CVE-2024-21658 Insufficient control of region value length in discourse-calendar

discourse-calendar is a discourse plugin which adds the ability to create a dynamic calendar in the first post of a topic. The limit on region value length is too generous. This allows a malicious actor to cause a Discourse instance to use excessive bandwidth and disk space. This issue has been...

IPCOM vulnerable to information disclosure

Overview SSL Accelerator/SSL-VPN Function of IPCOM provided by Fsas Technologies Inc. contains an information disclosure vulnerability due to observable timing discrepancy CWE-208. Fsas Technologies Inc. reported this vulnerability to JPCERT/CC to notify users of its solution through JVN. JPCERT/...

PT-2024-31210 · Seacms · Seacms

Name of the Vulnerable Software and Affected Versions: Seacms version 13 Description: The issue is related to Cross Site Scripting XSS via the admin-video.php endpoint. This allows for potential malicious script execution. No information is provided about the estimated number of potentially...

JVN#29238389: IPCOM vulnerable to information disclosure

SSL Accelerator/SSL-VPN Function of IPCOM provided by Fsas Technologies Inc. contains an information disclosure vulnerability due to observable timing discrepancy CWE-208. Impact Some of the encrypted communication may be decrypted by an attacker who can obtain the contents of the communication...

PT-2024-7592

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.6.58 Description The issue is related to a race condition between timeout and normal completion in the nbd module of the Linux kernel. This can lead to a use-after-free condition, potentially allowing an attack...

GHSA-MGWR-H7MV-FH29 Hwameistor Potential Permission Leakage of Cluster Level

Impact What kind of vulnerability is it? Who is impacted? This ClusterRole has verbs of resources. If a malicious user can access the worker node which has hwameistor's deployment, he/she can abuse these excessive permissions to do whatever he/she likes to the whole cluster, resulting in a...

PT-2024-38928 · Unknown · Dingfanzu Cms

Name of the Vulnerable Software and Affected Versions: dingfanzu CMS up to 29d67d9044f6f93378e6eb6ff92272217ff7225c Description: A critical vulnerability has been found in dingfanzu CMS, affecting an unknown part of the file /ajax/getBasicInfo.php. The manipulation of the username argument leads ...

PT-2024-6215 · Ivanti · Ivanti Epm

Name of the Vulnerable Software and Affected Versions: Ivanti EPM versions prior to 2022 SU6 Ivanti EPM versions prior to the 2024 September update Description: The issue is related to missing authentication in the Network Isolation feature of Ivanti EPM, allowing a remote unauthenticated attacke...

PT-2024-29371

Name of the Vulnerable Software and Affected Versions phpipam version 1.6 Description The issue is a Cross Site Scripting XSS vulnerability. It occurs through the appadminimport-exportimport-load-data.php file. This allows for potential malicious script execution. Recommendations For phpipam...

PT-2024-38921 · Feehicms · Feehicms

Name of the Vulnerable Software and Affected Versions: FeehiCMS versions up to 2.1.1 Description: A critical vulnerability was found in FeehiCMS, affecting the function update of the file /admin/index.php?r=friendly-link%2Fupdate. The manipulation of the argument FriendlyLinkimage leads to...

CVE-2024-43805 HTML injection in Jupyter Notebook and JupyterLab leading to DOM Clobbering

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. This vulnerability depends on user interaction by opening a malicious notebook with Markdown cells, or Markdown file using JupyterLab preview feature. A malicious user c...

CVE-2024-43805 HTML injection in Jupyter Notebook and JupyterLab leading to DOM Clobbering

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. This vulnerability depends on user interaction by opening a malicious notebook with Markdown cells, or Markdown file using JupyterLab preview feature. A malicious user c...

PT-2024-31399

Name of the Vulnerable Software and Affected Versions PHPSpreadsheet versions prior to 2.2.1 Description The issue allows for a bypassing of a filter, enabling an XXE-attack. This attack can obtain contents of local files, even if error reporting is muted. Technical details about exploitation...

PT-2024-31406 · Unknown · Hwameistor

Name of the Vulnerable Software and Affected Versions: Hwameistor versions prior to 0.14.6 Description: Hwameistor is a high-availability local storage system for cloud-native stateful workloads. This ClusterRole has excessive permissions, allowing a malicious user who can access the worker node...

PT-2024-38872 · Nafisulbari · Insurance Management System

Name of the Vulnerable Software and Affected Versions: nafisulbari/itsourcecode Insurance Management System version 1.0 Description: A vulnerability has been found in the Insurance Management System, affecting an unknown functionality of the file editClient.php. The manipulation of the AGENT ID...

PT-2024-10074

Name of the Vulnerable Software and Affected Versions GNOME libsoup versions prior to 3.6.1 Description The issue is related to a buffer overflow in the soup header parse param list strict function of the GNOME libsoup library. This overflow occurs in dynamic memory and is associated with...

PT-2024-30184 · Exiftags +1 · Exiftags +1

Name of the Vulnerable Software and Affected Versions: exiftags version 1.01 Description: A Buffer Overflow vulnerability in exiftags allows a local attacker to execute arbitrary code via the paresetag function. This issue enables local code execution. Recommendations: For exiftags version 1.01, ...

PT-2024-28675 · Unknown · Microscada Pro/X Sys600

Name of the Vulnerable Software and Affected Versions: MicroSCADA Pro/X SYS600 affected versions not specified Description: The product allows an authenticated user input to control or influence paths or file names that are used in filesystem operations. If exploited, this issue allows the attack...

PT-2024-31184 · Tenda · Tenda Ax1806

Name of the Vulnerable Software and Affected Versions: Tenda AX1806 version 1.0.0.1 Description: The issue is a stack overflow that occurs via the serverName parameter in the form fast setting internet set function. Recommendations: For Tenda AX1806 version 1.0.0.1, as a temporary workaround,...

PT-2024-30160 · Unknown · Kashipara Music Management System

Name of the Vulnerable Software and Affected Versions: Kashipara Music Management System version 1.0 Description: A Stored Cross Site Scripting XSS issue was found in the "/music/ajax.php?action=save music" endpoint, allowing remote attackers to execute arbitrary code via the title and artist...