PT-2024-37617 · Mesbook · Mesbook

Name of the Vulnerable Software and Affected Versions: MESbook version 20221021.03 Description: The issue allows an unauthenticated remote attacker to register user accounts without authentication. This can be done by accessing the "/account/Register/" route and providing parameters such as...

CVE-2024-36401

GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.22.6, 2.23.6, 2.24.4, and 2.25.2, multiple OGC request parameters allow Remote Code Execution RCE by unauthenticated users through specially crafted input against a default GeoServer...

PT-2024-28403 · Gradio · Gradio

Name of the Vulnerable Software and Affected Versions: Gradio version 4.36.1 Description: A code injection issue was discovered in Gradio via the component /gradio/component meta.py. This issue is triggered by a crafted input. Note that the supplier disputes this report as it involves a user...

PT-2024-5848

Name of the Vulnerable Software and Affected Versions Apache HTTP Server versions 2.4.59 and earlier Description The issue is related to a substitution encoding problem in the mod rewrite module of the Apache HTTP Server, allowing an attacker to execute scripts in directories permitted by the...

PT-2024-37608 · Ingenico · Ingenico Estate Manager

Name of the Vulnerable Software and Affected Versions: Ingenico Estate Manager version 2023 Description: A problematic vulnerability was found in the New Widget Handler component, affecting an unknown functionality of the file /emgui/rest/preferences/PREF HOME PAGE/sponsor/3/. The manipulation of...

PT-2024-4823 · Ibm · Ibm Infosphere Information Server

Name of the Vulnerable Software and Affected Versions: IBM InfoSphere Information Server version 11.7 Description: The issue is related to cross-site request forgery, which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. This...

PT-2024-4814 · Ibm · Ibm Infosphere Information Server

Name of the Vulnerable Software and Affected Versions: IBM InfoSphere Information Server version 11.7 Description: The issue is related to the disclosure of information through a query string, potentially allowing a remote attacker to gain unauthorized access to protected information. This could ...

PT-2024-5888 · Envoy +1 · Envoy +1

Name of the Vulnerable Software and Affected Versions: Envoy versions prior to 1.30.4 Envoy versions prior to 1.29.7 Envoy versions prior to 1.28.5 Envoy versions prior to 1.27.7 Description: The issue is related to a use-after-free error in the Envoy proxy server module. Exploitation of this iss...

OESA-2024-1779 rubygem-actionpack security update

Eases web-request routing, handling, and response as a half-way front, half-way page controller. Implemented with specific emphasis on enabling easy unit/integration testing that doesn't require a browser. Security Fixes: Action Pack is a framework for handling and responding to web requests. Und...

OESA-2024-1778 rubygem-actionpack security update

Eases web-request routing, handling, and response as a half-way front, half-way page controller. Implemented with specific emphasis on enabling easy unit/integration testing that doesn't require a browser. Security Fixes: Action Pack is a framework for handling and responding to web requests. Und...

OESA-2024-1762 rubygem-activesupport security update

A toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Rich support for multibyte strings, internationalization, time zones, and testing. Security Fixes: Action Pack is a framework for handling and responding to web requests. Under certain circumstances respon...

PT-2024-28370 · Idccms · Idccms

Name of the Vulnerable Software and Affected Versions: idccms version 1.35 Description: A Cross-Site Request Forgery CSRF issue was discovered in the component "/admin/userSys deal.php?mudi=infoSet". This allows for potential unauthorized actions on the affected system. Recommendations: For idccm...

PT-2024-28360 · Zziplib +1 · Zziplib +1

Name of the Vulnerable Software and Affected Versions: zziplib version 0.13.77 Description: A Heap Buffer Overflow issue allows attackers to cause a denial of service. This is achieved through the zzip parse root directory function located at /zzip/zip.c. Recommendations: For zziplib version...

Astra Linux – Vulnerability in Composer

Composer is a dependency manager for PHP. On the 2.x branch, prior to versions 2.2.24 and 2.7.7, the status, reinstall, and remove commands, when packages were installed from sources via Git, could allow execution of malicious code if the branch name contained specially crafted text in the...

PT-2024-25203 · Lumisxp · Lumisxp

Name of the Vulnerable Software and Affected Versions: Lumisxp versions 15.0.x through 16.1.x Description: A cross-site scripting XSS issue in the UrlAccessibilityEvaluation.jsp component allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the contentHtml...

PT-2024-34936 · Unknown · Mudler/Localai

Name of the Vulnerable Software and Affected Versions: mudler/localai version 2.14.0 Description: A command injection issue exists due to the application's handling of the backend parameter in the configuration file. This parameter is used in the name of the initialized process, allowing an...

PT-2024-37520

Name of the Vulnerable Software and Affected Versions: WordPress plugins affected versions not specified Description: A malicious threat actor has compromised the source code of various WordPress plugins hosted on WordPress.org, injecting malicious PHP scripts. These scripts exfiltrate database...

PT-2024-34002 · Ipswitch · Whatsup Gold

Name of the Vulnerable Software and Affected Versions: WhatsUp Gold versions prior to 2023.1.3 Description: A path traversal issue exists, allowing information disclosure through a specially crafted unauthenticated HTTP request to the AppProfileImport endpoint. Recommendations: For versions prior...

PT-2024-5800 · Openvpn +6 · Openvpn +6

Name of the Vulnerable Software and Affected Versions: OpenVPN versions 2.6.0 through 2.6.10 Description: The issue is related to OpenVPN's handling of exit notifications from authenticated clients in a server role. When multiple exit notifications are accepted, it can extend the validity of a...

PT-2024-28053

Name of the Vulnerable Software and Affected Versions pdoc versions prior to 14.5.1 Description The issue arises from documentation generated with pdoc --math being linked to JavaScript files from polyfill.io. The polyfill.io CDN has been sold and now serves malicious code, leading to a supply...