CVE-2024-29883

The CVE concerns Miraheze’s CreateWiki extension for MediaWiki. The issue: suppression of wiki requests does not respect configured visibility settings, causing leakage of information to users lacking the appropriate createWiki right. This is described as the underlying behavior that restricted v...

Rockwell Automation Arena Simulation

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION : low attack complexity Vendor : Rockwell Automation Equipment : Arena Simulation Software Vulnerabilities : Out-of-bounds Write, Heap-based Buffer Overflow, Improper Restriction of Operations within the Bounds of a Memory Buffer, Use After...

PT-2024-22906 · Unknown · Campcodes Online Examination System

Name of the Vulnerable Software and Affected Versions: Campcodes Online Examination System version 1.0 Description: A critical issue was found in the system, affecting an unknown function of the file /adminpanel/admin/facebox modal/updateExaminee.php. The manipulation of the id argument leads to...

PT-2024-22236 · Ffbull · Ffbull

Name of the Vulnerable Software and Affected Versions: ffBull version 4.11 Description: An OS command injection issue exists, which may allow a remote unauthenticated attacker to execute an arbitrary OS command with the privilege of the running web server. The developer of ffBull is unreachable,...

PT-2024-22777 · Unknown · Campcodes House Rental Management System

Name of the Vulnerable Software and Affected Versions: Campcodes House Rental Management System version 1.0 Description: A critical issue was found in the system, affecting an unknown functionality of the file index.php. The manipulation of the page argument leads to file inclusion. The attack ca...

PT-2024-22438 · Yealink · Yealink Vp59

Name of the Vulnerable Software and Affected Versions: Yealink VP59 version 91.15.0.118 Description: A Directory Traversal issue allows a physically proximate attacker to obtain sensitive information via the terms of use function in the company portal component. Recommendations: For Yealink VP59...

PT-2024-21427 · Vseeface · Vseeface

Name of the Vulnerable Software and Affected Versions: VSeeFace versions 1.13.38.c2 and earlier Description: The issue allows attackers to cause a denial of service, resulting in an application hang, via a spoofed UDP packet containing at least 10 digits in JSON data. Recommendations: For version...

PT-2024-12427 · Unknown · Etoile Web Design Front End Users

Name of the Vulnerable Software and Affected Versions: Etoile Web Design Front End Users versions prior to 3.2.25 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This means that an...

PT-2024-12130 · Onthegosystems · Onthegosystems Types

Name of the Vulnerable Software and Affected Versions: OnTheGoSystems Types versions 3.4.17 and earlier Description: The issue is related to an Unrestricted Upload of File with Dangerous Type, which affects OnTheGoSystems Types. Recommendations: For versions 3.4.17 and earlier, update to a versio...

PT-2024-19322 · Unknown · Icegram Email Subscribers & Newsletters

Name of the Vulnerable Software and Affected Versions: Icegram Email Subscribers & Newsletters versions n/a through 5.7.11 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS...

UBUNTU-CVE-2021-47172

In the Linux kernel, the following vulnerability has been resolved: iio: adc: ad7124: Fix potential overflow due to non sequential channel numbers Channel numbering must start at 0 and then not have any holes, or it is possible to overflow the available storage. Note this bug was introduced as pa...

PT-2024-22623 · Boldgrid · Post/Page Builder By Boldgrid

Name of the Vulnerable Software and Affected Versions: Post and Page Builder by BoldGrid – Visual Drag and Drop Editor versions 1.26.2 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as 'Cross-site Scripting', which allows...

PT-2024-2384 · Phpmyfaq · Phpmyfaq

Name of the Vulnerable Software and Affected Versions: phpMyFAQ versions prior to 3.2.6 Description: The issue is related to the manipulation of the news parameter in a POST request, allowing an attacker to inject malicious JavaScript code. Upon browsing to the compromised news page, the XSS...

PT-2024-22358

Name of the Vulnerable Software and Affected Versions KaTeX versions prior to 0.16.10 Description KaTeX is a JavaScript library for TeX math rendering on the web. Users who render untrusted mathematical expressions could encounter malicious input using edef that causes a near-infinite loop, despi...

PT-2024-19018 · WordPress · Vk All In One Expansion Unit

Name of the Vulnerable Software and Affected Versions: VK All in One Expansion Unit plugin for WordPress versions up to, and including, 9.96.0.1 Description: The issue is related to Stored Cross-Site Scripting via the child page index widget due to insufficient input sanitization and output...

Rockwell Automation PowerFlex 525 安全漏洞

The Rockwell Automation PowerFlex 527 is an adjustable AC frequency converter from Rockwell Automation. A denial of service vulnerability exists in the Rockwell Automation PowerFlex 527, which stems from improper restriction of device traffic and can be exploited by an attacker to cause the devic...

Paid Memberships Pro < 3.0 - Cross-Site Request Forgery

Description The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.12.10. This is due to missing nonce validation on the pmproliftersavestreamlineoption...

The issue with the Apache Ivy package manager, related to an incorrect restriction on the path to the restricted directory, allows a violator to write arbitrary files into the file system.

The vulnerability of the Apache Ivy package manager is related to an incorrect restriction on the path to the restricted catalog. Exploiting this vulnerability could allow a malicious actor to write arbitrary files into the file system...

PT-2024-20520 · Gibbon · Gibbon

Name of the Vulnerable Software and Affected Versions: Gibbon versions 26.0.00 and earlier Description: The issue allows remote authenticated users to conduct PHP deserialization attacks via the columnOrder parameter in a POST request to the "/modules/System%20Admin/import...

PT-2024-22365 · Unknown · Lakernote Easyadmin

Name of the Vulnerable Software and Affected Versions: lakernote EasyAdmin up to 20240315 Description: A critical vulnerability has been found in lakernote EasyAdmin. This affects an unknown part of the file /ureport/designer/saveReportFile. The manipulation of the file argument leads to path...