PT-2024-3134 · Tenda · Tenda Ac8

Name of the Vulnerable Software and Affected Versions: Tenda AC8 version 16.03.34.09 Description: The issue is related to a stack-based buffer overflow in the formSetRebootTimer function of the /goform/SetRebootTimer API endpoint. This can be exploited by manipulating the rebootTime argument,...

PT-2024-24578 · Unknown · Ads.Txt Admin

Name of the Vulnerable Software and Affected Versions: Ads.Txt Admin versions 1.3 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the Ads.Txt Admin. This is a type of attack where an attacker tricks a user into performing unintended actions on a web application that the...

PT-2024-24437 · Libsyn · Libsyn Publisher Hub

Name of the Vulnerable Software and Affected Versions: Libsyn Publisher Hub versions 1.4.4 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web application...

PT-2024-21614

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.8.0-05205-g77fadd89fe2d-dirty 213 Description The issue arises when the mirred action is used on a classful egress qdisc and a packet is mirrored or redirected to itself, resulting in a qdisc lock deadlock. Thi...

PT-2024-24434 · Unknown · Podlove Podcast Publisher

Name of the Vulnerable Software and Affected Versions: Podlove Podcast Publisher versions through 4.0.12 Description: The issue is related to an Improper Neutralization of Special Elements used in an SQL Command, also known as a SQL Injection vulnerability. This allows for potential exploitation ...

PT-2024-10421 · Kde +4 · Kde Plasma Workspace +4

Name of the Vulnerable Software and Affected Versions: KDE Plasma Workspace versions prior to 5.27.11.1 KDE Plasma Workspace 6.x versions prior to 6.0.5.1 Description: The issue allows connections via ICE based purely on the host, i.e., all local connections are accepted. This enables another use...

PT-2024-23076

Name of the Vulnerable Software and Affected Versions Evolution Controller versions 2.04.560.31.03.2024 and below Description The Web interface of Evolution Controller contains poorly configured access control on the DESKTOP EDIT USER GET CARD endpoint, allowing an unauthenticated attacker to...

CVE-2024-29022 Session Hijacking via XSS attack in header and session grid in Xibo CMS

Xibo is an Open Source Digital Signage platform with a web content management system and Windows display player software. In affected versions some request headers are not correctly sanitised when stored in the session and display tables. These headers can be used to inject a malicious script int...

GHSA-4VWX-54MW-VQFW Traefik vulnerable to denial of service with Content-length header

There is a potential vulnerability in Traefik managing requests with Content-length and no body . Sending a GET request to any Traefik endpoint with the Content-length request header results in an indefinite hang with the default configuration. This vulnerability can be exploited by attackers to...

Traefik vulnerable to denial of service with Content-length header

There is a potential vulnerability in Traefik managing requests with Content-length and no body . Sending a GET request to any Traefik endpoint with the Content-length request header results in an indefinite hang with the default configuration. This vulnerability can be exploited by attackers to...

PT-2024-23045 · Timber · Timber

Name of the Vulnerable Software and Affected Versions: Timber versions 1.23.0 and earlier Description: The issue is related to Deserialization of Untrusted Data, which can lead to remote code execution, especially when used with frameworks or developer code that have vulnerable POP chains. This i...

PT-2024-13203 · Cobham · Cobham Sailor Vsat Ku

Name of the Vulnerable Software and Affected Versions: Cobham SAILOR VSAT Ku version 164B019 Description: The issue is related to a Cross Site Scripting XSS vulnerability, which allows a remote attacker to execute arbitrary code via a crafted script to the c set rslog decode function in the acu w...

PT-2024-3328 · Maccms · Maccms

Name of the Vulnerable Software and Affected Versions: Macs CMS version 1.1.4f Description: The issue is related to a lack of protection against SQL injection attacks when handling certain parameters, including resetPassword, forgotPasswordProcess, saveUser, saveRole, deleteUser, deleteRole,...

PT-2024-27180 · Dedecms · Dedecms

Name of the Vulnerable Software and Affected Versions: DedeCMS version 5.7.112-UTF8 Description: A critical issue was found in DedeCMS, affecting an unknown function of the file stepselect main.php. The manipulation of the ids argument leads to SQL injection. This issue can be exploited remotely...

PT-2024-27221 · Sourcecodester · Sourcecodester Computer Laboratory Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Computer Laboratory Management System version 1.0 Description: A security issue has been found that allows cross-site scripting XSS attacks. This is due to the manipulation of the id argument in the /classes/Users.php file, whi...

PT-2024-24235

Name of the Vulnerable Software and Affected Versions: tiagorlampert CHAOS version 5.0.1 Description: A Cross Site Scripting XSS vulnerability exists in tiagorlampert CHAOS. A remote attacker may be able to escalate privileges via the sendCommandHandler function in the handler.go component. A...

PT-2024-5633 · Dell · Dell Storage Resource Manager

Name of the Vulnerable Software and Affected Versions: Dell Storage Resource Manager version 4.9.0.0 and below Description: The issue is related to a session fixation problem in the SRM Windows Host Agent. An unauthenticated attacker on an adjacent network could exploit this, potentially leading ...

GHSA-WM4W-7H2Q-3PF7 Matrix IRC Bridge truncated content of messages can be leaked

Impact The matrix-appservice-irc before version 2.0.0 can be exploited to leak the truncated body of a message if a malicious user sends a Matrix reply to an event ID they don't have access to. As a precondition to the attack, the malicious user needs to know the event ID of the message they want...

PT-2024-15886 · WordPress · Post Blocks +5

Name of the Vulnerable Software and Affected Versions: The Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel WordPress plugin versions prior to 2.2.76 Description: The issue concerns improper authorization in the WordPress plugin, allowing unauthenticated users to...

SpiceDB: LookupSubjects may return partial results if a specific kind of relation is used

Background Use of a relation of the form: relation folder: folder | folderparent with an arrow such as folder-view can cause LookupSubjects to only return the subjects found under subjects for either folder or folderparent. This bug only manifests if the same subject type is used multiple types i...