PT-2024-29474 · Unknown · Neuq Board

Name of the Vulnerable Software and Affected Versions: NEUQ board version 1.0 Description: A Buffer Overflow issue in the password.h component allows a remote attacker to cause a denial of service. Recommendations: For NEUQ board version 1.0, consider restricting access to the password.h componen...

PT-2024-27789 · Unknown · Lost/Found Information System

Name of the Vulnerable Software and Affected Versions: Lost and Found Information System version 1.0 Description: A Cross Site Scripting issue allows a remote attacker to escalate privileges. The issue is exploited via the "page" parameter to the "/php-lfis/admin/index.php" API endpoint...

PT-2024-22576 · Italtel · Italtel I-Mcs Nfv

Name of the Vulnerable Software and Affected Versions: Italtel i-MCS NFV version 12.1.0-20211215 Description: An issue was discovered that allows stored Cross-site scripting XSS to occur via POST requests. This means an attacker can inject malicious scripts into the system, which can then be...

PT-2024-38127 · Unknown · Sourcecodester School Fees Payment System

Name of the Vulnerable Software and Affected Versions: SourceCodester School Fees Payment System version 1.0 Description: A critical issue affects the processing of the file /view payment.php, where the manipulation of the argument ef id leads to sql injection. The attack can be initiated remotel...

PT-2024-38131 · Unknown · Sourcecodester School Fees Payment System

Name of the Vulnerable Software and Affected Versions: SourceCodester School Fees Payment System version 1.0 Description: A problematic issue has been found in the system, affecting an unknown part of the file /ajax.php. This issue leads to cross-site request forgery and can be initiated remotely...

PT-2024-38118 · Totolink · Totolink A3700R

Name of the Vulnerable Software and Affected Versions: TOTOLINK A3700R version 9.1.2u.5822 B20200513 Description: A vulnerability was found in the apmib Configuration Handler component, specifically affecting some unknown functionality of the file /cgi-bin/ExportSettings.sh. This issue leads to...

PT-2024-37280 · WordPress · The Aiomatic

Name of the Vulnerable Software and Affected Versions: The AIomatic - Automatic AI Content Writer for WordPress versions up to, and including, 2.0.5 Description: The issue is due to insufficient limitations on the email recipient and the content in the aiomatic send email function, which are...

CVE-2024-35296

Invalid Accept-Encoding header can cause Apache Traffic Server to fail cache lookup and force forwarding requests. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.10, from 9.0.0 through 9.2.4. Users are recommended to upgrade to version 8.1.11 or 9.2.5, which fixes the issue...

PT-2024-5308 · Phpipam · Phpipam

Name of the Vulnerable Software and Affected Versions: phpipam version 1.6 Description: The issue is related to a lack of protection for the web page structure in the phpipam web application for IP address management. This can be exploited by a remote attacker to conduct a cross-site scripting XS...

PT-2024-5307 · Phpipam · Phpipam

Name of the Vulnerable Software and Affected Versions: phpipam version 1.6 Description: The issue is related to a Cross Site Scripting XSS vulnerability. It affects the appadminfirewall-zoneszones-edit-network.php script in the phpipam web application for IP address management. The vulnerability...

GHSA-4MH8-9689-38VR snapd failed to restrict writes to the $HOME/bin path

In snapd versions prior to 2.62, when using AppArmor for enforcement of sandbox permissions, snapd failed to restrict writes to the $HOME/bin path. In Ubuntu, when this path exists, it is automatically added to the users PATH. An attacker who could convince a user to install a malicious snap whic...

PT-2024-26898 · Kubepi · Kubepi

Name of the Vulnerable Software and Affected Versions: KubePi versions 1.6.3 through 1.7.x Description: The issue is related to a defect in the KubePi JWT token verification. The JWT key in the default configuration file is empty. Although a random 32-bit string is generated to overwrite the key...

PT-2024-7036 · Spring · Spring Cloud Data Flow

Name of the Vulnerable Software and Affected Versions: Spring Cloud Data Flow versions prior to 2.11.4 Description: A malicious user who has access to the Skipper server API can use a crafted upload request to write an arbitrary file to any location on the file system, which could lead to...

The vulnerability of the Project File Handler component in the configuration and programming environment of EcoStruxure Foxboro SCADA Fox RTU Station allows a perpetrator to execute arbitrary code.

The vulnerability of the Project File Handler component in the configuration and programming environment of EcoStruxure Foxboro SCADA Fox RTU Station is related to an incorrect limitation on the path name to the restricted-access directory. Exploiting this vulnerability could allow a attacker to...

PT-2024-25959 · Unknown · Connectedhomeip Sdk

Name of the Vulnerable Software and Affected Versions: connectedhomeip SDK version 1.2 Description: The issue is related to an implementation problem in the Connectivity Standards Alliance Matter 1.2 protocol. This allows a third party to disclose information about devices that are part of the sa...

PT-2024-24589 · WordPress · Litespeed Cache

Name of the Vulnerable Software and Affected Versions: LiteSpeed Cache plugin for WordPress versions up to, and including, 6.2.0.1 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation. This allows unauthenticated attackers to update the toke...

PT-2025-2397 · Ibm · Ibm Security Directory Integrator +1

Name of the Vulnerable Software and Affected Versions: IBM Security Directory Integrator version 7.2.0 IBM Security Verify Directory Integrator version 10.0.0 Description: The issue could disclose sensitive information about directory contents, potentially aiding in further attacks against the...

PT-2024-10283 · Veritas · Veritas Enterprise Vault

Name of the Vulnerable Software and Affected Versions: Veritas Enterprise Vault versions prior to 15.2 Description: The issue allows remote attackers to execute arbitrary code because untrusted data, received on a .NET Remoting TCP port, is deserialized. This is due to shortcomings in the...

CVE-2024-38176

CVE-2024-38176 affects Microsoft GroupMe. The issue is an improper restriction of excessive authentication attempts that allows an unauthenticated, network-based attacker to achieve elevation of privileges. The description and connected sources confirm a privilege-escalation impact with high seve...

The vulnerability of the rspamd_maps() function in the Docker-based email server deployment and management tool, mailcow:dockerized, allows a attacker to execute arbitrary code.

The vulnerability of the rspamdmaps function in the Docker-based email server deployment and management tool, mailcow:dockerized, is related to an incorrect restriction on the path to the restricted directory. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code...