PT-2024-19499 · Zenml · Zenml

Name of the Vulnerable Software and Affected Versions: zenml-io/zenml affected versions not specified Description: A session fixation issue exists in the zenml-io/zenml application. The problem arises because JWT tokens used for user authentication are not invalidated upon logout. This allows an...

PT-2024-18162 · Unknown · Parisneo/Lollms-Webui

Name of the Vulnerable Software and Affected Versions: parisneo/lollms-webui affected versions not specified Description: An SQL injection issue exists in the delete discussion function, allowing an attacker to delete all discussions and message data by sending a crafted HTTP POST request to the...

PT-2024-27762 · Unknown · Wbsairback

Name of the Vulnerable Software and Affected Versions: WBSAirback version 21.02.04 Description: The issue is related to a command injection vulnerability in the operating system, specifically due to improper neutralisation of special elements in Active Directory integration. This allows the...

PT-2024-27822 · Unknown · Wbsairback

Name of the Vulnerable Software and Affected Versions: WBSAirback version 21.02.04 Description: The issue is a stored Cross-Site Scripting XSS vulnerability. It occurs through the /admin/SystemConfiguration endpoint, specifically in the name and free memory limit fields, and the type and password...

PT-2024-18271 · WordPress · Testimonial Slider

Name of the Vulnerable Software and Affected Versions: Testimonial Slider WordPress plugin versions prior to 2.3.8 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for exampl...

PT-2024-13206 · Cobham · Cobham Sailor Vsat Ku

Name of the Vulnerable Software and Affected Versions: Cobham SAILOR VSAT Ku version 164B019 Description: The issue allows a remote attacker to execute arbitrary code via a crafted script to the sub 21D24 function in the acu web component. Recommendations: For Cobham SAILOR VSAT Ku version 164B01...

PT-2024-14945 · WordPress · Wordpress Ping Optimizer

Name of the Vulnerable Software and Affected Versions: WordPress Ping Optimizer plugin versions through 2.35.1.3.0 Description: The issue concerns the lack of CSRF checks in certain areas, potentially allowing attackers to trick logged-in users into performing unwanted actions, such as clearing...

PT-2024-22912 · Unknown · Px4-Autopilot

Name of the Vulnerable Software and Affected Versions: PX4 Autopilot version 1.14.0 Description: An issue in the mission block.cpp component allows an attacker to manipulate the flight path, potentially causing crashes of the drone by altering the home point location. Recommendations: For PX4...

CVE-2024-31454

PsiTransfer (open-source file sharing) prior to version 2.2.0 is vulnerable due to unrestricted upload-endpoint access, where an attacker who obtains a file distribution id can replace files within that distribution. This leads to integrity violations at the level of individual files, as exposed ...

CVE-2024-31454 PsiTransfer file integrity violation vulnerability

PsiTransfer is an open source, self-hosted file sharing solution. Prior to version 2.2.0, the absence of restrictions on the endpoint, which is designed for uploading files, allows an attacker who received the id of a file distribution to change the files that are in this distribution. The...

CVE-2024-31453

PsiTransfer is affected by two CVEs: CVE-2024-31453 and CVE-2024-31454, both prior to version 2.2.0. The issue in CVE-2024-31453 arises from lack of endpoint restrictions that let an attacker push arbitrary files into a file distribution bucket, enabling manipulation of the distribution and poten...

PT-2024-10914 · Apache · Apache Zeppelin

Name of the Vulnerable Software and Affected Versions: Apache Zeppelin versions 0.9.0 and prior versions Description: A Cross-Site Request Forgery CSRF issue in the Credential page of Apache Zeppelin allows an attacker to submit malicious requests. Recommendations: For Apache Zeppelin versions...

PT-2024-18630 · WordPress · Wp Activity Log Premium

Name of the Vulnerable Software and Affected Versions: WP Activity Log Premium plugin for WordPress versions up to, and including, 4.6.4 Description: The issue allows for SQL Injection via the entry-roles parameter due to insufficient escaping on the user-supplied parameter and lack of sufficient...

PT-2024-3295

Name of the Vulnerable Software and Affected Versions Windows affected versions not specified Description The issue is related to an elevation-of-privilege vulnerability in the Windows authentication mechanism, which involves the use of defective cryptographic algorithms. This vulnerability can b...

PT-2024-23217 · Invision · Invision Community

Name of the Vulnerable Software and Affected Versions: Invision Community versions 4.4.0 through 4.7.15 Description: The issue allows for SQL injection through the store.php file, specifically in the categoryView method of the IPS exusmodulesfrontstore store class. User input passed through the...

PT-2024-22247 · Unify · Unify Cp Ip Phone

Name of the Vulnerable Software and Affected Versions: Unify CP IP Phone version 1.10.4.3 Description: The issue is related to weak credentials, specifically a hardcoded root password, in the firmware. Recommendations: For Unify CP IP Phone version 1.10.4.3, consider changing the hardcoded root...

PT-2024-6032 · Frrouting +5 · Frrouting +5

Name of the Vulnerable Software and Affected Versions: FRRouting versions through 9.1 Description: The issue is related to improper input validation, allowing a remote attacker to cause a denial of service by exploiting the vulnerability. Specifically, an attacker can use a malformed Prefix SID...

PT-2024-25790 · Unknown · Puneethreddyhc Event Management

Name of the Vulnerable Software and Affected Versions: PuneethReddyHC Event Management version 1.0 Description: A problematic vulnerability has been found in the software. The issue affects an unknown function of the file /backend/register.php. The manipulation of the arguments event id, full nam...

PT-2024-5024

Name of the Vulnerable Software and Affected Versions: tiagorlampert CHAOS version 5.0.1 tiagorlampert CHAOS versions before 1b451cf62582295b7225caf5a7b506f0bad56f6b and 24c9e109b5be34df7b2bce8368eae669c481ed5e Description: The issue allows a remote attacker to execute arbitrary code via the...

PT-2024-24728 · Rt +1 · Rt +1

Name of the Vulnerable Software and Affected Versions: RT software version 4.4.1 Description: The issue allows an attacker with local access to the device to retrieve sensitive information about the application, such as vulnerability tickets. This is because the application stores the information...