CVE-2024-45098

IBM Aspera Faspex 5.0.0–5.0.9 contains a security bypass that can allow a user to bypass intended access restrictions and modify resources. The issue is addressed in Faspex 5.0.10. Affected product: IBM Aspera Faspex (versions 5.0.0–5.0.9). Root cause indicated: bypass of access controls leading ...

CVE-2024-8463

File upload restriction bypass vulnerability in PHPGurukul Job Portal 1.0, the exploitation of which could allow an authenticated user to execute an RCE via webshell...

CVE-2024-8462

Windmill 1.380.0 is affected by CVE-2024-8462 in the HTTP Request Handler (backend/windmill-api/src/users.rs), leading to improper restriction of excessive authentication attempts. The vulnerability is exploitable remotely with high attack complexity and low reported impact; upgrading to version ...

CVE-2024-8463 File upload restriction bypass vulnerability in Job Portal

File upload restriction bypass vulnerability in PHPGurukul Job Portal 1.0, the exploitation of which could allow an authenticated user to execute an RCE via webshell...

PT-2024-39039 · Unknown · Job Portal

Name of the Vulnerable Software and Affected Versions: Job Portal versions affected versions not specified Description: A Cross-Site Scripting XSS vulnerability is present, where user-controlled input is not sufficiently encrypted. This could allow an attacker to retrieve the session details of a...

PT-2024-37866 · WordPress · Wp Ulike

Name of the Vulnerable Software and Affected Versions: WP ULike versions prior to 4.7.2.1 Description: The issue arises from the WP ULike WordPress plugin's failure to properly sanitize user display names when rendering them on a public page. This can lead to potential security risks, including t...

PT-2024-30191 · Unknown · Esafenet Cdg

Name of the Vulnerable Software and Affected Versions: ESAFENET CDG versions 5.6 and earlier Description: A SQL Injection flaw exists in ESAFENET CDG, allowing an attacker to execute arbitrary code via the id parameter of the "data.jsp" page. Recommendations: For ESAFENET CDG versions 5.6 and...

CVE-2024-7923

An authentication bypass vulnerability has been identified in Pulpcore when deployed with Gunicorn versions prior to 22.0, due to the puppet-pulpcore configuration. This issue arises from Apache's modproxy not properly unsetting headers because of restrictions on underscores in HTTP headers,...

CVE-2024-7012

An authentication bypass vulnerability has been identified in Foreman when deployed with External Authentication, due to the puppet-foreman configuration. This issue arises from Apache's modproxy not properly unsetting headers because of restrictions on underscores in HTTP headers, allowing...

PT-2024-5903

Name of the Vulnerable Software and Affected Versions Veeam Backup & Replication versions prior to 12.2.0.334 Description Veeam Backup & Replication is affected by a critical deserialization of untrusted data vulnerability that allows for unauthenticated remote code execution RCE. This flaw,...

PT-2024-5912

Name of the Vulnerable Software and Affected Versions Aardvark-dns versions 1.12.0 through 1.12.1 Description A flaw was found in Aardvark-dns, which is vulnerable to a Denial of Service attack due to the serial processing of TCP DNS queries. An attacker can exploit this flaw by keeping a TCP...

PT-2024-6520 · D Link · D-Link Dns-320

Name of the Vulnerable Software and Affected Versions: D-Link DNS-320 version 2.02b01 Description: The issue is related to the disclosure of information in the /cgi-bin/discovery.cgi file of the Web Management Interface component in the D-Link DNS-320 router's firmware. This can be exploited...

PT-2025-11579

Name of the Vulnerable Software and Affected Versions libbson versions prior to 1.27.5 MongoDB Server v8.0 versions prior to 8.0.1 MongoDB Server v7.0 versions prior to 7.0.16 Description The various bson append functions in the MongoDB C driver library may be susceptible to buffer overflow when...

PT-2024-26063 · Dressroom · Dressroom

Name of the Vulnerable Software and Affected Versions: Dressroom versions prior to SMR Sep-2024 Release 1 Description: The issue is related to improper access control in item selection, allowing local attackers to access protected data. User interaction is required to trigger this issue. There is...

PT-2024-38580 · WordPress · Sensei Lms

Name of the Vulnerable Software and Affected Versions: The Sensei LMS WordPress plugin versions prior to 4.24.2 Description: The issue concerns the Sensei LMS WordPress plugin, where some of its REST API routes are not properly protected, allowing unauthenticated attackers to leak email templates...

AlmaLinux 9 : nodejs:18 (ALSA-2024:6147)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2024:6147 advisory. node-tar: denial of service while parsing a tar file due to lack of folders depth validation CVE-2024-28863 nodejs: Bypass network import restriction via...

ALSA-2024:6148 Moderate: nodejs:18 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fixes: node-tar: denial of service while parsing a tar file due to lack of folders depth validation CVE-2024-28863 nodejs: Bypass network import...

PT-2024-30245 · Mcms · Mcms

Name of the Vulnerable Software and Affected Versions: MCMS version 5.4.1 Description: The issue is related to a front-end file upload vulnerability in MCMS, which can lead to remote command execution. This allows an attacker to execute commands remotely. Recommendations: For MCMS version 5.4.1,...

Ubuntu 24.04 LTS : Dovecot vulnerabilities (USN-6982-1)

The remote Ubuntu 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6982-1 advisory. It was discovered that Dovecot did not not properly have restrictions on ithe size of address headers. A remote attacker could possibly use this issue to...

PT-2024-18172 · Nt Ware +1 · Uniflow Online +1

Name of the Vulnerable Software and Affected Versions: uniFLOW Online versions prior to and including 2024.1.0 Description: The registration process of uniFLOW Online apps can be compromised when email login is enabled on the tenant, particularly for those utilizing email login in combination wit...