PT-2024-19916 · Cincopa · Cincopa Post Video Players

Name of the Vulnerable Software and Affected Versions: Cincopa Post Video Players versions 1.159 and earlier Description: A Cross-Site Request Forgery CSRF issue affects Cincopa Post Video Players. This issue allows for malicious requests to be made on behalf of the user without their knowledge o...

PT-2024-23164 · Nuuo · Nuuo Camera

Name of the Vulnerable Software and Affected Versions: NUUO Camera up to 20240319 Description: A vulnerability was found in the processing of the file /deletefile.php, where the manipulation of the argument filename leads to denial of service. The attack may be initiated remotely. The exploit has...

PT-2024-12463 · Uncanny · Uncanny Toolkit For Learndash

Name of the Vulnerable Software and Affected Versions: Uncanny Toolkit for LearnDash versions 3.6.4.3 and earlier Description: The issue is related to a URL Redirection to Untrusted Site, also known as an 'Open Redirect' vulnerability. This vulnerability allows an attacker to redirect users to...

PT-2024-23283 · Supsystic · Supsystic Slider

Name of the Vulnerable Software and Affected Versions: Supsystic Slider by Supsystic versions 1.8.10 and earlier Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for potential exploitation by...

TinyMCE Cross-Site Scripting (XSS) vulnerability in handling iframes

Impact A cross-site scripting XSS vulnerability was discovered in TinyMCE’s content insertion code. This allowed iframe elements containing malicious code to execute when inserted into the editor. These iframe elements are restricted in their permissions by same-origin browser protections, but...

PT-2024-22906 · Unknown · Campcodes Online Examination System

Name of the Vulnerable Software and Affected Versions: Campcodes Online Examination System version 1.0 Description: A critical issue was found in the system, affecting an unknown function of the file /adminpanel/admin/facebox modal/updateExaminee.php. The manipulation of the id argument leads to...

PT-2024-22457 · Tenda · Tenda Ac18

Name of the Vulnerable Software and Affected Versions: Tenda AC18 version 15.03.05.05 Description: The issue is related to a stack overflow vulnerability in the ssid parameter of the form fast setting wifi set function. This vulnerability can be exploited, potentially allowing unauthorized access...

PT-2024-12796 · Avada · Avada

Name of the Vulnerable Software and Affected Versions: Avada versions n/a through 7.11.1 Description: The issue is related to an Unrestricted Upload of File with Dangerous Type vulnerability. This allows for the upload of files with potentially dangerous types, which could lead to security issues...

PT-2024-13815 · Klbtheme · Klbtheme Clotya +5

Name of the Vulnerable Software and Affected Versions: KlbTheme Cosmetsy theme core plugin versions 1.3.0 and earlier KlbTheme Partdo theme core plugin versions 1.0.9 and earlier KlbTheme Bacola theme core plugin versions 1.3.3 and earlier KlbTheme Medibazar theme core plugin versions 1.2.3 and...

PT-2024-22281 · Easyrange · Easyrange

Name of the Vulnerable Software and Affected Versions: EasyRange Ver 1.41 Description: The issue with the executable file search path when displaying an extracted file on Explorer may lead to loading an executable file that resides in the same folder where the extracted file is placed. If this...

PT-2024-19175

Name of the Vulnerable Software and Affected Versions gradio-app/gradio affected versions not specified Description A vulnerability exists due to insufficient validation of user-supplied URLs in the "/proxy" route. Attackers can exploit this by manipulating the self.replica urls set through the...

PT-2024-13304 · Mesa +2 · Mesa +2

Name of the Vulnerable Software and Affected Versions: Mesa version 23.0.4 Description: A segmentation violation was discovered in glx pbuffer.c when calling glXGetDrawableAttribute. This issue is disputed as there are no common situations where users require uninterrupted operation with an...

PT-2024-12130 · Onthegosystems · Onthegosystems Types

Name of the Vulnerable Software and Affected Versions: OnTheGoSystems Types versions 3.4.17 and earlier Description: The issue is related to an Unrestricted Upload of File with Dangerous Type, which affects OnTheGoSystems Types. Recommendations: For versions 3.4.17 and earlier, update to a versio...

PT-2024-2596 · Tenda · Tenda Ac7

Name of the Vulnerable Software and Affected Versions: Tenda AC7 version 15.03.06.44 Description: A critical issue has been discovered in the Tenda AC7, specifically in the function formSetCfm located in the "/goform/setcfm" file. This issue is caused by the manipulation of the funcpara1 argument...

PT-2024-22961 · Dedecms · Dedecms

Name of the Vulnerable Software and Affected Versions: DedeCMS version 5.7 Description: A Cross-Site Request Forgery CSRF issue was discovered in DedeCMS, specifically via the component /src/dede/makehtml homepage.php, allowing a remote attacker to execute arbitrary code. Recommendations: For...

CarrierWave content-Type allowlist bypass vulnerability which possibly leads to XSS remained

Impact The vulnerability CVE-2023-49090 wasn't fully addressed. This vulnerability is caused by the fact that when uploading to object storage, including Amazon S3, it is possible to set a Content-Type value that is interpreted by browsers to be different from what's allowed by...

GHSA-3WC5-FCW2-2329 KaTeX missing normalization of the protocol in URLs allows bypassing forbidden protocols

Impact Code that uses KaTeX's trust option, specifically that provides a function to block-list certain URL protocols, can be fooled by URLs in malicious inputs that use uppercase characters in the protocol. In particular, this can allow for malicious input to generate javascript: links in the...

KaTeX's `\includegraphics` does not escape filename

Impact KaTeX users who render untrusted mathematical expressions could encounter malicious input using \includegraphics that runs arbitrary JavaScript, or generate invalid HTML. Patches Upgrade to KaTeX v0.16.10 to remove this vulnerability. Workarounds Avoid use of or turn off the trust option, ...

Security Bulletin: IBM App Connect Enterprise and IBM Integration Bus for z/OS are vulnerable to a loss of confidentiality (CVE-2024-22356)

Summary IBM App Connect Enterprise and IBM Integration Bus for z/OS are vulnerable to a loss of confidentiality. This bulletin identifies the steps to take to address the vulnerability. Vulnerability Details CVEID:CVE-2024-22356 DESCRIPTION: IBM App Connect Enterprise and IBM Integration Bus for...

PT-2024-22854 · Sourcecodester · Sourcecodester Php Task Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester PHP Task Management System version 1.0 Description: The delete admin users function is vulnerable to SQL Injection. This issue allows for potential exploitation, but no specific details about the estimated number of affected...