PT-2024-17933 · Grafana · Grafana

Name of the Vulnerable Software and Affected Versions: Countdown Timer for Elementor WordPress plugin versions prior to 1.3.7 Description: The issue concerns the Countdown Timer for Elementor WordPress plugin, where versions prior to 1.3.7 do not properly sanitise and escape some parameters when...

PT-2024-13301 · Mesa +2 · Mesa +2

Name of the Vulnerable Software and Affected Versions: Mesa version 23.0.4 Description: A buffer over-read was discovered in the glXQueryServerString function. This issue is disputed because there are no common situations in which users require uninterrupted operation with an attacker-controlled...

PT-2024-2657 · Cockpit +5 · Cockpit +5

Name of the Vulnerable Software and Affected Versions: Cockpit versions 270 and newer Description: A flaw was found in Cockpit, where deleting a sosreport with a crafted name via the Cockpit web interface can lead to a command injection vulnerability, resulting in privilege escalation. This issue...

PT-2024-20933

Name of the Vulnerable Software and Affected Versions Ignite Realtime Openfire versions 4.9.0 and earlier Ignite Realtime Openfire versions 4.8.0 and earlier Description The issue allows a remote attacker to escalate privileges via the admin.authorizedJIDs system property component or the ROOM...

PT-2024-18135 · WordPress · Wp-Schema-Pro

Name of the Vulnerable Software and Affected Versions: wp-schema-pro WordPress plugin versions prior to 2.7.16 Description: The issue allows a contributor user to access custom fields on any post, regardless of post type or status, via a shortcode. This is due to the plugin not validating post...

PT-2024-21141 · Lychee · Lychee

Name of the Vulnerable Software and Affected Versions: Lychee version 3.1.6 Description: A Cross-site Request Forgery CSRF issue allows remote attackers to execute arbitrary code via the create new album function. This can be exploited to perform unauthorized actions on the affected system...

PT-2024-2423 · Apache · Apache Doris

Name of the Vulnerable Software and Affected Versions: Apache Doris versions 1.2.0 through 2.0.4 Description: The issue is related to the download of code without integrity check in Apache Doris, which may result in remote command execution. An attacker authorized to create a JDBC catalog can use...

PT-2024-23089 · Distrobox · Distrobox

Name of the Vulnerable Software and Affected Versions: Distrobox versions prior to 1.7.0.1 Description: The issue allows attackers to execute arbitrary code via command injection into exported executables. Recommendations: For versions prior to 1.7.0.1, update to version 1.7.0.1 or later to resol...

PT-2024-7570 · Unknown · Libiec61850

Name of the Vulnerable Software and Affected Versions: libiec61850 version 1.4.0 Description: A NULL Pointer Dereference issue was detected in the mmsServer handleFileCloseRequest.c function of src/mms/iso mms/server/mms file service.c, which can cause the application to crash due to a SEGV. The...

PT-2024-20034 · Draytek · Draytek Vigor 3910

Name of the Vulnerable Software and Affected Versions: Draytek Vigor3910 version 4.3.2.5 Description: A Directory Traversal issue was discovered in the process post function. When sending a certain POST request, it calls the function and exports information. Recommendations: For Draytek Vigor3910...

PT-2024-15247 · WordPress · System Dashboard

Name of the Vulnerable Software and Affected Versions: The System Dashboard WordPress plugin versions prior to 2.8.10 Description: The issue concerns a lack of sanitization and escaping of certain parameters in the plugin, which could allow administrators in multisite WordPress configurations to...

PT-2024-15812 · WordPress · Enjoy Social Feed

Name of the Vulnerable Software and Affected Versions: Enjoy Social Feed plugin for WordPress website versions through 6.2.2 Description: The issue concerns a lack of authorization and CSRF protection in various functions hooked to admin init, allowing unauthenticated users to call them and unlin...

PT-2024-5872 · Glpi +1 · Glpi +1

Name of the Vulnerable Software and Affected Versions: GLPI versions prior to 10.0.13 Description: The issue is related to CSV injection, where an attacker can create an asset with a crafted title, potentially allowing a remote attacker to impact the confidentiality, integrity, and availability o...

PT-2024-13383 · Epmm · Epmm

Name of the Vulnerable Software and Affected Versions: EPMM versions prior to 12.1.0.0 Description: The issue allows an authenticated user with appropriate privilege to access or modify data in the underlying database due to an SQL Injection vulnerability in the web component. Recommendations: Fo...

PT-2024-22280 · Offis +4 · Dcmtk +4

Name of the Vulnerable Software and Affected Versions: OFFIS DCMTK version 3.6.8 Description: An incorrect type conversion vulnerability exists in the DVPSSoftcopyVOI PList::createFromImage functionality. A specially crafted malformed file can lead to arbitrary code execution. An attacker can...

PT-2024-2079 · Microsoft · Windows Hyper-V +1

Name of the Vulnerable Software and Affected Versions: Windows Hyper-V affected versions not specified Description: The vulnerability is related to insufficient input validation in the Windows Hyper-V system, allowing a remote attacker to execute arbitrary code. This issue can be exploited by an...

PT-2024-20335 · Teamwire · Teamwire Windows Desktop Client

Name of the Vulnerable Software and Affected Versions: Teamwire Windows desktop client versions 2.0.1 through 2.4.0 Description: An issue in the Teamwire Windows desktop client allows a remote attacker to obtain sensitive information via a crafted payload to the message function. Recommendations:...

PT-2024-21389 · Prestashop · Prestashop Product Designer Module

Name of the Vulnerable Software and Affected Versions: PrestaShop Product Designer module versions prior to 1.178.36 Description: A Server-Side Request Forgery SSRF issue allows remote attackers to cause a denial of service DoS and escalate privileges via the url parameter in the postProcess...

PT-2024-20654 · Dell · Dell Secure Connect Gateway (Scg) Policy Manager

Name of the Vulnerable Software and Affected Versions: Dell Secure Connect Gateway SCG Policy Manager version 5.10+ Description: The issue is related to a weak password recovery mechanism for forgotten passwords. An adjacent network low privileged attacker could potentially exploit this, leading ...

PT-2024-18703 · Helpdesk · Helpdesk

Name of the Vulnerable Software and Affected Versions: HelpDeskZ versions 2.0.2 and earlier Description: A Cross-Site Scripting XSS issue has been found in HelpDeskZ. This issue could allow an attacker to send a specially crafted JavaScript payload within the email field and partially take contro...