The vulnerability of the Ivanti Cloud Services Appliance’s network interface, related to incorrect path name restrictions for the restricted access catalog, allows a hacker to execute arbitrary code.

The vulnerability of the Ivanti Cloud Services Appliance relates to an incorrect restriction on the path name to the restricted-access catalog. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

PT-2024-39600 · WordPress · Wp Blocks Hub

Name of the Vulnerable Software and Affected Versions: WP Blocks Hub plugin for WordPress versions up to, and including, 1.0.2 Description: The issue is related to Stored Cross-Site Scripting via SVG File uploads due to insufficient input sanitization and output escaping. This allows authenticate...

The vulnerability of the command-line interface of ArubaOS systems allows a hacker to execute arbitrary code.

The vulnerability of the command-line interface of ArubaOS systems is related to incorrect restrictions on the path name to the restricted-access directory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

Jenkins item creation restriction bypass vulnerability

Jenkins provides APIs for fine-grained control of item creation: - Authorization strategies can prohibit the creation of items of a given type in a given item group ACLhasCreatePermission2. - Item types can prohibit creation of new instances in a given item group...

CVE-2024-47804

A flaw was found in Jenkins. When attempting to create an item prohibited by ACLhasCreatePermission2 or TopLevelItemDescriptorisApplicableInItemGroup through the Jenkins CLI or the REST API, if either of these checks fail, Jenkins creates the item in memory and only deletes it from disk. This may...

PT-2024-37565 · Opentext · Opentext Vertica

Name of the Vulnerable Software and Affected Versions: OpenText Vertica versions 10.0 through 10.X OpenText Vertica versions 11.0 through 11.X OpenText Vertica versions 12.0 through 12.X OpenText Vertica versions 23.0 through 23.X OpenText Vertica versions 24.0 through 24.X Description: The issue...

PT-2024-7434 · Draytek · Draytek Vigor310

Name of the Vulnerable Software and Affected Versions: DrayTek Vigor310 versions through 4.3.2.6 Description: The issue is related to a buffer overflow vulnerability in the web interface of DrayTek Vigor routers, caused by improper handling of input data. This can be exploited by a remote attacke...

PT-2024-6594 · Draytek · Draytek Vigor 3910

Name of the Vulnerable Software and Affected Versions: DrayTek Vigor3910 devices through 4.3.2.6 Description: The issue is a stack-based overflow when processing query string parameters because GetCGI mishandles extraneous ampersand characters and long key-value pairs. This can be exploited by...

PT-2024-31857 · October · October

Name of the Vulnerable Software and Affected Versions: October versions 3.6.30 Description: The issue allows an authenticated admin account to upload a PDF file containing malicious JavaScript into the target system. If the file is accessed through the website, it could lead to a Cross-Site...

PT-2024-31856 · Zenario · Zenario

Name of the Vulnerable Software and Affected Versions: Zenario version 9.7.61188 Description: The issue allows authenticated admin users to upload PDF files containing malicious code into the target system. If the PDF file is accessed through the website, it can trigger a Cross Site Scripting XSS...

DEBIAN-CVE-2024-9393

An attacker could, via a specially crafted multipart response, execute arbitrary JavaScript under the resource://pdf.js origin. This could allow them to access cross-origin PDF content. This access is limited to "same site" documents by the Site Isolation feature on desktop clients, but full...

PT-2024-7961 · Librenms · Librenms

Name of the Vulnerable Software and Affected Versions: LibreNMS versions prior to 24.9.0 Description: A Stored Cross-Site Scripting XSS vulnerability in the "Device Dependencies" feature allows authenticated users to inject arbitrary JavaScript through the hostname parameter. This can lead to the...

PT-2024-7952

Name of the Vulnerable Software and Affected Versions Docker affected versions not specified Podman affected versions not specified Buildah affected versions not specified Description A vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction, where the system...

VulnCheck KEV: CVE-2024-9265

The Echo RSS Feed Post Generator plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 5.4.6. This is due to the plugin not properly restricting the roles that can set during registration through the echocheckpostheadersent function. This makes...

PT-2024-31860 · Pagekit · Pagekit

Name of the Vulnerable Software and Affected Versions: Pagekit version 1.0.18 Description: The issue is related to Cross Site Scripting XSS in the "index.php/admin/site/widget" endpoint. This means an attacker could potentially inject malicious scripts into the website, affecting users who visit...

PT-2024-24233 · Flatpress · Flatpress

Name of the Vulnerable Software and Affected Versions: Flatpress version 1.3 Description: The issue allows a remote attacker to execute arbitrary code via a crafted payload to the file name parameter. This enables the attacker to perform Cross Site Scripting attacks. Recommendations: For Flatpres...

Pluck 安全漏洞

Pluck is a small and simple content management system written in PHP by Pluck CMS Open Source. A security vulnerability exists in Pluck version 4.7.18, which stems from an incorrect path restriction to a restricted directory that could allow an unauthenticated attacker to extract sensitive...

RestrictedPython information leakage via `AttributeError.obj` and the `string` module

Impact A user can gain access to protected and potentially sensible information indirectly via AttributeError.obj and the string module. Patches The problem will be fixed in version 7.3. Workarounds If the application does not require access to the module string, it can remove it from...

tigervnc bug fix update

An update is available for tigervnc. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Virtual Network Computing VNC is a remote display system which allows users ...

SNMP service is enabled by default in Sharp NEC Display Solutions projectors

Overview Multiple projectors provided by Sharp NEC Display Solutions, Ltd. are configured with SNMP service enabled by default, therefore can be accessed by specifying SNMP community name "public" CWE-1242 ,CVE-2024-7011. SNMP service configuration enable/disable cannot be changed on the manageme...