PT-2024-5664 · Korenix · Korenix Jetport 5601V3

Name of the Vulnerable Software and Affected Versions: Korenix JetPort 5601v3 versions 1.2 and earlier Description: The issue is related to the missing encryption of sensitive data, which allows eavesdropping. This can be exploited by a remote attacker to bypass existing security restrictions...

PT-2024-23648 · Netentsec · Netentsec Ns-Asg

Name of the Vulnerable Software and Affected Versions: netentsec NS-ASG version 6.3 Description: The issue is related to SQL Injection, which can be exploited via the "/admin/address interpret.php" API endpoint. There is no information provided about the estimated number of potentially affected...

PT-2024-3606 · Foxit · Foxit Reader

Name of the Vulnerable Software and Affected Versions: Foxit Reader version 2024.1.0.23997 Description: A type confusion vulnerability exists in the way Foxit Reader handles a Lock object. This can be triggered by a specially crafted Javascript code inside a malicious PDF document, leading to...

PT-2024-23810 · Unknown · Youdiancms

Name of the Vulnerable Software and Affected Versions: YouDianCMS versions up to 9.5.12 Description: A critical issue was found in YouDianCMS, affecting the file AppLibActionAdminChannelAction.class.php. The manipulation of the file argument leads to unrestricted upload. This issue can be exploit...

PT-2024-10839 · Discuzx · Discuzx

Name of the Vulnerable Software and Affected Versions: DiscuzX versions up to 3.4-20200818 Description: A problematic issue was found in the function show next step of the file upload/install/include/install function.php. The manipulation of the argument uchidden leads to cross-site scripting. It...

PT-2024-22678 · Unknown · Jumpserver

Name of the Vulnerable Software and Affected Versions: JumpServer versions prior to 3.10.6 Description: The issue allows an authenticated user to exploit the Insecure Direct Object Reference IDOR vulnerability in the file manager's bulk transfer by manipulating job IDs to upload malicious files,...

PT-2024-23614 · Qdrant · Qdrant

Name of the Vulnerable Software and Affected Versions: Qdrant versions 1.6.1 through 1.8.2 Description: A critical issue affects some unknown processing of the file lib/collection/src/collection/snapshots.rs of the component Full Snapshot REST API, leading to path traversal. The manipulation of...

PT-2024-23398 · Woocommerce · Wholesale For Woocommerce

Name of the Vulnerable Software and Affected Versions: Wholesale For WooCommerce versions prior to 2.3.0 Description: A Missing Authorization issue has been identified. This issue allows unauthorized access, potentially leading to data breaches or other security incidents. The estimated number of...

PT-2024-23121 · Unknown · Electron Packager

Name of the Vulnerable Software and Affected Versions: Electron Packager versions prior to 18.3.1 Description: A random segment of 1-10kb of Node.js heap memory allocated either side of a known buffer will be leaked into the final executable. This memory could contain sensitive information such a...

PT-2024-2499 · Argo Cd · Argo Cd

Name of the Vulnerable Software and Affected Versions: Argo CD versions 2.4 through 2.10.2 Argo CD versions 2.4 through 2.9.7 Argo CD versions 2.4 through 2.8.11 Description: The issue is related to the loadRepoIndex function in Argo CD's helm package, which does not limit the size or time while...

GHSA-MRJ3-F2H4-7W45 Saleor: Customers' addresses leak when using Warehouse as a `Pickup: Local stock only` delivery method

Summary Using Pickup: Local stock only as a click-and-collect points could cause a leak of customer addresses Details When using Pickup: Local stock only click-and-collect as a delivery method in specific conditions the customer could overwrite the warehouse address with its own, which exposes it...

GHSA-HR5W-CWWQ-2V4M ZITADEL's Improper Content-Type Validation Leads to Account Takeover via Stored XSS + CSP Bypass

Impact ZITADEL users can upload their own avatar image and various image types are allowed. Due to a missing check, an attacker could upload HTML and pretend it is an image to gain access to the victim's account in certain scenarios. A possible victim would need to directly open the supposed imag...

PT-2024-23505 · Tenda · Tenda Fh1202

Name of the Vulnerable Software and Affected Versions: Tenda FH1202 version 1.2.0.14408 Description: The issue is a stack overflow vulnerability in the urls parameter of the saveParentControlInfo function. This vulnerability can be exploited, potentially allowing attackers to execute arbitrary...

PT-2024-23512 · Tenda · Tenda F1203

Name of the Vulnerable Software and Affected Versions: Tenda FH1203 version 2.0.1.6 Description: The issue is a stack overflow vulnerability in the security parameter of the formWifiBasicSet function. This vulnerability can be exploited, potentially allowing unauthorized access or control...

PT-2024-2454 · Tenda · Tenda F1203

Name of the Vulnerable Software and Affected Versions: Tenda FH1203 version 2.0.1.6 Description: The issue is related to a stack overflow vulnerability in the security 5g parameter of the formWifiBasicSet function. This vulnerability can be exploited by a remote attacker to impact the...

Cisco IOS and IOS XE Software Intermediate System-to-Intermediate System Denial of Service Vulnerability

A vulnerability in the Intermediate System-to-Intermediate System IS-IS protocol of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, adjacent attacker to cause a denial of service DoS condition on an affected device. This vulnerability is due to insufficient input...

PT-2024-23000 · Tenda · Tenda F1203

Name of the Vulnerable Software and Affected Versions: Tenda F1203 version 2.0.1.6 Description: A critical issue was found in the function R7WebsSecurityHandler of the file /goform/execCommand. The manipulation of the argument password leads to a stack-based buffer overflow. This issue can be...

PT-2024-23161 · Tenda · Tenda F1203

Name of the Vulnerable Software and Affected Versions: Tenda FH1203 version 2.0.1.6 Description: A critical issue has been found, affecting the function GetParentControlInfo of the file "/goform/GetParentControlInfo". The manipulation of the argument mac leads to a stack-based buffer overflow. Th...

PT-2024-2551 · Cisco · Cisco Ios Xe

Name of the Vulnerable Software and Affected Versions: Cisco IOS XE Software affected versions not specified Description: The issue is related to improper handling of error conditions in the Data Model Interface DMI services of Cisco IOS XE Software when a device administrator updates an IPv4...

PT-2024-22835 · Synology · Synology Surveillance Station

Name of the Vulnerable Software and Affected Versions: Synology Surveillance Station versions prior to 9.2.0-11289 Synology Surveillance Station versions prior to 9.2.0-9289 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used...