PT-2024-29928 · Unknown · Welcart E-Commerce

Name of the Vulnerable Software and Affected Versions: Welcart e-Commerce versions prior to 2.11.2 Description: The issue allows an attacker who can login to the product to obtain or alter the information stored in the database. This is achieved through a SQL injection vulnerability...

PT-2024-31905 · Frog Cms · Frog Cms

Name of the Vulnerable Software and Affected Versions: FrogCMS version 0.9.5 Description: A Cross-Site Request Forgery CSRF issue was discovered in FrogCMS, allowing unauthorized actions via the "/admin/?/plugin/file manager/rename" API endpoint. This could potentially lead to unauthorized file...

PT-2024-30874

Name of the Vulnerable Software and Affected Versions WCFM Marketplace versions 3.6.10 and earlier Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Reflected XSS. Recommendations For versions...

PT-2024-30849 · Magepeople · Magepeople Team Bus Ticket Booking With Seat Reservation

Name of the Vulnerable Software and Affected Versions: MagePeople Team Bus Ticket Booking with Seat Reservation versions through 5.3.5 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored X...

PT-2024-30851 · Unknown · Wayneconnor Sliding Door

Name of the Vulnerable Software and Affected Versions: wayneconnor Sliding Door versions n/a through 3.6 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS attacks. Recommendations: F...

CVE-2024-40852

This issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 18 and iPadOS 18. An attacker may be able to see recent photos without authentication in Assistive Access...

CVE-2024-7098 XML Injection in SFS Consulting's ww.Winsure

Improper Restriction of XML External Entity Reference vulnerability in SFS Consulting ww.Winsure allows XML Injection. This issue affects ww.Winsure: before 4.6.2...

CVE-2024-7098

CVE-2024-7098 corresponds to an Improper Restriction of XML External Entity Reference in SFS Consulting WW.Winsure prior to version 4.6.2, enabling XML Injection. Multiple connected sources (NVD, Red Hat, CVE list) confirm affected product and root cause. Impact is rated critical (high confidenti...

Rocky Linux 9 : nodejs:18 (RLSA-2024:6147)

The remote Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:6147 advisory. node-tar: denial of service while parsing a tar file due to lack of folders depth validation CVE-2024-28863 nodejs: Bypass network import restriction vi...

PT-2024-28668 · Mattermost · Mattermost Desktop App

Name of the Vulnerable Software and Affected Versions: Mattermost Desktop App versions =5.8.0 Description: The issue concerns a flaw in the screen capture functionality of the Mattermost Desktop App, allowing an attacker to silently capture high-quality screenshots via JavaScript APIs...

Rocky Linux 8 : nodejs:18 (RLSA-2024:6148)

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2024:6148 advisory. node-tar: denial of service while parsing a tar file due to lack of folders depth validation CVE-2024-28863 nodejs: Bypass network import restriction vi...

PT-2024-30997 · Apple · Xcode +1

Name of the Vulnerable Software and Affected Versions: Xcode versions prior to 16 Description: A malicious application may gain access to a user's Keychain items. This issue was addressed by enabling hardened runtime. Recommendations: For versions prior to 16, update to Xcode 16 to resolve the...

PT-2024-39246 · Syscom · Omflow

Name of the Vulnerable Software and Affected Versions: OMFLOW from The SYSCOM Group affected versions not specified Description: The issue is related to the data query functionality in OMFLOW, which does not properly restrict the query range. This allows remote attackers with regular privileges t...

PT-2024-36778 · WordPress · Avada

Name of the Vulnerable Software and Affected Versions: Avada | Website Builder For WordPress & eCommerce plugin for WordPress versions up to, and including, 3.11.9 Description: The issue is related to Stored Cross-Site Scripting via the plugin's fusion button shortcode due to insufficient input...

PT-2024-20853 · Unknown · Mirapolis Lms

Name of the Vulnerable Software and Affected Versions: Mirapolis LMS version 4.6.XX Description: An issue in Mirapolis LMS allows authenticated users to exploit an Insecure Direct Object Reference IDOR vulnerability by manipulating the ID parameter and increment STEP parameter, leading to the...

CVE-2024-45014 s390/boot: Avoid possible physmem_info segment corruption

In the Linux kernel, the following vulnerability has been resolved: s390/boot: Avoid possible physmeminfo segment corruption When physical memory for the kernel image is allocated it does not consider extra memory required for offsetting the image start to match it with the lower 20 bits of KASLR...

PT-2024-39189 · Sourcecodester · Sourcecodester Best House Rental Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Best House Rental Management System version 1.0 Description: A critical vulnerability has been found in the system. The issue affects the function delete user/save user of the file /admin class.php. The manipulation of the...

PT-2024-20860 · Unknown · 3Dsecure 2.0

Name of the Vulnerable Software and Affected Versions: 3DSecure 2.0 versions 3 and earlier Description: The issue allows form action hijacking via the threeDsMethod.jsp endpoint with the threeDSMethodData parameter or the threeDSMethodNotificationURL parameter. This enables modification of the...

PT-2024-6146 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 8.14 through 17.1.7 GitLab CE/EE versions 17.2 through 17.2.5 GitLab CE/EE versions 17.3 through 17.3.2 Description: An issue was discovered in GitLab CE/EE that allows an attacker to trigger a pipeline as an arbitrary...

CVE-2024-21753

A improper limitation of a pathname to a restricted directory 'path traversal' in Fortinet FortiClientEMS versions 7.2.0 through 7.2.4, 7.0.0 through 7.0.13, 6.4.0 through 6.4.9, 6.2.0 through 6.2.9, 6.0.0 through 6.0.8, 1.2.1 through 1.2.5 allows attacker to perform a denial of service, read or...