PT-2024-27148 · Oneflow · Oneflow

Name of the Vulnerable Software and Affected Versions: OneFlow version 0.9.1 Description: An issue in the oneflow.scatter nd parameter allows attackers to cause a Denial of Service DoS when the index parameter exceeds the range of shape. Recommendations: For version 0.9.1, consider restricting th...

PT-2024-27118 · Unknown · Lylme Spage

Name of the Vulnerable Software and Affected Versions: LyLme spage version 1.9.5 Description: The issue concerns Server-Side Request Forgery SSRF via the get head function. This allows for potential unauthorized access to internal resources. Recommendations: For LyLme spage version 1.9.5, conside...

PT-2024-29786 · WordPress · Affieasy

Name of the Vulnerable Software and Affected Versions: AffiEasy plugin for WordPress versions up to, and including, 1.1.7 Description: The issue is related to Cross-Site Request Forgery. This occurs because the plugin improperly releases the tagged and patched version, using the vulnerable versio...

PT-2024-12228 · Ruijie · Ruijie Eg105G +3

Name of the Vulnerable Software and Affected Versions: Ruijie EG210G-P affected versions not specified Ruijie EG105G-V2 affected versions not specified Ruijie NBR affected versions not specified Ruijie EG105G affected versions not specified Description: An issue in the mentioned Ruijie routers...

PT-2024-36021 · Rhinos · Rhinos

Name of the Vulnerable Software and Affected Versions: RhinOS versions 3.0-1190 Description: A vulnerability could allow PHP code injection through the "search" parameter in /portal/search.htm, enabling a remote attacker to perform a reverse shell on the remote system and compromise the entire...

PT-2024-4051 · Semcms · Semcms

Name of the Vulnerable Software and Affected Versions: SEMCMS version 4.8 Description: A SQL injection issue allows a remote attacker to obtain sensitive information via the lgid parameter in "Download.php". The vulnerability is related to the lack of protection for the SQL query structure, which...

PT-2024-26467

Name of the Vulnerable Software and Affected Versions Mocodo Mocodo Online versions 4.2.6 and below Description The issue arises from improper sanitization of the sql case input field in the /web/generate.php endpoint, allowing remote attackers to execute arbitrary SQL commands and potentially...

PT-2024-26543 · Idccms · Idccms

Name of the Vulnerable Software and Affected Versions: idccms version 1.35 Description: A Cross-Site Request Forgery CSRF issue was discovered in idccms via the component "/admin/vpsApi deal.php?mudi=rev&nohrefStr=close". This issue allows for unauthorized requests to be made on behalf of the use...

PT-2024-15570 · WordPress · Ai Chatbot

Name of the Vulnerable Software and Affected Versions: AI ChatBot plugin for WordPress versions up to, and including, 5.3.4 Description: The issue is related to unauthorized access of data due to a missing capability check on the openai file list callback function. This allows authenticated...

PT-2024-26536 · Idccms · Idccms

Name of the Vulnerable Software and Affected Versions: idccms version 1.35 Description: A Cross-Site Request Forgery CSRF issue was discovered in the component /admin/infoWeb deal.php, specifically with the mudi parameter set to rev. This allows for unauthorized requests to be made on behalf of t...

PT-2024-14967 · WordPress · Luckywp Table Of Contents

Name of the Vulnerable Software and Affected Versions: LuckyWP Table of Contents plugin for WordPress versions up to and including 2.1.4 Description: The issue is related to Stored Cross-Site Scripting via the Header Title field due to insufficient input sanitization and output escaping. This...

PT-2024-26541 · Idccms · Idccms

Name of the Vulnerable Software and Affected Versions: idccms version 1.35 Description: The issue is related to a Cross-Site Request Forgery CSRF in the component /admin/share switch.php. The affected endpoint includes parameters such as mudi, dataType, fieldName, fieldName2, tabName, and dataID...

PT-2024-30372 · Unknown · Gaizhenbiao/Chuanhuchatgpt

Name of the Vulnerable Software and Affected Versions: gaizhenbiao/chuanhuchatgpt version 20240310 Description: A Local File Inclusion LFI vulnerability exists within the application’s chat history upload functionality. The issue stems from improper input validation when handling file paths durin...

PT-2024-28041 · Unknown · Imartinez/Privategpt

Name of the Vulnerable Software and Affected Versions: imartinez/privategpt affected versions not specified Description: A stored Cross-Site Scripting XSS issue exists due to improper validation of file uploads. Attackers can exploit this by uploading malicious HTML files containing JavaScript...

PT-2024-27599 · WordPress · Sp Project & Document Manager

Name of the Vulnerable Software and Affected Versions: The SP Project & Document Manager WordPress plugin versions 4.71 and earlier Description: The issue allows a logged-in user to view and download files belonging to another user due to a lack of proper access controllers. Recommendations: For...

PT-2024-24104 · Aruba · Aruba Instantos/Arubaos

Name of the Vulnerable Software and Affected Versions: Aruba InstantOS/ArubaOS versions prior to 10.5.1.0 Description: The issue is related to command injection vulnerabilities in the Soft AP Daemon service, which can lead to unauthenticated remote code execution. This is achieved by sending...

PT-2024-3567

Name of the Vulnerable Software and Affected Versions Git versions prior to 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4 Description The issue allows an attacker to execute arbitrary code when cloning repositories with submodules. This is possible because Git can be fooled into...

PT-2024-12025 · Sourcecodester · Sourcecodester Customer Relationship Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Simple Customer Relationship Management System version 1.0 Description: The issue allows an attacker to execute arbitrary code. This can be achieved via the company or query parameters in a Cross Site Scripting vulnerability, o...

The 2024 Browser Security Report Uncovers How Every Web Session Could be a Security Minefield

With the browser becoming the most prevalent workspace in the enterprise, it is also turning into a popular attack vector for cyber attackers. From account takeovers to malicious extensions to phishing attacks, the browser is a means for stealing sensitive data and accessing organizational system...

PT-2024-22045 · Apple · Macos Sonoma +5

Name of the Vulnerable Software and Affected Versions: iOS versions prior to 17.5 iPadOS versions prior to 17.5 tvOS versions prior to 17.5 watchOS versions prior to 10.5 macOS Sonoma versions prior to 14.5 Description: The issue was addressed with improved memory handling. An app may be able to...