PT-2024-20241 · Unknown · Novel-Plus

Name of the Vulnerable Software and Affected Versions: Novel-Plus versions 4.3.0-RC1 and prior Description: An arbitrary file download issue exists, allowing an attacker to download files by passing specially crafted filePath and fileName parameters to the fileDownload function in the...

PT-2024-20472

Name of the Vulnerable Software and Affected Versions Allegro AI’s ClearML platform versions 0.17.0 through 1.14.2 Description Deserialization of untrusted data can occur in the client SDK of Allegro AI’s ClearML platform, enabling a maliciously uploaded artifact to run arbitrary code on an end...

PT-2024-20473

Name of the Vulnerable Software and Affected Versions Allegro AI's ClearML platform versions 1.4.0 through 1.14.1 Description A path traversal vulnerability in the client SDK of Allegro AI's ClearML platform enables a maliciously uploaded dataset to write local or remote files to an arbitrary...

PT-2024-17641 · Beijing Baichuo · Smart S40 Management Platform

Name of the Vulnerable Software and Affected Versions: Beijing Baichuo Smart S40 Management Platform versions up to 20240126 Description: A critical issue has been found in the Smart S40 Management Platform, affecting some unknown functionality of the file /useratte/web.php of the component Impor...

PT-2024-20339 · Yzmcms · Yzmcms

Name of the Vulnerable Software and Affected Versions: yzmcms version 7.0 Description: An issue in the component /member/index/login of yzmcms allows attackers to direct users to malicious sites via a crafted URL. Recommendations: For yzmcms version 7.0, consider restricting access to the...

PT-2024-17634 · Tongda Oa · Tongda Oa

Name of the Vulnerable Software and Affected Versions: Tongda OA 2017 versions up to 11.10 Description: A critical vulnerability has been found in Tongda OA. The issue affects an unknown function of the file /general/email/outbox/delete.php. The manipulation of the DELETE STR argument leads to SQ...

PT-2024-17658 · Jspxcms · Jspxcms

Name of the Vulnerable Software and Affected Versions: Jspxcms version 10.2.0 Description: A vulnerability was found in Jspxcms, classified as problematic. It affects an unknown function of the file /ext/collect/find text.do. The manipulation leads to cross site scripting and can be launched...

GHSA-GFRH-GWQC-63CV Sulu HTML Injection via Autocomplete Suggestion

Impact It is an issue when input HTML into the Tag name. The HTML is execute when the tag name is listed in the auto complete form. Only admin users are affected and only admin users can create tags. Patches Has the problem been patched? What versions should users upgrade to? The problem is patch...

PT-2024-6391 · Gpac +2 · Gpac +2

Name of the Vulnerable Software and Affected Versions: GPAC version 2.2.1 Description: The issue is related to a Use-After-Free UAF vulnerability in the dasher configure pid function. This vulnerability can be exploited by a remote attacker to cause a denial of service. The dasher configure pid...

PT-2024-19270 · Phpmyfaq · Phpmyfaq

Name of the Vulnerable Software and Affected Versions: phpMyFAQ versions prior to 3.2.5 Description: The issue allows an attacker to spoof another user's details, making a compelling phishing case for removing another user's account. Although the front-end of the user removal page does not allow...

PT-2024-18732 · Samsung · Galaxy Store

Name of the Vulnerable Software and Affected Versions: Galaxy Store versions prior to 4.5.63.6 Description: The issue allows local attackers to access sensitive information via implicit intent due to an implicit intent hijacking vulnerability in the In-App Purchase IAP component of the Galaxy...

PT-2024-14906 · Canon · Color Imageclass Lbp674C +10

Name of the Vulnerable Software and Affected Versions: Satera LBP670C Series/Satera MF750C Series firmware versions 03.07 and earlier Color imageCLASS LBP674C/Color imageCLASS X LBP1333C/Color imageCLASS MF750C Series/Color imageCLASS X MF1333C Series firmware versions 03.07 and earlier i-SENSYS...

Important: cri-tools

Issue Overview: A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of da...

PT-2024-20329 · Unknown · Mediaserver

Name of the Vulnerable Software and Affected Versions: media-server version 1.0.0 Description: The issue is related to a Use-After-Free UAF vulnerability. This vulnerability occurs when the sip subscribe remove function is used. The UAF vulnerability is a type of memory corruption bug that can...

PT-2024-20330 · Unknown · Mediaserver

Name of the Vulnerable Software and Affected Versions: media-server version 1.0.0 Description: A Use-After-Free UAF issue was discovered in the sip uac stop timer function. This issue is related to the /uac/sip-uac-transaction.c file. Recommendations: For media-server version 1.0.0, consider...

PT-2024-1692 · D Link · D-Link Go-Rt-Ac750

Name of the Vulnerable Software and Affected Versions: D-LINK Go-RT-AC750 version GORTAC750 A1 FW v101b03 Description: The issue is related to a hardcoded password for the Alphanetworks account in the D-LINK Go-RT-AC750 router, allowing remote attackers to obtain root access via a telnet session...

PT-2024-20381

Name of the Vulnerable Software and Affected Versions Stimulsoft Dashboard.JS versions prior to 2024.1.2 Description A Cross Site Scripting issue allows a remote attacker to execute arbitrary code via a crafted payload to the "search bar component". This enables the attacker to perform unauthoriz...

Xen: Multiple Vulnerabilities

Background Xen is a bare-metal hypervisor. Description Multiple vulnerabilities have been discovered in Xen. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details. Workaround There is no known workaround at this time...

Nervos CKB Transaction which calls syscall load_cell_data_hash has nondeterministic result

Impact Tx-pool verify transaction which inputs' script contains loadcelldatahash is nondeterministic Workarounds Enforce tx-pool ResolvedTrascation inputs' load data is none...

GHSA-Q73F-W3H7-7WCC Nervos CKB Transaction which calls syscall load_cell_data_hash has nondeterministic result

Impact Tx-pool verify transaction which inputs' script contains loadcelldatahash is nondeterministic Workarounds Enforce tx-pool ResolvedTrascation inputs' load data is none...