CVE-2024-47780 Information Disclosure in TYPO3 Page Tree

TYPO3 is a free and open source Content Management Framework. Backend users could see items in the backend page tree without having access if the mounts pointed to pages restricted for their user/group, or if no mounts were configured but the pages allowed access to "everybody." However, affected...

Information Disclosure in TYPO3 Page Tree

Problem Backend users could see items in the backend page tree without having access if the mounts pointed to pages restricted for their user/group, or if no mounts were configured but the pages allowed access to "everybody." However, affected users could not manipulate these pages. Solution Upda...

Security Bulletin: IBM Engineering Systems Design Rhapsody - Model Manager - Race Condition Format Flaw (Uses of non-thread safe SimpleDateFormat.format() when enabling DEBUG log for IDMappingsService.verbose)

Summary In 'IBM Engineering Systems Design Rhapsody - Model Manager RMM' if DEBUG logging is enabled for 'IDMappingsService.verbose', then there is a possibility of an incorrect date being written to the logs, or the possibility of an exception being thrown due to a race-condition involving the u...

CVE-2022-4534

The Limit Login Attempts Spam Protection plugin for WordPress is vulnerable to IP Address Spoofing in versions up to, and including, 5.3. This is due to insufficient restrictions on where the IP Address information is being retrieved for request logging and login restrictions. Attackers can suppl...

CVE-2024-9381: Improper Limitation of a Pathname to a Restricted Directory

Path traversal in Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to bypass restrictions...

PT-2024-7465 · Fortinet · Fortimanager

Name of the Vulnerable Software and Affected Versions: FortiManager versions 7.4.2 and below FortiManager versions 7.2.5 and below FortiManager versions 7.0.12 and below Description: The issue is related to the exposure of sensitive information to unauthorized actors. It allows a remote...

PT-2024-6848 · Microsoft · Windows +1

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Microsoft Simple Certificate Enrollment Protocol affected versions not specified Description: The issue is related to an uncontrolled resource consumption in the implementation of the Simple Certificate...

PT-2024-40214 · Surrealdb · Surrealdb

Name of the Vulnerable Software and Affected Versions: SurrealDB versions prior to 2.0.4 Description: The issue arises from the order in which permissions are processed, leading to potential leaks of field values or record contents to users without the required permissions. This can occur in...

PT-2024-31833 · Motorola · Motorola Cx2

Name of the Vulnerable Software and Affected Versions: Motorola CX2L router versions 1.0.2 and below Description: A command injection issue exists, allowing malicious users to inject and execute arbitrary commands. This is due to the system directly invoking the system function to execute command...

Siemens Tecnomatix Plant Simulation

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories CERT Services | Services |...

CVE-2024-8927

A flaw was found in PHP. The configuration directive cgi.forceredirect prevents anyone from calling PHP directly with a URL such as http://host.example/cgi-bin/php/secretdir/script.php. However, in certain uncommon configurations, an attacker may be able to bypass this restriction and access...

CVE-2024-23369 Improper Restriction of Operations within the Bounds of a Memory Buffer in HLOS

Memory corruption when invalid length is provided from HLOS for FRS/UDS request/response buffers...

Redis 2.6 < 6.2.16, 7.0.0. < 7.2.6, 7.4.0 RCE vulnerability

Redis is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:redis:redis"; if...

PT-2024-7098 · D Link · Dir-605L

Name of the Vulnerable Software and Affected Versions: D-Link DIR-605L version 2.13B01 BETA Description: A critical issue has been found in the function formWlanSetup Wizard of the file /goform/formWlanSetup Wizard. The manipulation of the argument webpage leads to buffer overflow. This issue...

PT-2024-32583 · WordPress · Wpvibes Elementor Addon Elements

Name of the Vulnerable Software and Affected Versions: WPVibes Elementor Addon Elements versions 1.13.6 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS attacks...

PT-2024-7001 · D Link · D-Link Dir-619L

Name of the Vulnerable Software and Affected Versions: D-Link DIR-619L version 2.06 Description: A critical issue is present in the function formSetPortTr of the file /goform/formSetPortTr, allowing for remote exploitation through a buffer overflow. The manipulation of the curTime argument leads ...

PT-2024-32557 · Pickplugins · Pickplugins Accordion

Name of the Vulnerable Software and Affected Versions: PickPlugins Accordion versions 2.2.99 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS in PickPlugins Accordion...

PT-2024-32512 · Unknown · Bit Form – Contact Form Plugin

Name of the Vulnerable Software and Affected Versions: Bit Form – Contact Form Plugin versions n/a through 2.13.10 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS in the Bit Form –...

PT-2024-32568

Name of the Vulnerable Software and Affected Versions Xylus Themes WP Bulk Delete versions prior to 1.3.2 Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Reflected XSS, which can be exploited...

PT-2024-32517 · Unknown · Secure Copy Content Protection/Content Locking

Name of the Vulnerable Software and Affected Versions: Secure Copy Content Protection and Content Locking versions n/a through 4.2.3 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS, which allows Stored XSS...