PT-2024-8742 · Siemens · Tecnomatix Plant Simulation +1

Name of the Vulnerable Software and Affected Versions: Tecnomatix Plant Simulation versions prior to V2302.0018 Tecnomatix Plant Simulation versions prior to V2404.0007 Teamcenter Visualization versions prior to V14.2.0.14 Teamcenter Visualization versions prior to V14.3.0.12 Teamcenter...

PT-2024-34453 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Jpress versions prior to 5.1.1 Description: The issue allows for arbitrary file uploads on the Windows platform. This can lead to the construction of non-standard file formats, such as .jsp, which can result in arbitrary command execution...

PT-2024-8743 · Siemens · Tecnomatix Plant Simulation +1

Name of the Vulnerable Software and Affected Versions: Tecnomatix Plant Simulation versions prior to V2302.0018 Tecnomatix Plant Simulation versions prior to V2404.0007 Teamcenter Visualization versions prior to V14.2.0.14 Teamcenter Visualization versions prior to V14.3.0.12 Teamcenter...

PT-2025-13827 · NetGear · Netgear Wnr854T

Name of the Vulnerable Software and Affected Versions: Netgear WNR854T version 1.5.2 Description: The issue allows an attacker to send a specially crafted request to "post.cgi", updating the wan hostname parameter in nvram, which can lead to command injection and force a reboot. Recommendations:...

CVE-2022-20633

A vulnerability in the web-based management interface of Cisco ECE could allow an unauthenticated, remote attacker to perform a username enumeration attack against an affected device. This vulnerability is due to differences in authentication responses that are sent back from the application as...

CVE-2021-1491

A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to read arbitrary files on the underlying file system of the device. This vulnerability is due to insufficient file scope limiting. An attacker could exploit this...

CVE-2021-1484

A vulnerability in the web UI of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to inject arbitrary commands on an affected system and cause a denial of service DoS condition. This vulnerability is due to improper input validation of user-supplied input to the device...

CVE-2022-20939

A vulnerability in the web-based management interface of Cisco Smart Software Manager On-Prem could allow an authenticated, remote attacker to elevate privileges on an affected system. This vulnerability is due to inadequate protection of sensitive user information. An attacker could exploit this...

CVE-2023-20004

Three vulnerabilities in the CLI of Cisco TelePresence CE and RoomOS could allow an authenticated, local attacker to overwrite arbitrary files on the local file system of an affected device. These vulnerabilities are due to improper access controls on files that are on the local file system. An...

CVE-2023-20036

A vulnerability in the web UI of Cisco IND could allow an authenticated, remote attacker to execute arbitrary commands with administrative privileges on the underlying operating system of an affected device. This vulnerability is due to improper input validation when uploading a Device Pack. An...

Authorization Bypass Through User-Controlled Key in Tables

None...

Mail app does not respect download permissions in shares

None...

OESA-2024-2383 rubygem-actionmailer security update

Email on Rails. Compose, deliver, and test emails using the familiar controller/view pattern. First-class support for multipart email and attachments. Security Fixes: Action Mailer is a framework for designing email service layers. Starting in version 3.0.0 and prior to versions 6.1.7.9, 7.0.8.5,...

PT-2024-13380 · Gpac +2 · Gpac +2

Name of the Vulnerable Software and Affected Versions: GPAC version 2.3-DEV-revrelease Description: A use after free issue exists, specifically in the gf filterpacket del function in filter core/filter.c at line 38. This can lead to a double-free condition, potentially causing the application to...

PT-2024-8904

Name of the Vulnerable Software and Affected Versions: PHP versions 8.1. through 8.1.30 PHP versions 8.2. through 8.2.25 PHP versions 8.3. through 8.3.13 Description: The issue is related to the ldap escape function in PHP, which can cause an integer overflow when given uncontrolled long string...

PT-2024-34378 · Unknown · Python Book

Name of the Vulnerable Software and Affected Versions: python book version V1.0 Description: The issue concerns an Incorrect Access Control vulnerability, which allows attackers to obtain sensitive information of users with different IDs by modifying the ID parameter. This vulnerability exposes...

PT-2024-16852 · Zzcms · Zzcms

Name of the Vulnerable Software and Affected Versions: ZZCMS version 2023 Description: A critical issue affects some unknown functionality of the file /admin/ad list.php?action=pass of the component Keyword Filtering. The manipulation of the keyword argument leads to SQL injection. The attack may...

FortiManager fgfmd remote command execution

Added: 11/15/2024 Background FortiManager is an integrated platform for the centralized management of products in a Fortinet security infrastructure. Problem Missing authentication in the fgfmd service could allow a remote attacker to execute arbitrary commands. Resolution Upgrade to FortiManager...

PT-2024-20405 · Athonet · Athonet Vepc Mme

Name of the Vulnerable Software and Affected Versions: Athonet vEPC MME version 11.4.0 Description: The issue is related to an invalid memory access when handling the ProtocolIE ID field of E-RAB Setup List Context SURes messages. This allows attackers to cause a Denial of Service DoS to the...

GHSA-J3PX-Q95C-9683 zlib-rs stack overflow during decompression with malicious input

A denial of service vulnerability was found in zlib-rs, triggered by specially constructed input. This input causes a stack overflow, resulting in the process using zlib-rs to crash. Impact Due to the way LLVM handles the zlib-rs codebase, tail calls were not guaranteed. This caused certain input...