PT-2024-15064 · Supsystic · The Ultimate Maps

Name of the Vulnerable Software and Affected Versions: The Ultimate Maps by Supsystic WordPress plugin versions prior to 1.2.16 Description: The issue allows high privilege users, such as admins, to perform Cross-Site Scripting attacks even when unfiltered html is disallowed, due to the plugin no...

PT-2024-15639 · Unknown · Cxbsoft Url-Shorting

Name of the Vulnerable Software and Affected Versions: CXBSoft Url-shorting versions up to 1.3.1 Description: A critical issue was found in the HTTP POST Request Handler component, specifically in the file /pages/short to long.php. The manipulation of the shorturl argument leads to SQL injection...

PT-2024-15657 · Dedebiz · Dedebiz

Name of the Vulnerable Software and Affected Versions: DedeBIZ version 6.3.0 Description: A critical vulnerability has been found in DedeBIZ, affecting unknown code in the file /admin/makehtml freelist action.php. The manipulation of the startid argument leads to SQL injection. The attack can be...

PT-2024-1269 · Hitachi · Hitachi Device Manager

Name of the Vulnerable Software and Affected Versions: Hitachi Device Manager versions prior to 8.8.5-04 Description: The issue is related to insufficient protection of password input fields in the Device Manager Agent component of the Hitachi Device Manager system. This could allow a remote...

PT-2024-15599 · Taokeyun · Taokeyun

Name of the Vulnerable Software and Affected Versions: Taokeyun versions up to 1.0.5 Description: A critical issue has been found in the HTTP POST Request Handler component, specifically affecting the function index of the file application/index/controller/app/Video.php. The manipulation of the c...

PT-2024-11899 · Unknown · Weitong Mall

Name of the Vulnerable Software and Affected Versions: Weitong Mall version 1.0.0 Description: A critical issue was found in Weitong Mall. The vulnerability affects an unknown functionality of the file platform-shopsrcmainresourcescomplatformdaoOrderDao.xml. The manipulation of the argument...

PT-2024-2679 · Mediawiki +1 · Watchanalytics Extension +2

Name of the Vulnerable Software and Affected Versions: MediaWiki versions prior to 1.40.2 WatchAnalytics extension in MediaWiki affected versions not specified Description: An issue in the WatchAnalytics extension allows for XSS to occur via the Special:PageStatistics page parameter. This can...

PT-2024-1138 · Apache · Apache Solr

Name of the Vulnerable Software and Affected Versions: Apache Solr versions 9.0.0 through 9.3.0 Description: The Solr Metrics API publishes all unprotected environment variables available to each Apache Solr instance. Users are able to specify which environment variables to hide, however, the...

PT-2024-14335 · Verydows · Verydows

Name of the Vulnerable Software and Affected Versions: Verydows version 2.0 Description: The issue is related to a Cross-Site Request Forgery CSRF in the /protected/controller/backend/role controller component. This allows for unauthorized actions to be performed on behalf of a user without their...

The vulnerability of the OPNsense operating system arises from an incorrect limitation on the path to the restricted access directory. This allows a malicious user to execute arbitrary commands with root privileges.

The vulnerability of the OPNsense operating system exists due to an incorrect limitation on the path name to the restricted access directory. Exploiting this vulnerability allows a malicious actor, operating remotely, to execute arbitrary commands with root privileges using a specially created ZI...

PT-2024-19450 · Jfinalcms · Jfinalcms

Name of the Vulnerable Software and Affected Versions: JFinalcms version 5.0.0 Description: A stored XSS issue exists via the "/gusetbook/save" API endpoint, specifically through the content parameter, allowing remote attackers to inject arbitrary web script or HTML. Recommendations: For JFinalcm...

PT-2024-11900 · Apollo · Apollo

Name of the Vulnerable Software and Affected Versions: Apollo versions 2.0.0 through 2.0.1 Description: A vulnerability was found in the Configuration Center component, affecting some unknown functionality of the file /users. This issue leads to improper authorization and can be exploited remotel...

PT-2024-18989 · Cef · Cef

Name of the Vulnerable Software and Affected Versions: CEF Chromium Embedded Framework versions prior to the version containing commit 1f55d2e Description: The issue arises from the CefLayeredWindowUpdaterOSR::OnAllocatedSharedMemory function not checking the size of the shared memory, leading to...

CVE-2023-51750

ScaleFusion 10.5.2 does not properly limit users to the Edge application because file downloads can occur. NOTE: the vendor's position is "Not vulnerable if the default Windows device profile configuration is used which utilizes modern management with website allow-listing rules."...

Code injection

In ScaleFusion Windows Desktop App agent 10.5.2, Kiosk mode application restrictions can be bypassed allowing arbitrary code to be executed. This is fixed in 10.5.7 by preventing the launching of the file explorer in Agent-based Multi-App and Single App Kiosk mode...

Design/Logic Flaw

The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to unauthorized modification of membership levels created by the plugin due to an incorrectly implemented capability check in the pmprorestapigetpermissionscheck function in...

PT-2024-14284 · Unknown · Scalefusion

Name of the Vulnerable Software and Affected Versions: ScaleFusion version 10.5.2 Description: The issue arises because ScaleFusion does not properly limit users to the Edge application, allowing file downloads to occur. The vendor notes that the default Windows device profile configuration, whic...

PT-2024-1449 · Unknown · Rapid Scada

Name of the Vulnerable Software and Affected Versions: Rapid SCADA versions prior to 5.8.4 Description: The issue is related to the use of hard-coded credentials in the SCADA system. This could allow a remote attacker to gain full control over the system by connecting to a specific port...

PT-2024-10342 · Fortinet · Forticlientems

Name of the Vulnerable Software and Affected Versions: FortiClientEMS versions 7.2.0 through 7.2.4 FortiClientEMS versions prior to 7.0.10 Description: The issue is related to an improper restriction of excessive authentication attempts, which may allow an unauthenticated attacker to perform a...

CVE-2023-51748

ScaleFusion 10.5.2 does not properly limit users to the Edge application because Ctrl-O and Ctrl-S can be used. This is fixed in 10.5.7 by preventing the launching of the file explorer in Agent-based Multi-App and Single App Kiosk mode...