PT-2024-32056 · Draytek · Draytek Vigor 3910

Name of the Vulnerable Software and Affected Versions: Draytek Vigor 3910 version 4.3.2.6 Description: A buffer overflow was discovered in the sProfileName parameter at the "usergrp.cgi" endpoint. This issue allows attackers to cause a Denial of Service DoS via a crafted input. Recommendations: F...

PT-2024-31906 · Frog Cms · Frog Cms

Name of the Vulnerable Software and Affected Versions: FrogCMS version 0.9.5 Description: A Cross-Site Request Forgery CSRF issue was discovered. The issue can be exploited via the /admin/?/plugin/file manager/delete/123 API endpoint. Recommendations: For FrogCMS version 0.9.5, as a temporary...

PT-2024-13406 · Unknown · Chaosblade

Name of the Vulnerable Software and Affected Versions: Chaosblade versions 0.3 through 1.7.3 Description: The issue allows OS command execution via the cmd parameter without authentication when server mode is used. This is related to the exec.CommandContext in Chaosblade. Recommendations: For...

PT-2024-7456 · Vendure · Vendure

Name of the Vulnerable Software and Affected Versions: Vendure versions prior to 3.0.5 and 2.3.3 Description: The issue in Vendure's asset server plugin allows an attacker to craft a request that can traverse the server file system and retrieve the contents of arbitrary files, including sensitive...

PT-2024-32054 · Draytek · Draytek Vigor 3910

Name of the Vulnerable Software and Affected Versions: Draytek Vigor 3910 version 4.3.2.6 Description: A buffer overflow issue was discovered in the extRadSrv2 parameter at the "cgiapp.cgi" endpoint. This issue allows attackers to cause a Denial of Service DoS via a crafted input. Recommendations...

PT-2024-32300 · Runofast · Runofast Indoor Security Camera For Baby Monitor

Name of the Vulnerable Software and Affected Versions: runofast Indoor Security Camera for Baby Monitor affected versions not specified Description: The issue concerns a default password set as password for the root account, allowing unauthorized access to the "/stream1" URI via the rtsp://...

PT-2024-32159 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to 6.6.52 Description: The issue is related to a double put of @cfile in smb2 rename path. When smb2 set path attr is called with a valid @cfile and returns -EINVAL, it is necessary to call cifs get writable path...

CVE-2024-45604

The CVE-2024-45604 entry describes a directory traversal vulnerability in Contao's back-end FileSelector widget, allowing authenticated backend users to list files outside the document root. Affected software is Contao core-bundle; the root cause is insufficient validation of file paths in the Fi...

PT-2024-9895 · Glpi +1 · Fields Plugin +1

Name of the Vulnerable Software and Affected Versions: Fields plugin for GLPI versions prior to 1.21.13 Description: The issue is related to a lack of protection against SQL injection attacks in the Fields plugin for GLPI. This allows an authenticated user to perform a SQL injection when the plug...

PT-2024-40087 · Unknown +1 · Phpspreadsheet +1

Name of the Vulnerable Software and Affected Versions: Kimai versions affected versions not specified PHPSpreadsheet versions affected versions not specified Description: The issue is related to an XXE vulnerability in PHPSpreadsheet, which is used by Kimai for importing and exporting invoices...

PT-2024-39332

Name of the Vulnerable Software and Affected Versions: MicroPython version 1.22.2 Description: A critical issue has been found in the MicroPython objarray component, where resizing and copying a bytes object into itself may reference memory that has already been freed, leading to use after free...

PT-2024-6309 · Document Foundation +5 · Libreoffice +5

Name of the Vulnerable Software and Affected Versions: LibreOffice versions prior to 24.2.5 Description: The issue affects the Zip Repair Mode of LibreOffice, where an improper digital signature invalidation vulnerability allows for signature forgery. This means an attacker could create a special...

PT-2024-7389 · Unknown +1 · Matrix-Js-Sdk +1

Name of the Vulnerable Software and Affected Versions: matrix-js-sdk versions 9.11.0 through 34.7.0 Description: The issue is related to the MatrixClient.sendSharedHistoryKeys method in the matrix-js-sdk, which is vulnerable to interception by malicious homeservers. This method is used to share...

PT-2024-9536 · Siemens · Tecnomatix Plant Simulation +1

Name of the Vulnerable Software and Affected Versions: Tecnomatix Plant Simulation versions prior to V2302.0016 Tecnomatix Plant Simulation versions prior to V2404.0005 Teamcenter Visualization versions prior to V14.2.0.14 Teamcenter Visualization versions prior to V14.3.0.12 Teamcenter...

PT-2024-37303

Name of the Vulnerable Software and Affected Versions: langchain-ai/langchain versions prior to 0.2.4 Description: A vulnerability in the FAISS.deserialize from bytes function allows for pickle deserialization of untrusted data, which can lead to the execution of arbitrary commands via the...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS when an admin assigns a valuator to a proposal, or does an action that generates an admin activity log. Workaround Users who are not able to upgrade to the fixed version can redirect the pages /admin and...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS through the QuillJS WYSWYG editor in the admin panel, by modifying an HTML file before being uploaded to the server. Workaround Users who are not able to upgrade to the fixed version can: 1 Review the user...

PT-2024-31993 · Totolink · Totolink Ac1200 T8

Name of the Vulnerable Software and Affected Versions: TOTOLINK AC1200 T8 version 4.1.5cu.861 B20230220 Description: The issue is a buffer overflow vulnerability in the setWiFiAclRules function via the desc parameter. This vulnerability can be exploited, but details about the estimated number of...

PT-2024-7673 · Intel · Intel Raid Web Console

Name of the Vulnerable Software and Affected Versions: IntelR RAID Web Console software all versions Description: The issue is related to improper access control in the IntelR RAID Web Console software, which may allow an authenticated user to potentially enable denial of service via adjacent...

PT-2024-37781 · Tnb Mobile Solutions · Tnb Mobile Solutions Cockpit

Name of the Vulnerable Software and Affected Versions: TNB Mobile Solutions Cockpit Software versions prior to v2.13 Description: The issue is related to the use of hard-coded credentials in TNB Mobile Solutions Cockpit Software, allowing unauthorized access to read sensitive strings within an...