PT-2024-19452 · Jfinalcms · Jfinalcms

Name of the Vulnerable Software and Affected Versions: JFinalcms version 5.0.0 Description: A Cross Site Scripting XSS issue allows attackers to execute arbitrary code by exploiting the username parameter in the "/admin/login" API endpoint. Recommendations: For JFinalcms version 5.0.0, avoid usin...

PT-2024-13402 · Unknown · Multisigwallet

Name of the Vulnerable Software and Affected Versions: MultiSigWallet version 0xF0C99 Description: A reentrancy issue was found in the executeTransaction function of MultiSigWallet. This issue could potentially be exploited. Recommendations: For MultiSigWallet version 0xF0C99, consider disabling...

PT-2024-1144

Name of the Vulnerable Software and Affected Versions: EDK2 affected versions not specified Description: The issue is related to a buffer overflow vulnerability in the Dhcp6SendRequestMsg function of the Tianocore edk2 library, specifically in the NetworkPkg/Dhcp6Dxe/Dhcp6Io.c file. This...

PT-2024-14370 · Totolink · Totolink X6000R

Name of the Vulnerable Software and Affected Versions: TOTOLINK X6000R version 9.4.0cu.852 B20230719 Description: An issue in the TOTOLINK X6000R allows attackers to run arbitrary code via the sub 410118 function of the shttpd program. Recommendations: For TOTOLINK X6000R version 9.4.0cu.852...

PT-2024-1173 · Totolink · Totolink X2000R

Name of the Vulnerable Software and Affected Versions: Totolink X2000R version 1.0.0-B20221212.1452 Description: A critical issue is related to the function formMapDelDevice in the /boafrm/formMapDelDevice file, where the manipulation of the macstr argument leads to command injection. This can be...

PT-2024-1074

Name of the Vulnerable Software and Affected Versions Atlassian Confluence versions 8.0.x through 8.5.3 Description A template injection vulnerability in older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve remote code execution RCE on an affected...

PT-2024-15003 · Tecnick.Com +3 · Tcexam

Name of the Vulnerable Software and Affected Versions: Software affected versions not specified Description: The issue arises when access to the "admin" folder is not protected by external authorization mechanisms, such as Apache Basic Auth. This allows any user to download protected information,...

PT-2024-11628 · Elite Crm · Elite Crm

Name of the Vulnerable Software and Affected Versions: Elite CRM version 1.2.11 Description: A Cross Site Scripting issue allows an attacker to execute arbitrary code via the language parameter to the "/ngs/login" endpoint. Recommendations: For Elite CRM version 1.2.11, avoid using the language...

PT-2024-15038 · WordPress · Caos | Host Google Analytics Locally

Name of the Vulnerable Software and Affected Versions: CAOS | Host Google Analytics Locally plugin for WordPress versions up to, and including, 4.7.14 Description: The issue allows unauthorized modification of data due to a missing capability check on the update settings function. This makes it...

PT-2024-14940 · WordPress · Export Wp Page To Static Html/Css

Name of the Vulnerable Software and Affected Versions: Export WP Page to Static HTML/CSS plugin for WordPress versions up to, and including, 2.1.9 Description: The issue is related to a missing capability check on multiple AJAX actions, allowing authenticated attackers with subscriber-level acces...

PT-2024-1166

The vulnerable software is Google Chrome, specifically the V8 JavaScript engine, which is also used in other Chromium-based browsers such as Microsoft Edge, Brave, and Opera. The issue is an out-of-bounds memory access vulnerability that can be exploited by attackers to trigger crashes or execute...

PT-2024-13047 · WordPress · Givewp

Name of the Vulnerable Software and Affected Versions: GiveWP plugin for WordPress versions up to, and including, 2.33.3 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the give stripe disconnect connect stripe account function. This...

PT-2024-15109 · WordPress · Commenttweets

Name of the Vulnerable Software and Affected Versions: CommentTweets WordPress plugin versions 0.6 and earlier Description: The issue concerns the lack of CSRF checks in certain areas of the plugin, which could allow attackers to make logged-in users perform unwanted actions via CSRF attacks...

PT-2024-14893 · WordPress · Wp Crowdfunding

Name of the Vulnerable Software and Affected Versions: WP Crowdfunding WordPress plugin versions prior to 2.1.9 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back in the pag...

PT-2024-13857 · Broadcom · Apiida Api Gateway Manager

Name of the Vulnerable Software and Affected Versions: APIIDA API Gateway Manager for Broadcom Layer7 version 2023.2 Description: The APIIDA API Gateway Manager for Broadcom Layer7 is affected by a Cross Site Scripting XSS issue. This allows for malicious scripts to be injected into the website,...

PT-2024-13278 · Hcl · Hcl Dryice Myxalytics

Name of the Vulnerable Software and Affected Versions: HCL DRYiCE MyXalytics affected versions not specified Description: The issue allows file upload capability through a path traversal vulnerability. Certain endpoints permit users to manipulate the path, including the file name, where these fil...

PT-2023-35674 · Git +1 · Libxml2

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a heap-use-after-free READ 8 crash. The crash state involves the functions xmlStaticCopyNode, xmlDocCopyNode, and...

Increase liquidity in close position may not cover original borrowed liquidity

Lines of code Vulnerability details Summary When a position is closed, there is no check to ensure that the effective added liquidity covers the original borrowed liquidity from the LP. Impact Closing a position in the Particle LAMM protocol must ensure that the borrowed liquidity gets fully adde...

Modifying the loan term setting can default existing loans

Lines of code Vulnerability details Summary Protocol admins can modify the loan term settings. This action can inadvertently default existing loans created under different terms. Impact Positions in the Particle LAMM protocol are created for a configurable period of time, defined by the LOANTERM...

PT-2023-31140

Name of the Vulnerable Software and Affected Versions Hotel Management version 1.0 Description The issue concerns multiple authenticated Reflected Cross-Site Scripting vulnerabilities. Specifically, the children parameter of the "reservation.php" resource is copied into the HTML document as plain...