PT-2024-15896 · Unknown · Hongmaple Octopus

Name of the Vulnerable Software and Affected Versions: hongmaple octopus version 1.0 Description: A vulnerability was found in hongmaple octopus, affecting an unknown functionality. The manipulation of the argument description with the input alertdocument.cookie leads to cross-site scripting. The...

PT-2024-1831 · Vitalpbx · Vitalpbx

Name of the Vulnerable Software and Affected Versions: VitalPBX versions 3.2.4 through 3.2.5 Description: The issue is related to insufficient protection of service data when processing a script from the /var/lib/vitalpbx directory, allowing an attacker to execute arbitrary code via a crafted...

VectorAdmin Authorization Issues Vulnerability

VectorAdmin is a generalized suite of tools for vector database administration. VectorAdmin suffers from an authorization issue vulnerability that stems from the inclusion of an authentication bypass in vector-admin that allows a user to register to vector-admin while domain restriction is active...

PT-2024-15887 · Qwdigital · Qwdigital Linkwechat

Name of the Vulnerable Software and Affected Versions: qwdigital LinkWechat version 5.1.0 Description: A vulnerability was found in qwdigital LinkWechat, affecting an unknown part of the file /linkwechat-api/common/download/resource of the component Universal Download Interface. The manipulation ...

CVE-2024-21796

Electronic Deliverables Creation Support Tool Construction Edition prior to Ver1.0.4 and Electronic Deliverables Creation Support Tool Design & Survey Edition prior to Ver1.0.4 improperly restrict XML external entity references XXE. By processing a specially crafted XML file, arbitrary files on t...

Server side request forgery (ssrf)

Label Studio, an open source data labeling tool had a remote import feature allowed users to import data from a remote web source, that was downloaded and could be viewed on the website. Prior to version 1.10.1, this feature could had been abused to download a HTML file that executed malicious...

PT-2024-13165 · Line · Ailand Clinic Mini-App

Name of the Vulnerable Software and Affected Versions: Ailand clinic mini-app on Line version 13.6.1 Description: An issue in the Ailand clinic mini-app on Line allows attackers to send crafted malicious notifications via leakage of the channel access token. This leakage enables attackers to...

Mozilla Thunderbird Security Advisories (mfsa_2024-04) - Windows

Mozilla Thunderbird is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:thunderbird";...

PT-2024-2067 · Unknown · Gtb Central Console

Name of the Vulnerable Software and Affected Versions: GTB Central Console version 15.17.1-30814.NG Description: An issue was discovered in the GTB Central Console, where the method systemSettingsDnsDataAction at /opt/webapp/src/AppBundle/Controller/React/SystemSettingsController.php is vulnerabl...

CVE-2024-23633 Label Studio XSS Vulnerability on Data Import

Label Studio, an open source data labeling tool had a remote import feature allowed users to import data from a remote web source, that was downloaded and could be viewed on the website. Prior to version 1.10.1, this feature could had been abused to download a HTML file that executed malicious...

[SECURITY] [DSA 5604-1] openjdk-11 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5604-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff January 23, 2024 https://www.debian.org/security/faq -...

CVE-2024-0703 Sticky Buttons <= 3.2.2 - Authenticated (Admin+) Stored Cross-Site Scripting

The Sticky Buttons – floating buttons builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via sticky URLs in all versions up to, and including, 3.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-23206

An access issue was addressed with improved access restrictions. This issue is fixed in Safari 17.3, iOS 16.7.5 and iPadOS 16.7.5, iOS 17.3 and iPadOS 17.3, macOS Sonoma 14.3, tvOS 17.3, watchOS 10.3. A maliciously crafted webpage may be able to fingerprint the user...

Design/Logic Flaw

An access issue was addressed with improved access restrictions. This issue is fixed in watchOS 10.3, tvOS 17.3, iOS 17.3 and iPadOS 17.3, macOS Sonoma 14.3, iOS 16.7.5 and iPadOS 16.7.5, Safari 17.3. A maliciously crafted webpage may be able to fingerprint the user...

PT-2024-14072 · Webkul · Webkul Bundle Product

Name of the Vulnerable Software and Affected Versions: Webkul Bundle Product version 6.0.1 Description: A SQL injection issue allows a remote attacker to execute arbitrary code via the id product parameters in the UpdateProductQuantity function. Recommendations: For Webkul Bundle Product version...

PT-2024-1385 · Google +4 · Google Chrome +4

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 121.0.6167.85 Description: The issue is related to insufficient policy enforcement in DevTools, which can allow an attacker to leak cross-origin data via a crafted Chrome Extension if a user is convinced to...

PT-2024-19447 · Beetl-Bbs · Beetl-Bbs

Name of the Vulnerable Software and Affected Versions: beetl-bbs version 2.0 Description: The issue is related to a Cross Site Scripting XSS flaw that allows attackers to execute arbitrary code. This is achieved by exploiting the keyword parameter in the "/index" API endpoint. Recommendations: Fo...

Command injection

CloudLinux CageFS 7.0.8-2 or below insufficiently restricts file paths supplied to the sendmail proxy command. This allows local users to read and write arbitrary files outside the CageFS environment in a limited way...

CVE-2020-36772

CloudLinux CageFS 7.0.8-2 or below insufficiently restricts file paths supplied to the sendmail proxy command. This allows local users to read and write arbitrary files of certain file formats outside the CageFS environment...

Code execution in pandasai

GenerateSDFPipeline in syntheticdataframe in PandasAI aka pandas-ai through 1.5.17 allows attackers to trigger the generation of arbitrary Python code that is executed by SDFCodeExecutor. An attacker can create a dataframe that provides an English language specification of this Python code. NOTE:...