PT-2024-5666 · Tenda · Tenda I22

Name of the Vulnerable Software and Affected Versions: Tenda i22 version 1.0.0.34687 Description: A critical issue was found in the formApPortalPhoneAuth function of the /goform/apPortalPhoneAuth file. The manipulation of the data argument leads to a buffer overflow. This can be exploited remotel...

CVE-2024-40822

This issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 16.7.9 and iPadOS 16.7.9, iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, watchOS 10.6. An attacker with physical access to a device may be able to access contacts from the lock screen...

CVE-2024-40783

The issue was addressed with improved restriction of data container access. This issue is fixed in macOS Monterey 12.7.6, macOS Sonoma 14.6, macOS Ventura 13.6.8. A malicious application may be able to bypass Privacy preferences...

CVE-2024-40822

This issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 16.7.9 and iPadOS 16.7.9, iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, watchOS 10.6. An attacker with physical access to a device may be able to access contacts from the lock screen...

CVE-2024-40818

This issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 16.7.9 and iPadOS 16.7.9, iOS 17.6 and iPadOS 17.6, macOS Sonoma 14.6, macOS Ventura 13.6.8, watchOS 10.6. An attacker with physical access may be able to use Siri to access sensitive user data...

CVE-2024-27883

A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Monterey 12.7.6, macOS Sonoma 14.6, macOS Ventura 13.6.8. An app may be able to modify protected parts of the file system...

CVE-2023-42925

The issue was addressed with improved restriction of data container access. This issue is fixed in iOS 17 and iPadOS 17, macOS Sonoma 14. An app may be able to access Notes attachments...

CVE-2023-42925

The issue was addressed with improved restriction of data container access. This issue is fixed in iOS 17 and iPadOS 17, macOS Sonoma 14. An app may be able to access Notes attachments...

CVE-2023-42925

CVE-2023-42925 affects Apple platforms (iOS, iPadOS, macOS Sonoma) and concerns an app potentially accessing Notes attachments due to insufficient restriction of data container access. The issue is addressed in iOS 17, iPadOS 17, and macOS Sonoma 14. Connected sources confirm the vulnerability de...

Magento LTS vulnerable to stored Cross-site Scripting (XSS) in admin system configs

Impact This XSS vulnerability is about the system configs design/header/welcome design/header/logosrc design/header/logosrcsmall design/header/logoalt They are intended to enable admins to set a text in the two cases, and to define an image url for the other two cases. But because of previously...

PT-2024-27787 · Unknown · Lost/Found Information System

Name of the Vulnerable Software and Affected Versions: Lost and Found Information System version 1.0 Description: The issue allows a remote attacker to escalate privileges. This is achieved via the id parameter to the "php-lfis/admin/categories/view category.php" endpoint. Recommendations: For Lo...

PT-2024-29474 · Unknown · Neuq Board

Name of the Vulnerable Software and Affected Versions: NEUQ board version 1.0 Description: A Buffer Overflow issue in the password.h component allows a remote attacker to cause a denial of service. Recommendations: For NEUQ board version 1.0, consider restricting access to the password.h componen...

PT-2024-35467 · Unknown · Wp-Affiliate-Platform

Name of the Vulnerable Software and Affected Versions: wp-affiliate-platform versions prior to 6.5.2 Description: The issue concerns a lack of CSRF check when deleting affiliates, which could allow attackers to make a logged-in user change or delete them via a CSRF attack. Recommendations: For...

PT-2024-27789 · Unknown · Lost/Found Information System

Name of the Vulnerable Software and Affected Versions: Lost and Found Information System version 1.0 Description: A Cross Site Scripting issue allows a remote attacker to escalate privileges. The issue is exploited via the "page" parameter to the "/php-lfis/admin/index.php" API endpoint...

PT-2024-22576 · Italtel · Italtel I-Mcs Nfv

Name of the Vulnerable Software and Affected Versions: Italtel i-MCS NFV version 12.1.0-20211215 Description: An issue was discovered that allows stored Cross-site scripting XSS to occur via POST requests. This means an attacker can inject malicious scripts into the system, which can then be...

PT-2024-38127 · Unknown · Sourcecodester School Fees Payment System

Name of the Vulnerable Software and Affected Versions: SourceCodester School Fees Payment System version 1.0 Description: A critical issue affects the processing of the file /view payment.php, where the manipulation of the argument ef id leads to sql injection. The attack can be initiated remotel...

PT-2024-38131 · Unknown · Sourcecodester School Fees Payment System

Name of the Vulnerable Software and Affected Versions: SourceCodester School Fees Payment System version 1.0 Description: A problematic issue has been found in the system, affecting an unknown part of the file /ajax.php. This issue leads to cross-site request forgery and can be initiated remotely...

PT-2024-38118 · Totolink · Totolink A3700R

Name of the Vulnerable Software and Affected Versions: TOTOLINK A3700R version 9.1.2u.5822 B20200513 Description: A vulnerability was found in the apmib Configuration Handler component, specifically affecting some unknown functionality of the file /cgi-bin/ExportSettings.sh. This issue leads to...

PT-2024-37280 · WordPress · The Aiomatic

Name of the Vulnerable Software and Affected Versions: The AIomatic - Automatic AI Content Writer for WordPress versions up to, and including, 2.0.5 Description: The issue is due to insufficient limitations on the email recipient and the content in the aiomatic send email function, which are...

CVE-2024-35296

Invalid Accept-Encoding header can cause Apache Traffic Server to fail cache lookup and force forwarding requests. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.10, from 9.0.0 through 9.2.4. Users are recommended to upgrade to version 8.1.11 or 9.2.5, which fixes the issue...