PT-2024-13450 · Unknown +1 · Readymedia +1

Name of the Vulnerable Software and Affected Versions: ReadyMedia MiniDLNA version 1.3.3 Description: A stack-buffer-overflow issue allows attackers to cause a denial of service via the SendContainer function at tivo commands.c. Recommendations: For ReadyMedia MiniDLNA version 1.3.3, consider...

CarrierWave content-Type allowlist bypass vulnerability which possibly leads to XSS remained

Impact The vulnerability CVE-2023-49090 wasn't fully addressed. This vulnerability is caused by the fact that when uploading to object storage, including Amazon S3, it is possible to set a Content-Type value that is interpreted by browsers to be different from what's allowed by...

PT-2024-23252 · Emacs +9 · Emacs +9

Name of the Vulnerable Software and Affected Versions: Emacs versions prior to 29.3 Description: The issue concerns how Gnus in Emacs handles inline MIME contents, treating them as trusted. This could potentially lead to security issues, although specific details about exploitation or affected...

PT-2024-22413 · Scalapay · Scalapay

Name of the Vulnerable Software and Affected Versions: Scalapay versions 1.2.41 and earlier Description: The issue allows a remote attacker to escalate privileges via the ScalapayReturnModuleFrontController::postProcess method. This is a SQL injection vulnerability. Recommendations: For Scalapay...

OESA-2024-1321 python-aiosmtpd security update

This is a server for SMTP and related protocols, similar in utility to the standard library's smtpd.py module, but rewritten to be based on asyncio for Python 3. Security Fixes: aiosmtpd is a reimplementation of the Python stdlib smtpd.py based on asyncio. aiosmtpd is vulnerable to inbound SMTP...

PT-2024-22365 · Unknown · Lakernote Easyadmin

Name of the Vulnerable Software and Affected Versions: lakernote EasyAdmin up to 20240315 Description: A critical vulnerability has been found in lakernote EasyAdmin. This affects an unknown part of the file /ureport/designer/saveReportFile. The manipulation of the file argument leads to path...

PT-2024-21762 · Cigesv2 · Cigesv2

Name of the Vulnerable Software and Affected Versions: CIGESv2 affected versions not specified Description: The issue is related to a SQL injection vulnerability in the CIGESv2 system. This vulnerability can be exploited through the /ajaxSubServicios.php endpoint, specifically in the idServicio...

PT-2024-22463 · Unknown · Niushop B2B2C

Name of the Vulnerable Software and Affected Versions: Niushop B2B2C versions 5.3.3 and earlier Description: The issue allows an attacker to escalate privileges via the deleteArea function of the Address.php component or the setPrice function of the Goodsbatchset.php component. This is a SQL...

PT-2024-21771 · Cigesv2 · Cigesv2

Name of the Vulnerable Software and Affected Versions: CIGESv2 affected versions not specified Description: The issue is related to a SQL injection vulnerability in the CIGESv2 system. This vulnerability can be exploited through the /ajaxServiciosAtencion.php endpoint, specifically in the...

PT-2024-22794

Name of the Vulnerable Software and Affected Versions Mobile Security Framework MobSF versions 3.9.5 Beta and prior Description The issue arises from the lack of input validation when extracting hostnames in android:host, allowing requests to be sent to local hostnames. This can lead to server-si...

Jira - CVE-2024-22243

h3. Issue Summary We have several Customers waiting for a response about the vulnerability CVE-2024-22243|https://nvd.nist.gov/vuln/detail/CVE-2024-22243, if it affects Atlassian products, in particular, Jira Data Center. h3. Steps to Reproduce Run Generic Security Scan Tool h3. Expected Results...

CVE-2024-27922

TOMP Bare Server implements the TompHTTP bare server. A vulnerability in versions prior to 2.0.2 relates to insecure handling of HTTP requests by the @tomphttp/bare-server-node package. This flaw potentially exposes the users of the package to manipulation of their web traffic. The impact may var...

PT-2024-2346 · Tenda · Tenda Ac10

Name of the Vulnerable Software and Affected Versions: Tenda AC10U version 15.03.06.48 Description: A critical issue was found in the function formSetPPTPServer of the file /goform/SetPptpServerCfg. The manipulation of the argument endIP leads to a stack-based buffer overflow. This can be initiat...

PT-2024-22186 · WordPress · Wp Responsive Tabs Horizontal Vertical/Accordion Tabs

Name of the Vulnerable Software and Affected Versions: WP Responsive Tabs horizontal vertical and accordion Tabs versions 1.1.17 and earlier Description: The issue is related to improper neutralization of input during web page generation, which can lead to stored cross-site scripting XSS. This...

PT-2024-22172 · WordPress · Dsgvo All In One For Wp

Name of the Vulnerable Software and Affected Versions: DSGVO All in one for WP versions n/a through 4.3 Description: A Cross-Site Request Forgery CSRF issue affects the software, allowing unauthorized actions to be performed on behalf of a user without their knowledge or consent. Recommendations:...

PT-2024-23102 · Unknown · Sentrifugo

Name of the Vulnerable Software and Affected Versions: Sentrifugo version 3.2 Description: A Cross-Site Scripting XSS issue exists in Sentrifugo, specifically through the /sentrifugo/index.php/sitepreference/add endpoint, where the description parameter is vulnerable. This could allow a remote us...

PT-2024-23096 · Unknown · Sentrifugo

Name of the Vulnerable Software and Affected Versions: Sentrifugo version 3.2 Description: The issue is related to a SQL injection vulnerability. It could allow a remote user to send a specially crafted query to the server and extract all the data from it. The vulnerability is exploited through t...

CVE-2024-29037

datahub-helm provides the Kubernetes Helm charts for deploying Datahub and its dependencies on a Kubernetes cluster. Starting in version 0.1.143 and prior to version 0.2.182, due to configuration issues in the helm chart, if there was a successful initial deployment during a limited window of tim...

CVE-2024-29037 Default secret use for initial deployment

datahub-helm provides the Kubernetes Helm charts for deploying Datahub and its dependencies on a Kubernetes cluster. Starting in version 0.1.143 and prior to version 0.2.182, due to configuration issues in the helm chart, if there was a successful initial deployment during a limited window of tim...

CVE-2024-29037 Default secret use for initial deployment

datahub-helm provides the Kubernetes Helm charts for deploying Datahub and its dependencies on a Kubernetes cluster. Starting in version 0.1.143 and prior to version 0.2.182, due to configuration issues in the helm chart, if there was a successful initial deployment during a limited window of tim...