PT-2024-20835 · Unknown · Simple Admin Panel

Name of the Vulnerable Software and Affected Versions: Simple Admin Panel App version 1.0 Description: A cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Size Number parameter under the Add Size function...

PT-2024-21113 · Qanything · Qanything

Name of the Vulnerable Software and Affected Versions: QAnything versions prior to 1.2.0 Description: The issue allows SQL Injection in the qanything kernel/connector/database/mysql/mysql client.py module. Recommendations: For versions prior to 1.2.0, update to version 1.2.0 or later to resolve t...

PT-2024-2333

Name of the Vulnerable Software and Affected Versions Bricks Builder versions 1.9.6 and earlier Description A critical remote code execution vulnerability in Bricks Builder, a WordPress site builder, allows unauthenticated attackers to execute arbitrary PHP code on vulnerable installations. This...

PT-2024-8689

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 11.0.0-M1 through 11.0.0-M26 Apache Tomcat versions 10.1.0-M1 through 10.1.30 Apache Tomcat versions 9.0.0-M1 through 9.0.95 Description The issue is related to an Unchecked Error Condition vulnerability in Apache Tomcat...

PT-2024-19017 · Atlassian · Confluence

Name of the Vulnerable Software and Affected Versions: Confluence Data Center and Server versions 7.19.0 through 8.9.0 Confluence Data Center and Server version 4.3 Description: This Reflected XSS and CSRF vulnerability allows an unauthenticated attacker to execute arbitrary HTML or JavaScript co...

PT-2024-19473 · Beetl · Beetl

Name of the Vulnerable Software and Affected Versions: Beetl versions prior to 3.15.12 Description: The rendering template in Beetl has a server-side template injection SSTI vulnerability. When the incoming template is controllable, it will be filtered by the DefaultNativeSecurityManager blacklis...

PT-2024-20362 · Totolink · Totolink A3300R

Name of the Vulnerable Software and Affected Versions: TOTOLINK A3300R version V17.0.0cu.557 B20221024 Description: A command injection issue was discovered via the enable parameter in the setPortForwardRules function. This allows for potential exploitation. Recommendations: For TOTOLINK A3300R...

PT-2024-20363 · Totolink · Totolink A3300R

Name of the Vulnerable Software and Affected Versions: TOTOLINK A3300R version 17.0.0cu.557 B20221024 Description: The issue is related to a command injection vulnerability. This vulnerability can be exploited via the port or enable parameters in the setRemoteCfg function. Recommendations: For...

PT-2024-4536 · Graphviz +5 · Graphviz +5

Name of the Vulnerable Software and Affected Versions: Graphviz versions 2.36.0 through 9.x before 10.0.1 Graphviz versions 2.36 before 10.0.0 Description: The issue is related to an out-of-bounds read in the Graphviz application, which can be exploited via a crafted config6a file. This may allow...

PT-2024-5052 · Netis Systems · Netis Systems Mw5360

Name of the Vulnerable Software and Affected Versions: NETIS SYSTEMS MW5360 version 1.0.1.3031 Description: The issue is related to a command injection vulnerability via the password parameter on the login page. This vulnerability may allow a remote attacker to execute arbitrary commands...

Host header injection in the password reset

Summary The password reset functionality sends to the the user requesting a password change an email containing an URL to reset its password. The URL sent contains a unique token, valid during 24 hours, allowing the user to reset its password. This token is highly sensitive ; as an attacker able ...

GHSA-MRQG-MWH7-Q94J Host header injection in the password reset

Summary The password reset functionality sends to the the user requesting a password change an email containing an URL to reset its password. The URL sent contains a unique token, valid during 24 hours, allowing the user to reset its password. This token is highly sensitive ; as an attacker able ...

PT-2024-13164 · Line · Line

Name of the Vulnerable Software and Affected Versions: Line version 13.6.1 Description: An issue in the Otakara lapis totuka mini-app on Line allows attackers to send crafted malicious notifications via leakage of the channel access token. This leakage enables attackers to exploit the system...

PT-2024-19575 · Flycms · Flycms

Name of the Vulnerable Software and Affected Versions: FlyCms version 1.0 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. It can be exploited via the "/system/email/email conf updagte" API endpoint. This vulnerability allows an attacker to perform unauthorized actions o...

PT-2024-1206 · Oracle · Oracle E-Business Suite +1

Name of the Vulnerable Software and Affected Versions: Oracle E-Business Suite versions 12.2.3 through 12.2.13 Description: The issue is related to insufficient input validation in the Login - SSO component of the Oracle Application Object Library product. This allows an unauthenticated attacker...

PT-2024-14293 · Piwigo · Piwigo

Name of the Vulnerable Software and Affected Versions: piwigo version 14.0.0 Description: A Cross Site Scripting issue allows a remote attacker to obtain sensitive information via the lang parameter in the Admin Tools plug-in component. Recommendations: For piwigo version 14.0.0, consider...

PT-2024-14340 · Tenda · Tenda Ax1803

Name of the Vulnerable Software and Affected Versions: Tenda AX1803 version 1.0.0.1 Description: The issue is a stack overflow that occurs via the adv.iptv.stballvlans parameter in the formSetIptv function. Recommendations: For Tenda AX1803 version 1.0.0.1, as a temporary workaround, consider...

PT-2024-13705 · Trendnet · Trendnet Tv-Ip1314Pi

Name of the Vulnerable Software and Affected Versions: TRENDnet TV-IP1314PI version 5.5.3 200714 Description: A stack-based buffer overflow was discovered, leading to arbitrary command execution. This occurs because of a lack of length validation during an sscanf of a user-entered scale field in...

PT-2024-2726 · Mysql Server +8 · Mysql Server +8

Name of the Vulnerable Software and Affected Versions: OpenSSL versions prior to the fixed version MySQL Server versions 8.0.36 and earlier, 8.3.0 and earlier Description: The POLY1305 MAC implementation in OpenSSL contains a bug that might corrupt the internal state of applications running on...

Video series discussing the major threat actor trends from 2023

In this video series, Talos Director of Threat Intelligence and Interdiction Matt Olney and Head of Outreach Nick Biasini share their insights on the most significant cybersecurity threats from the past year. From attacks on network infrastructure to the latest APT activities, as well as an updat...