PT-2024-29499

Name of the Vulnerable Software and Affected Versions CKAN versions prior to 2.10.5 CKAN versions prior to 2.11.0 Description CKAN is an open-source data management system for powering data hubs and data portals. If there were connection issues with the Solr server, the internal Solr URL...

PT-2024-30010 · Unknown · Mini-Inventory-And-Sales-Management-System

Name of the Vulnerable Software and Affected Versions: Mini Inventory and Sales Management System version commit 18aa3d Description: A cross-site scripting XSS issue in the /email/welcome.php component allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into t...

PT-2024-29932 · Mattermost · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost versions 9.8.x through 9.8.2 Mattermost versions 9.9.x through 9.9.1 Mattermost versions 9.5.x through 9.5.7 Mattermost versions 9.10.x through 9.10.0 Description: The issue arises from the failure to restrict input in the POST...

PT-2024-7833 · Esri · Esri Portal For Arcgis

Name of the Vulnerable Software and Affected Versions: Esri Portal for ArcGIS versions 10.8.1 through 11.1 Description: The issue is related to a reflected XSS vulnerability that may allow a remote, unauthenticated attacker to create a crafted link which, when clicked, could potentially execute...

GO-2023-1945 HashiCorp Consul Access Restriction Bypass in github.com/hashicorp/consul

HashiCorp Consul Access Restriction Bypass in github.com/hashicorp/consul...

PT-2024-30017 · Unknown · Hotel Management System

Name of the Vulnerable Software and Affected Versions: Hotel Management System version commit 91caab8 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the book id parameter at the "admin modify room.php" endpoint. There is no information...

PT-2024-38755 · Chillzhuang · Springblade

Name of the Vulnerable Software and Affected Versions: chillzhuang SpringBlade version 4.1.0 Description: A critical vulnerability has been found in the software, affecting an unknown function of the file "/api/blade-system/menu/list?updatexml". The manipulation leads to sql injection, and it is...

Rakuten Ichiba 安全漏洞

Rakuten Ichiba is an online shopping APP from Rakuten, a Japanese company. A security vulnerability exists in Rakuten Ichiba that stems from a failure to properly restrict access to features that use custom URL schemes, increasing the risk of users being subject to phishing attacks...

PT-2024-30563 · Lf Edge · Lf Edge Ekuiper

Name of the Vulnerable Software and Affected Versions: LF Edge eKuiper versions prior to 1.14.2 Description: A SQL Injection vulnerability exists in the sqlKvStore of LF Edge eKuiper, allowing the execution of malicious SQL queries via the Get method. This issue affects various handlers, includin...

CVE-2024-43345

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in PluginOps Landing Page Builder allows PHP Local File Inclusion.This issue affects Landing Page Builder: from n/a through 1.5.2.0...

PT-2024-38690 · Zzcms · Zzcms

Name of the Vulnerable Software and Affected Versions: ZZCMS version 2023 Description: A critical vulnerability was found in ZZCMS 2023, affecting unknown code in the file /I/list.php. The manipulation of the skin argument leads to path traversal. This issue can be exploited remotely. The exploit...

PT-2024-8634 · Moodle +2 · Moodle +2

Name of the Vulnerable Software and Affected Versions: Moodle versions prior to 4.4.2 Description: A flaw was found in Moodle where sensitive secrets and keys are not excluded from the export of site administration presets, potentially leading to unintentional leakage if shared with a third party...

PT-2024-30476 · Unknown · Wp Socio Wp Telegram Widget/Join Link

Name of the Vulnerable Software and Affected Versions: WP Socio WP Telegram Widget and Join Link versions 2.1.27 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS...

CVE-2024-7703 ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup <= 4.0.37 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SVG File Upload

The ARMember – Membership Plugin, Content Restriction, Member Levels, User Profile & User signup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 4.0.37 due to insufficient input sanitization and output escaping. This mak...

CVE-2024-42317 mm/huge_memory: avoid PMD-size page cache if needed

In the Linux kernel, the following vulnerability has been resolved: mm/hugememory: avoid PMD-size page cache if needed xarray can't support arbitrary page cache size. the largest and supported page cache size is defined as MAXPAGECACHEORDER by commit 099d90642a71 "mm/filemap: make MAXPAGECACHEORD...

Security Bulletin: The IBM QRadar SIEM Amazon Web Services protocol is vulnerable to access restriction bypass and sensitive information exposure (CVE-2020-8908, CVE-2023-2976)

Summary Google Guava is used by IBM QRadar SIEM Amazon Web Services protocol, and it has known vulnerabilities. The issues have been addressed in an update. Vulnerability Details CVEID:CVE-2020-8908 DESCRIPTION: Guava could allow a remote authenticated attacker to bypass security restrictions,...

PT-2024-30543 · Rengine · Rengine

Name of the Vulnerable Software and Affected Versions: reNgine versions 2.1.2 and prior Description: The issue occurs when scanning a domain, and if the target domain's DNS record contains an XSS payload, it leads to the execution of malicious scripts in the reNgine's dashboard view when any user...

PT-2024-30268 · Pluck Cms · Pluck Cms

Name of the Vulnerable Software and Affected Versions: Pluck CMS version 4.7.18 Description: The issue allows attackers to execute a brute force attack due to the lack of restriction on failed login attempts. Recommendations: For Pluck CMS version 4.7.18, consider implementing a custom restrictio...

PT-2024-9442 · Ipswitch · Whatsup Gold

Name of the Vulnerable Software and Affected Versions: WhatsUp Gold versions prior to 2024.0.0 Description: The issue is related to a SQL Injection vulnerability in WhatsUp Gold, which can be exploited by an unauthenticated attacker to retrieve a user's encrypted password. The vulnerability is...

PT-2024-7655 · Hashicorp +1 · Hashicorp Vault +2

Name of the Vulnerable Software and Affected Versions: JetBrains TeamCity versions prior to 2024.07.1 Description: The issue exists due to inadequate protection of the web page structure in the HashiCorp Vault plugin of the JetBrains TeamCity CI/CD system. Exploitation of this issue may allow a...