriction of XML External Entity Reference vulnerability in WP Royal Royal Elementor Addons allows XML Injection.This issue affects Royal Elementor Addons: from n/a through 1.3.980...

CVE-2024-50442

CVE-2024-50442 is an XML External Entity (XXE) vulnerability in WordPress plugin Royal Elementor Addons and Templates (

PT-2024-34236 · Unknown · Firelight Lightbox

Name of the Vulnerable Software and Affected Versions: Firelight Lightbox versions 2.3.3 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS attacks. Recommendations: For...

PT-2024-33016 · Unknown · Dingfanzu Cms

Name of the Vulnerable Software and Affected Versions: dingfanzu CMS version 1.0 Description: The issue is related to a Cross-Site Request Forgery CSRF in the component /admin/doAdminAction.php?act=delAdmin&id=17. This allows for unauthorized actions to be performed. Recommendations: For dingfanz...

PT-2024-34248 · Unknown · Checklist Trip Plan

Name of the Vulnerable Software and Affected Versions: Checklist Trip Plan versions n/a through 1.0.10 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS attacks. Recommendations: For...

PT-2024-34221 · Unknown · Futurio Extra

Name of the Vulnerable Software and Affected Versions: Futurio Extra versions 2.0.11 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS attacks. Recommendations: For...

ROS-20241028-02

The vulnerability of the net-netip component of Golang programming language is related to incorrect operation of Is methods IsPrivate, IsLoopback, etc. methods. Exploitation of the vulnerability can allow an intruder to bypass the existing access restriction policy...

PT-2024-10120

Name of the Vulnerable Software and Affected Versions libexpat versions prior to 2.6.4 Description The issue is related to the XML ResumeParser function in the libexpat library, which can cause a crash due to insufficient checking of unusual or exceptional states. This can be exploited by a remot...

PT-2024-16252 · Code Projects · Code-Projects Blood Bank Management

Name of the Vulnerable Software and Affected Versions: code-projects Blood Bank Management version 1.0 Description: A critical issue affects the processing of the file /file/accept.php, where the manipulation of the reqid argument leads to SQL injection. The attack can be initiated remotely...

PT-2024-16263 · Unknown · Code-Projects Blood Bank Management System

Name of the Vulnerable Software and Affected Versions: code-projects Blood Bank Management System version 1.0 Description: A problematic issue was found in the system, affecting some unknown functionality of the file /bloodrequest.php. The manipulation of the msg argument leads to cross-site...

PT-2024-16251 · Unknown · Code-Projects Blood Bank Management

Name of the Vulnerable Software and Affected Versions: code-projects Blood Bank Management versions up to 1.0 Description: A critical issue has been found in the code, affecting the file /abs.php. The manipulation of the search argument leads to SQL injection. This issue can be exploited remotely...

CVE-2024-49753 Denied Host Validation Bypass in Zitadel Actions

Zitadel is open-source identity infrastructure software. Versions prior to 2.64.1, 2.63.6, 2.62.8, 2.61.4, 2.60.4, 2.59.5, and 2.58.7 have a flaw in the URL validation mechanism of Zitadel actions allows bypassing restrictions intended to block requests to localhost 127.0.0.1. The isHostBlocked...

PT-2024-11552 · Ovaledge · Ovaledge

Name of the Vulnerable Software and Affected Versions: OvalEdge versions 5.2.8.0 and earlier Description: The issue allows for Sensitive Data Exposure through a GET request to "/user/getUserWithTeam". This requires authentication and discloses information associated with all registered user ID...

PT-2024-27780 · Mangoos · Mangoos

Name of the Vulnerable Software and Affected Versions: MangoOS versions prior to 5.2.0 Description: The issue is related to a Client-Side Template Injection CSTI vulnerability. This vulnerability can be exploited via the Platform Management Edit page. Recommendations: For versions prior to 5.2.0,...

PT-2024-33494 · Plenti +1 · Plenti +1

Name of the Vulnerable Software and Affected Versions: Plenti versions prior to 0.7.2 Description: The issue is related to an arbitrary file write vulnerability. The /postLocal endpoint is vulnerable, which may lead to Remote Code Execution when a Plenti user serves their website. Recommendations...