PT-2024-9623 · Gstreamer +10 · Gstreamer +10

Name of the Vulnerable Software and Affected Versions: GStreamer versions prior to 1.24.10 Description: An out-of-bounds write issue was identified in the convert to s334 1a function in isomp4/qtdemux.c. This issue arises due to a discrepancy between the size of memory allocated to the storage...

PT-2024-39268 · WordPress · Bulk Noindex & Nofollow Toolkit

Name of the Vulnerable Software and Affected Versions: The Bulk NoIndex & NoFollow Toolkit plugin for WordPress versions up to, and including, 2.15 Description: The issue is related to Reflected Cross-Site Scripting due to the use of remove query arg without appropriate escaping on the URL. This...

CVE-2024-38266

An improper restriction of operations within the bounds of a memory buffer in the parameter type parser of the Zyxel VMG8825-T50K firmware versions through 5.50ABOM.8C0 could allow an authenticated attacker with administrator privileges to cause potential memory corruptions, resulting in a thread...

CVE-2024-38268

An improper restriction of operations within the bounds of a memory buffer in the MAC address parser of the Zyxel VMG8825-T50K firmware versions through 5.50ABOM.8C0 could allow an authenticated attacker with administrator privileges to cause potential memory corruptions, resulting in a thread...

CVE-2024-38267

An improper restriction of operations within the bounds of a memory buffer in the IPv6 address parser of the Zyxel VMG8825-T50K firmware versions through 5.50ABOM.8C0 could allow an authenticated attacker with administrator privileges to cause potential memory corruptions, resulting in a thread...

CVE-2024-38266

An improper restriction of operations within the bounds of a memory buffer in the parameter type parser of the Zyxel VMG8825-T50K firmware versions through 5.50ABOM.8C0 could allow an authenticated attacker with administrator privileges to cause potential memory corruptions, resulting in a thread...

CVE-2024-38266

An improper restriction of operations within the bounds of a memory buffer in the parameter type parser of the Zyxel VMG8825-T50K firmware versions through 5.50ABOM.8C0 could allow an authenticated attacker with administrator privileges to cause potential memory corruptions, resulting in a thread...

PT-2024-39218 · WordPress · Beam Me Up Scotty – Back To Top Button

Name of the Vulnerable Software and Affected Versions: Beam me up Scotty – Back to Top Button plugin for WordPress versions up to, and including, 1.0.21 Description: The issue is related to Reflected Cross-Site Scripting due to the use of add query arg without proper escaping on the URL. This...

PT-2024-7541 · Unknown · Workstation

Name of the Vulnerable Software and Affected Versions: WorkstationST affected versions not specified Description: The issue is related to incorrect restriction of the directory path name in the OPC server. Exploitation of this issue may allow a remote attacker to gain access to the server...

PT-2024-39403 · WordPress · The Oneelements – Best Elementor Addons

Name of the Vulnerable Software and Affected Versions: The OneElements – Best Elementor Addons plugin for WordPress versions up to, and including, 1.3.7 Description: The issue is related to Stored Cross-Site Scripting via SVG File uploads due to insufficient input sanitization and output escaping...

PT-2024-39160 · WordPress · Koko Analytics

Name of the Vulnerable Software and Affected Versions: Koko Analytics plugin for WordPress versions prior to 1.3.13 Description: The issue arises from the use of add query arg without proper escaping on the URL, allowing unauthenticated attackers to inject arbitrary web scripts in pages. This can...

PT-2024-32329 · Dataease · Dataease

Name of the Vulnerable Software and Affected Versions: DataEase versions prior to 2.10.1 Description: The issue allows an attacker to achieve remote command execution by adding a carefully constructed h2 data source connection string. This can be done by sending a POST request to the...

PT-2024-9227 · 2N · 2N Access Commander

Name of the Vulnerable Software and Affected Versions: 2N Access Commander versions 3.1.1.2 and prior Description: The issue is related to incorrect restriction of a directory path with limited access. Exploitation of this issue may allow a remote attacker to execute arbitrary code. This can be...

PT-2024-38900 · WordPress · The Radio Player – Live Shoutcast

Name of the Vulnerable Software and Affected Versions: The Radio Player – Live Shoutcast, Icecast and Any Audio Stream Player for WordPress plugin versions up to, and including, 2.0.78 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and outp...

The vulnerability of the functional web frameworks WebMvc.fn and WebFlux.fn of the Spring Framework arises from incorrect path name restrictions for restricted directories. This allows attackers to gain access to any file in the file system.

The vulnerability of the functional web frameworks WebMvc.fn and WebFlux.fn of the Spring Framework is related to an incorrect restriction on the path name to the restricted directory. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain access to any file in t...

PT-2024-32086 · Helpdesk · Helpdesk

Name of the Vulnerable Software and Affected Versions: HelpDeskZ version 2.0.2 Description: A cross-site scripting XSS vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name text field of Custom Fields message box. This issue potential...

PT-2024-32298 · Mellium · Mellium.Im/Xmpp

Name of the Vulnerable Software and Affected Versions: Mellium mellium.im/xmpp versions 0.0.1 through 0.21.4 Description: The issue allows response spoofing because the stanza type is not checked. This can lead to potential system compromise. The estimated number of potentially affected devices...

PT-2024-31671 · Zimbra · Zimbra Collaboration +2

Name of the Vulnerable Software and Affected Versions: Zimbra Collaboration ZCS versions through 10.0 Description: A stored Cross-Site Scripting XSS attack is possible due to improper sanitization of user input in Zimbra Webmail Modern UI. This allows an attacker to inject malicious code into...

ROS-20240923-02

Vulnerability of ANGLE library in Mozilla Firefox, Firefox ESR and Thunderbird email client browsers is related to writing beyond buffer boundaries. Exploitation of the vulnerability could allow an attacker acting remotely to cause a denial of service. remotely to cause a denial of service...

PT-2024-39416

Name of the Vulnerable Software and Affected Versions SourceCodester Online Eyewear Shop version 1.0 Description A critical issue affects some unknown functionality of the file /Users.phpf=save of the component User Creation Handler. The manipulation of the type argument with the input 1 leads to...