PT-2024-39416

Name of the Vulnerable Software and Affected Versions SourceCodester Online Eyewear Shop version 1.0 Description A critical issue affects some unknown functionality of the file /Users.phpf=save of the component User Creation Handler. The manipulation of the type argument with the input 1 leads to...

PT-2024-39412 · Unknown · Code-Projects Student Record System

Name of the Vulnerable Software and Affected Versions: code-projects Student Record System version 1.0 Description: A critical issue has been found in the code-projects Student Record System, affecting unknown code in the file /course.php. The manipulation of the coursename argument leads to SQL...

CVE-2024-8853

Vulnerability summary (CVE-2024-8853) The Webo-facto plugin for WordPress is affected in versions up to and including 1.40. The root cause is an insufficient restriction on the doSsoAuthentification function, enabling unauthenticated attackers to escalate privileges by registering with a username...

WordPress plugin Webo-facto 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

PT-2024-29883 · Galaxy · Galaxy

Name of the Vulnerable Software and Affected Versions: Galaxy versions prior to the latest patched version Description: The issue concerns the editor visualization, specifically the "/visualizations" endpoint, which can be used to store HTML tags and trigger javascript execution upon an edit...

PT-2024-31774

Name of the Vulnerable Software and Affected Versions: Confidant versions prior to 6.6.2 Description: The issue is a cross-site scripting XSS vulnerability that affects various API endpoints in Confidant, an open-source secret management service. These endpoints include GET /v1/credentials, GET...

VulnCheck KEV: CVE-2017-11511

The ManageEngine ServiceDesk 9.3.9328 is vulnerable to arbitrary file downloads due to improper restrictions of the pathname used in the filepath parameter for the download-file URL. An unauthenticated remote attacker can use this vulnerability to download arbitrary files...

CVE-2022-25769

ImpactThe default .htaccess file has some restrictions in the access to PHP files to only allow specific PHP files to be executed in the root of the application. This logic isn't correct, as the regex in the second FilesMatch only checks the filename, not the full path...

CVE-2022-25769 Improper regex in htaccess file

ImpactThe default .htaccess file has some restrictions in the access to PHP files to only allow specific PHP files to be executed in the root of the application. This logic isn't correct, as the regex in the second FilesMatch only checks the filename, not the full path...

CVE-2022-25769 Improper regex in htaccess file

ImpactThe default .htaccess file has some restrictions in the access to PHP files to only allow specific PHP files to be executed in the root of the application. This logic isn't correct, as the regex in the second FilesMatch only checks the filename, not the full path...

PT-2024-31906 · Frog Cms · Frog Cms

Name of the Vulnerable Software and Affected Versions: FrogCMS version 0.9.5 Description: A Cross-Site Request Forgery CSRF issue was discovered. The issue can be exploited via the /admin/?/plugin/file manager/delete/123 API endpoint. Recommendations: For FrogCMS version 0.9.5, as a temporary...

PT-2024-32054 · Draytek · Draytek Vigor 3910

Name of the Vulnerable Software and Affected Versions: Draytek Vigor 3910 version 4.3.2.6 Description: A buffer overflow issue was discovered in the extRadSrv2 parameter at the "cgiapp.cgi" endpoint. This issue allows attackers to cause a Denial of Service DoS via a crafted input. Recommendations...

PT-2024-32056 · Draytek · Draytek Vigor 3910

Name of the Vulnerable Software and Affected Versions: Draytek Vigor 3910 version 4.3.2.6 Description: A buffer overflow was discovered in the sProfileName parameter at the "usergrp.cgi" endpoint. This issue allows attackers to cause a Denial of Service DoS via a crafted input. Recommendations: F...

PT-2024-32300 · Runofast · Runofast Indoor Security Camera For Baby Monitor

Name of the Vulnerable Software and Affected Versions: runofast Indoor Security Camera for Baby Monitor affected versions not specified Description: The issue concerns a default password set as password for the root account, allowing unauthorized access to the "/stream1" URI via the rtsp://...

CVE-2024-45811

Vite a frontend build tooling framework for javascript. In affected versions the contents of arbitrary files can be returned to the browser. @fs denies access to files outside of Vite serving allow list. Adding ?import&raw to the URL bypasses this limitation and returns the file content if it...

nodejs:18 security update

An update is available for module.nodejs-nodemon, nodejs-packaging, module.nodejs-packaging, nodejs-nodemon. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list...

RLSA-2024:6147 Moderate: nodejs:18 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fixes: node-tar: denial of service while parsing a tar file due to lack of folders depth validation CVE-2024-28863 nodejs: Bypass network import...

RLSA-2024:6148 Moderate: nodejs:18 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fixes: node-tar: denial of service while parsing a tar file due to lack of folders depth validation CVE-2024-28863 nodejs: Bypass network import...

PT-2024-30840 · Elementor · The Plus Addons For Elementor Page Builder

Name of the Vulnerable Software and Affected Versions: The Plus Addons for Elementor Page Builder Lite versions n/a through 5.6.2 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS...

PT-2024-29928 · Unknown · Welcart E-Commerce

Name of the Vulnerable Software and Affected Versions: Welcart e-Commerce versions prior to 2.11.2 Description: The issue allows an attacker who can login to the product to obtain or alter the information stored in the database. This is achieved through a SQL injection vulnerability...