PT-2024-34249 · Unknown · Amilia Store

Name of the Vulnerable Software and Affected Versions: Amilia Store versions 2.9.8 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS attacks. Recommendations: For Amilia...

PT-2024-8854 · D Link · D-Link Dir-820L

Name of the Vulnerable Software and Affected Versions: D-Link DIR-820L version 1.05b03 Description: The issue is related to the ping v4 and ping v6 functions in the D-Link DIR-820L router's firmware, which fails to properly sanitize data when handling the ping addr parameter. This can allow a...

PT-2024-16273 · Wavlink · Wavlink Wn572Hp3 +1

Name of the Vulnerable Software and Affected Versions: WAVLINK WN530H4 versions up to 20221028 WAVLINK WN530HG4 versions up to 20221028 WAVLINK WN572HG3 versions up to 20221028 Description: A critical issue affects the set ipv6 function of the firewall.cgi file, where manipulation of the...

PT-2024-16268 · Unknown · Project Worlds Student Project Allocation System

Name of the Vulnerable Software and Affected Versions: Project Worlds Student Project Allocation System version 1.0 Description: A critical issue was found in the Project Selection Page component, specifically in the /student/project selection/project selection.php file. The manipulation of the...

PT-2024-16272 · Unknown · Codezips Pet Shop Management System

Name of the Vulnerable Software and Affected Versions: Codezips Pet Shop Management System version 1.0 Description: A critical issue has been found in the system, affecting the /deleteanimal.php file, where the manipulation of the t1 argument leads to SQL injection. The attack can be initiated...

GHSA-7H8M-PVW3-5GH4 Rancher allows privilege escalation in Windows nodes due to Insecure Access Control Lists

Impact A vulnerability has been identified whereby Rancher Manager deployments containing Windows nodes have weak Access Control Lists ACL, allowing BUILTIN\Users or NT AUTHORITY\Authenticated Users to view or edit sensitive files which could lead to privilege escalation. The affected files inclu...

Denied Host Validation Bypass in Zitadel Actions

Summary A flaw in the URL validation mechanism of Zitadel actions allows bypassing restrictions intended to block requests to localhost 127.0.0.1. The isHostBlocked check, designed to prevent such requests, can be circumvented by creating a DNS record that resolves to 127.0.0.1. This enables...

CVE-2024-49753 Denied Host Validation Bypass in Zitadel Actions

Zitadel is open-source identity infrastructure software. Versions prior to 2.64.1, 2.63.6, 2.62.8, 2.61.4, 2.60.4, 2.59.5, and 2.58.7 have a flaw in the URL validation mechanism of Zitadel actions allows bypassing restrictions intended to block requests to localhost 127.0.0.1. The isHostBlocked...

PT-2024-31765 · Musasi · Musasi

Name of the Vulnerable Software and Affected Versions: MUSASI version 3 Description: The issue is related to the use of client-side authentication. If exploited, it may allow retrieval of other users' credentials and sensitive information. Recommendations: For MUSASI version 3, consider disabling...

PT-2024-11558 · Ovaledge · Ovaledge

Name of the Vulnerable Software and Affected Versions: OvalEdge versions 5.2.8.0 and earlier Description: The issue is related to multiple Stored XSS also known as Persistent or Type II vulnerabilities. These vulnerabilities can be exploited via a POST request to the "/profile/updateProfile" API...

PT-2024-11553 · Ovaledge · Ovaledge

Name of the Vulnerable Software and Affected Versions: OvalEdge versions 5.2.8.0 and earlier Description: The issue allows for an Account Takeover via a POST request to "/profile/updateProfile" using the userId and email parameters. Authentication is required to exploit this issue. Recommendation...

PT-2024-11555 · Ovaledge · Ovaledge

Name of the Vulnerable Software and Affected Versions: OvalEdge versions 5.2.8.0 and earlier Description: The issue allows for an Account Takeover via a POST request to "/profile/updateProfile" using the userId and email parameters. Authentication is required to exploit this issue. Recommendation...

PT-2024-16228 · Safenet · Esafenet Cdg

Name of the Vulnerable Software and Affected Versions: ESAFENET CDG version 5 Description: A critical issue has been found, affecting the actionPassOrNotAutoSign function in the /com/esafenet/servlet/service/processsign/AutoSignService.java file. The manipulation of the UniqueId argument leads to...

PT-2024-39897 · WordPress · Eventprime – Events Calendar

Name of the Vulnerable Software and Affected Versions: The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress versions up to, and including, 4.0.4.7 Description: The issue is related to Stored Cross-Site Scripting via the ep booking attendee fields fields due to insufficient...

PT-2024-33103 · Assimp +2 · Assimp +2

Name of the Vulnerable Software and Affected Versions: assimp version 5.4.3 Description: An issue in the Assimp library allows a local attacker to execute arbitrary code via the CallbackToLogRedirector function. This enables the attacker to potentially gain control over the system. Recommendation...

PT-2025-18318 · Xwiki · Xwiki

Name of the Vulnerable Software and Affected Versions: XWiki versions 15.3-rc-1 through 15.10.14 XWiki versions 16.0.0-rc-1 through 16.4.6 XWiki versions 16.5.0-rc-1 through 16.10.0-rc-1 Description: The issue allows a user with access to pages in the XWiki space to access the...

PT-2024-16206 · Sourcecodester · Best House Rental Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Best House Rental Management System version 1.0 Description: A vulnerability was found in the Manage Tenant Details component, specifically affecting the /index.php?page=tenants file. The issue arises from the manipulation of t...

CVE-2024-49756 AshPostgres empty, atomic, non-bulk actions, policy bypass for side-effects vulnerability.

AshPostgres is the PostgreSQL data layer for Ash Framework. Starting in version 2.0.0 and prior to version 2.4.10, in certain very specific situations, it was possible for the policies of an update action to be skipped. This occurred only on "empty" update actions no changing fields, and would...

BIT-HUBBLE-RELAY-2024-47825 CIDR deny policies may not take effect when a more narrow CIDR allow is present

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Starting in version 1.14.0 and prior to versions 1.14.16 and 1.15.10, a policy rule denying a prefix that is broader than /32 may be ignored if there is a policy rule referencing a more narrow prefix CIDRSe...

BIT-CILIUM-2024-47825 CIDR deny policies may not take effect when a more narrow CIDR allow is present

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Starting in version 1.14.0 and prior to versions 1.14.16 and 1.15.10, a policy rule denying a prefix that is broader than /32 may be ignored if there is a policy rule referencing a more narrow prefix CIDRSe...