PT-2024-39702 · WordPress · Image Map Pro

Name of the Vulnerable Software and Affected Versions: Image Map Pro plugin for WordPress versions up to, and including, 6.0.20 Description: The issue is related to Stored Cross-Site Scripting via the save project function, allowing authenticated attackers with contributor-level and above...

PT-2024-11553 · Ovaledge · Ovaledge

Name of the Vulnerable Software and Affected Versions: OvalEdge versions 5.2.8.0 and earlier Description: The issue allows for an Account Takeover via a POST request to "/profile/updateProfile" using the userId and email parameters. Authentication is required to exploit this issue. Recommendation...

PT-2024-11555 · Ovaledge · Ovaledge

Name of the Vulnerable Software and Affected Versions: OvalEdge versions 5.2.8.0 and earlier Description: The issue allows for an Account Takeover via a POST request to "/profile/updateProfile" using the userId and email parameters. Authentication is required to exploit this issue. Recommendation...

PT-2024-33085 · Unknown · Esafenet Cdg

Name of the Vulnerable Software and Affected Versions: ESAFENET CDG versions 5 and earlier Description: A SQL Injection issue allows an attacker to execute arbitrary code via the id parameter of the "dataSearch.jsp" page. Recommendations: For versions 5 and earlier, update to a version that...

OpenRefine has a path traversal in LoadLanguageCommand

The load-language command expects a lang parameter from which it constructs the path of the localization file to load, of the form translations-$LANG.json. When doing so, it does not check that the resulting path is in the expected directory, which means that this command could be exploited to re...

PT-2024-33644 · Unknown · Product Filter By Wbw

Name of the Vulnerable Software and Affected Versions: Product Filter by WBW versions 2.7.0 and earlier Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks...

PT-2024-39765 · Vimesa · Vimesa Vhf/Fm Transmitter Blue Plus

Name of the Vulnerable Software and Affected Versions: VIMESA VHF/FM Transmitter Blue Plus affected versions not specified Description: The issue concerns a Denial-of-Service DoS vulnerability. An unauthenticated attacker can send an unauthorized HTTP GET request to the unprotected endpoint...

PT-2024-16194 · Janto · Janto

Name of the Vulnerable Software and Affected Versions: Janto version 4.3r11 Description: A Cross-Site Scripting issue has been found, allowing an attacker to execute JavaScript code in a victim's browser. This is achieved by sending a malicious URL using the endpoint...

PT-2024-16206 · Sourcecodester · Best House Rental Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Best House Rental Management System version 1.0 Description: A vulnerability was found in the Manage Tenant Details component, specifically affecting the /index.php?page=tenants file. The issue arises from the manipulation of t...

PT-2024-16169 · Unknown · Phpgurukul Medical Card Generation System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Medical Card Generation System version 1.0 Description: A critical issue was found in the Managecard Edit Image Page component, specifically in the /admin/changeimage.php file. The manipulation of the editid argument leads to SQL...

PT-2024-9145 · Cisco · Cisco Secure Firewall Management Center (Fmc)

Name of the Vulnerable Software and Affected Versions: Cisco Secure Firewall Management Center FMC Software versions affected versions not specified Description: A vulnerability in the web-based management interface could allow an authenticated, remote attacker to inject arbitrary HTML content in...

PT-2024-16163 · Zzcms · Zzcms

Name of the Vulnerable Software and Affected Versions: ZZCMS version 2023 Description: A problematic issue was found in ZZCMS, affecting an unknown part of the file 3/qq-connect2.0/API/com/inc.php, leading to information disclosure. The attack can be initiated remotely. Recommendations: For ZZCMS...

PT-2024-16168 · Unknown · Phpgurukul Medical Card Generation System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Medical Card Generation System version 1.0 Description: A critical issue has been identified in the Report of Medical Card Page component, specifically in the /admin/card-bwdates-reports-details.php file. The issue allows for SQL...

PT-2024-7476 · Cisco · Cisco Secure Firewall Management Center (Fmc)

Name of the Vulnerable Software and Affected Versions: Cisco Secure Firewall Management Center FMC Software affected versions not specified Description: A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center FMC Software could allow an authenticated, remo...

PT-2024-33150 · Unknown · Client Management System

Name of the Vulnerable Software and Affected Versions: Client Management System version 1.0 Description: A SQL injection issue was discovered in the Client Management System via the Between Dates Reports parameter at the "/admin/bwdates-reports-ds.php" API endpoint. Recommendations: For Client...

PT-2024-33350 · Rsa · Archer Platform

Name of the Vulnerable Software and Affected Versions: Archer Platform versions 6.x before 2024.08 Description: A Reflected XSS issue was discovered in the Dashboard Listing Archer Platform UX page. This could allow a remote unauthenticated attacker to trick a victim application user into supplyi...

PT-2024-26426 · Unknown · Pandora Fms

Name of the Vulnerable Software and Affected Versions: Pandora FMS versions 700 through 777.3 Description: A post-authentication arbitrary file read issue exists within the server plugins section in the plugin edition feature. This allows for unauthorized access to files on the server...

CVE-2024-50063 bpf: Prevent tail call between progs attached to different hooks

In the Linux kernel, the following vulnerability has been resolved: bpf: Prevent tail call between progs attached to different hooks bpf progs can be attached to kernel functions, and the attached functions can take different parameters or return different return values. If prog attached to one...

CVE-2024-49974 NFSD: Limit the number of concurrent async COPY operations

In the Linux kernel, the following vulnerability has been resolved: NFSD: Limit the number of concurrent async COPY operations Nothing appears to limit the number of concurrent async COPY operations that clients can start. In addition, AFAICT each async COPY can copy an unlimited number of 4MB...

CVE-2024-49974 NFSD: Limit the number of concurrent async COPY operations

In the Linux kernel, the following vulnerability has been resolved: NFSD: Limit the number of concurrent async COPY operations Nothing appears to limit the number of concurrent async COPY operations that clients can start. In addition, AFAICT each async COPY can copy an unlimited number of 4MB...