PT-2024-31615 · Yeti · Yeti

Name of the Vulnerable Software and Affected Versions: Yeti versions prior to 2.1.11 Description: The issue concerns a denial of service vulnerability. Remote user-controlled data tags can lead to Unicode normalization with a compatibility form NFKD. Under Windows, such normalization is costly in...

PT-2024-28540 · Dell · Dell Powerscale Insightiq

Name of the Vulnerable Software and Affected Versions: Dell PowerScale InsightIQ version 5.0 Description: The issue is related to the use of hard-coded credentials in Dell PowerScale InsightIQ. A high-privileged attacker with local access could potentially exploit this, leading to information...

PT-2024-39117 · Totolink · Totolink Ac1200 T8

Name of the Vulnerable Software and Affected Versions: TOTOLINK AC1200 T8 version 4.1.5cu.861 B20230220 Description: A critical vulnerability was found in the TOTOLINK AC1200 T8, affecting unknown code of the file /etc/shadow.sample. The manipulation leads to the use of a hard-coded password. The...

CVE-2024-7627

The Bit File Manager plugin for WordPress is vulnerable to Remote Code Execution in versions 6.0 to 6.5.5 via the 'checkSyntax' function. This is due to writing a temporary file to a publicly accessible directory before performing file validation. This makes it possible for unauthenticated...

PT-2024-39034 · Unknown · Job Portal

Name of the Vulnerable Software and Affected Versions: Job Portal versions affected versions not specified Description: The issue is related to a SQL injection vulnerability. An attacker could send a specially designed query through the id parameter in the "/jobportal/admin/category/index.php"...

CVE-2024-34642

Improper authorization in One UI Home prior to SMR Sep-2024 Release 1 allows physical attackers to temporarily access sensitive information...

CVE-2024-34642

Improper authorization in One UI Home prior to SMR Sep-2024 Release 1 allows physical attackers to temporarily access sensitive information...

CVE-2024-34642

Improper authorization in One UI Home prior to SMR Sep-2024 Release 1 allows physical attackers to temporarily access sensitive information...

PT-2024-38278 · Progress · Openedge

Name of the Vulnerable Software and Affected Versions: OpenEdge LTS versions prior to 11.7.18 OpenEdge LTS versions prior to 12.2.13 Description: A Local ABL Client bypass of the required PASOE security checks may allow an attacker to commit unauthorized code injection into Multi-Session Agents o...

PT-2024-26075 · Unknown · Universalcredentialmanager

Name of the Vulnerable Software and Affected Versions: UniversalCredentialManager versions prior to SMR Sep-2024 Release 1 Description: The issue is related to the incorrect use of privileged API in UniversalCredentialManager, allowing local attackers to access privileged API related to...

PT-2024-6139 · Zyxel · Wax655E +4

Name of the Vulnerable Software and Affected Versions: Zyxel NWA1123ACv3 versions 6.70ABVT.4 and earlier Zyxel WAC500 versions 6.70ABVS.4 and earlier Zyxel WAX655E versions 7.00ACDO.1 and earlier Zyxel WBE530 versions 7.00ACLE.1 and earlier Zyxel USG LITE 60AX version V2.00ACIP.2 Description: The...

PT-2024-31591 · Hoverfly · Hoverfly

Name of the Vulnerable Software and Affected Versions: Hoverfly affected versions not specified Description: The /api/v2/simulation POST handler in Hoverfly allows users to create new simulation views from the contents of a user-specified file. This feature can be abused by an attacker to read...

PT-2024-29371

Name of the Vulnerable Software and Affected Versions phpipam version 1.6 Description The issue is a Cross Site Scripting XSS vulnerability. It occurs through the appadminimport-exportimport-load-data.php file. This allows for potential malicious script execution. Recommendations For phpipam...

PT-2024-31406 · Unknown · Hwameistor

Name of the Vulnerable Software and Affected Versions: Hwameistor versions prior to 0.14.6 Description: Hwameistor is a high-availability local storage system for cloud-native stateful workloads. This ClusterRole has excessive permissions, allowing a malicious user who can access the worker node...

PT-2024-10074

Name of the Vulnerable Software and Affected Versions: GNOME libsoup versions prior to 3.6.1 Description: The issue is related to a buffer overflow in the soup header parse param list strict function of the GNOME libsoup library. This overflow occurs in dynamic memory and is associated with...

PT-2024-30483 · Checkout · Stripe Payments For Woocommerce

Name of the Vulnerable Software and Affected Versions: Stripe Payments For WooCommerce by Checkout versions 1.9.1 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the software, potentially allowing unauthorized actions. Upgrade to a newer version to remediate...

PT-2024-31252 · Unknown · Picuploader

Name of the Vulnerable Software and Affected Versions: PicUploader version fcf82ea Description: A cross-site scripting XSS issue exists in the /master/auth/OnedriveRedirect.php component, allowing attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the error...

PT-2024-38842 · Unknown · Continew Admin

Name of the Vulnerable Software and Affected Versions: ContiNew Admin version 3.2.0 Description: A critical vulnerability was found in ContiNew Admin, affecting the function top.continew.starter.extension.crud.controller.BaseControllertree of the file...

PT-2024-38820 · D Link · Dns-320L +18

Name of the Vulnerable Software and Affected Versions: D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05, and DNS-1550-04 up to 20240814 Description: A...

SUSE CVE-2021-4441

In the Linux kernel, the following vulnerability has been resolved: spi: spi-zynq-qspi: Fix a NULL pointer dereference in zynqqspiexecmemop In zynqqspiexecmemop, kzalloc is directly used in memset, which could lead to a NULL pointer dereference on failure of kzalloc. Fix this bug by adding a chec...