PT-2024-3325

Name of the Vulnerable Software and Affected Versions DHCP affected versions not specified Description The issue is related to a lack of authentication in the DHCP protocol, specifically with the classless static route option 121. This allows an attacker to manipulate routes and potentially...

The vulnerability of the microprogramming software for Mitel series 6800, 6900, 6900w, and 6970 lies in the improper limitation of the path name to the restricted access catalog, allowing unauthorized access to protected information.

The vulnerability of the microprogramming software for Mitel series 6800, 6900, 6900w, and 6970 is related to incorrect restrictions on the path to the restricted catalog. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information by sending a special...

Gradio's Component Server does not properly consider` _is_server_fn` for functions

Component Server in Gradio before 4.13 does not properly consider isserverfn for functions...

PT-2024-4657

Name of the Vulnerable Software and Affected Versions Ollama versions prior to 0.1.34 Description Ollama has a flaw due to insufficient input validation, leading to a path traversal issue. This allows an attacker to overwrite arbitrary files on the server, potentially leading to remote code...

CVE-2023-51600

Honeywell Saia PG5 Controls Suite XML External Entity Processing Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Honeywell Saia PG5 Controls Suite. User interaction is required to exploit this...

CVE-2023-44452

CVE-2023-44452 affects Linux Mint Xreader (and related Atril/Xreader components) via CBT file parsing. The root cause is insufficient validation when handling user-supplied strings used in system calls during CBT extraction, enabling arbitrary code execution in the context of the current user aft...

CVE-2023-40507

The provided sources confirm a concrete vulnerability in LG Simple Editor: an XML External Entity (XXE) handling flaw in the copyContent command. A crafted document with a URI causes the XML parser to fetch the URI and embed its contents back into the XML, allowing a remote attacker to disclose i...

PT-2024-25859 · Savsoft · Savsoft Quiz

Name of the Vulnerable Software and Affected Versions: Savsoft Quiz version 6.0 Description: The issue allows stored XSS via the quiz name parameter in the "index.php/quiz/insert quiz/" endpoint. This enables potential attackers to inject malicious scripts into the application. Recommendations: F...

CVE-2024-0615 Content Control <= 2.1.0 - Missing Authorization to Sensitive Information Exposure

The Content Control – The Ultimate Content Restriction Plugin! Restrict Content, Create Conditional Blocks & More plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.0 via the API. This makes it possible for unauthenticated attackers to...

PT-2024-25195 · Sourcecodester · Sourcecodester Computer Laboratory Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Laboratory Management System version 1.0 Description: The issue is related to Cross Site Scripting XSS via the Middle Name parameter in the Create User function. This allows for potential malicious script injection...

PT-2024-25242 · WordPress · Phlox

Name of the Vulnerable Software and Affected Versions: Shortcodes and extra features for Phlox theme plugin for WordPress versions up to, and including, 2.15.5 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'aux gmaps' shortcode due to insufficient input...

PT-2024-28760 · WordPress · Essential Addons For Elementor

Name of the Vulnerable Software and Affected Versions: The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress versions up to, and including, 5.9.15 Description: The issue is related to Stored Cross-Site Scripting via the eael team...

The vulnerability of the threat detection mechanism for Microsoft Defender for IoT involves an incorrect restriction on the path name to the restricted catalog, allowing attackers to execute arbitrary code.

The vulnerability of the Microsoft Defender for IoT threat detection mechanism is related to an incorrect restriction on the path name to the restricted catalog. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

PT-2024-26508 · WordPress · Wordpress Backup & Migration

Name of the Vulnerable Software and Affected Versions: WordPress Backup & Migration plugin versions up to, and including, 1.4.8 Description: The issue allows authenticated attackers with subscriber access or above to access log files maintained by the plugin due to a missing capability check on t...

PT-2024-25544 · Weblizar · Weblizar School Management Pro

Name of the Vulnerable Software and Affected Versions: Weblizar School Management Pro versions through 10.3.4 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for potential exploitation...

CVE-2024-27045 drm/amd/display: Fix a potential buffer overflow in 'dp_dsc_clock_en_read()'

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix a potential buffer overflow in 'dpdscclockenread' Tell snprintf to store at most 10 bytes in the output buffer instead of 30. Fixes the below:...

PT-2024-25194 · Sourcecodester · Sourcecodester Product Show Room

Name of the Vulnerable Software and Affected Versions: SourceCodester Product Show Room version 1.0 Description: The issue is related to Cross Site Scripting XSS via the Last Name field under Add Users. This allows for potential malicious script injection. No information is provided about the...

PT-2024-26167 · WordPress · Side Menu Lite

Name of the Vulnerable Software and Affected Versions: The Side Menu Lite WordPress plugin versions prior to 4.2.1 Description: The issue is related to the lack of CSRF checks in some bulk actions, which could allow attackers to make logged-in admins perform unwanted actions, such as deleting...

PT-2024-20956 · Unknown · Shixcam A9 Camera

Name of the Vulnerable Software and Affected Versions: SHIXCAM A9 Camera version v.CYCAM 48B BC01 v87 0903 Description: An issue in the SHIXCAM A9 Camera firmware allows a remote attacker to obtain sensitive information via a crafted request to a UDP port. Recommendations: For version v.CYCAM 48B...

PT-2024-3514

Name of the Vulnerable Software and Affected Versions Cisco IP Phone 6800 versions affected versions not specified Cisco IP Phone 7800 versions affected versions not specified Cisco IP Phone 8800 versions affected versions not specified Cisco Video Phone 8875 versions affected versions not...