PT-2024-31175 · Tenda · Tenda Ax1806

Name of the Vulnerable Software and Affected Versions: Tenda AX1806 version 1.0.0.1 Description: The issue is a stack overflow that occurs via the iptv.city.vlan parameter in the formGetIptv function. This allows for potential exploitation. Recommendations: For Tenda AX1806 version 1.0.0.1, as a...

PT-2024-31172 · Tenda · Tenda Ax1806

Name of the Vulnerable Software and Affected Versions: Tenda AX1806 version 1.0.0.1 Description: The issue is a stack overflow that can occur via the iptv.stb.port parameter in the formGetIptv function. This poses a risk of remote code execution. Recommendations: For Tenda AX1806 version 1.0.0.1,...

PT-2024-31252 · Unknown · Picuploader

Name of the Vulnerable Software and Affected Versions: PicUploader version fcf82ea Description: A cross-site scripting XSS issue exists in the /master/auth/OnedriveRedirect.php component, allowing attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the error...

PT-2024-30483 · Checkout · Stripe Payments For Woocommerce

Name of the Vulnerable Software and Affected Versions: Stripe Payments For WooCommerce by Checkout versions 1.9.1 and earlier Description: A Cross-Site Request Forgery CSRF issue affects the software, potentially allowing unauthorized actions. Upgrade to a newer version to remediate...

PT-2024-30427 · Mediavine · Create By Mediavine

Name of the Vulnerable Software and Affected Versions: Create by Mediavine versions 1.9.8 and earlier Description: This issue exposes sensitive information to unauthorized actors. Users are urged to upgrade to the latest version to mitigate risks. Recommendations: For versions 1.9.8 and earlier,...

PT-2024-31522 · Skysystem · Arfa-Cms

Name of the Vulnerable Software and Affected Versions: SkySystem Arfa-CMS versions prior to 5.1.3124 Description: A SQL injection issue in the poll component allows remote attackers to execute arbitrary SQL commands via the psid parameter. This enables attackers to manipulate database queries,...

PT-2024-31514 · Req · Req

Name of the Vulnerable Software and Affected Versions: req package versions prior to 3.43.4 Description: The req package may send an unintended request when a malformed URL is provided, due to the cleanHost function in http.go using a "garbage in, garbage out" design. This can lead to security...

PT-2024-38842 · Unknown · Continew Admin

Name of the Vulnerable Software and Affected Versions: ContiNew Admin version 3.2.0 Description: A critical vulnerability was found in ContiNew Admin, affecting the function top.continew.starter.extension.crud.controller.BaseControllertree of the file...

PT-2024-10235

Name of the Vulnerable Software and Affected Versions Versa Director affected versions not specified Description The issue is related to the REST API in Versa Director, which is used for orchestration and management. Certain APIs, such as the login screen, banner display, and device registration,...

PT-2024-38827 · Code Projects · Code-Projects Pharmacy Management System

Name of the Vulnerable Software and Affected Versions: code-projects Pharmacy Management System version 1.0 Description: A critical vulnerability was found in the code-projects Pharmacy Management System. The issue affects the function editManager of the file /index.php?action=editManager of the...

PT-2024-38820 · D Link · Dns-320L +18

Name of the Vulnerable Software and Affected Versions: D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05, and DNS-1550-04 up to 20240814 Description: A...

PT-2024-30652 · Open Edx +1 · Openedx-Atlas +4

Name of the Vulnerable Software and Affected Versions: openedx-translations affected versions not specified edx-platform versions from 'redwood' to 'master' Description: The openedx-translations repository contains translation files from Open edX repositories to be kept in sync with Transifex...

PT-2024-38812 · WordPress · Imagerecycle

Name of the Vulnerable Software and Affected Versions: ImageRecycle pdf & image compression plugin for WordPress versions up to, and including, 3.1.14 Description: The issue is due to missing or incorrect nonce validation on several functions in the class/class-image-otimizer.php file. This allow...

PT-2024-30204 · Unknown · Staff Appraisal System

Name of the Vulnerable Software and Affected Versions: Staff Appraisal System version 1.0 Description: A host header injection vulnerability in the Staff Appraisal System allows attackers to obtain the password reset token via user interaction with a crafted password reset link. This enables...

PT-2024-36432 · Zohocorp · Zoho Manageengine Adaudit Plus

Name of the Vulnerable Software and Affected Versions: Zohocorp ManageEngine ADAudit Plus versions below 8000 Description: The issue concerns an authenticated SQL injection vulnerability in the aggregate reports option. This vulnerability can be exploited by authenticated users, potentially leadi...

PT-2024-27045 · Zohocorp · Zoho Manageengine Adaudit Plus

Name of the Vulnerable Software and Affected Versions: Zohocorp ManageEngine ADAudit Plus versions below 8000 Description: The issue concerns an authenticated SQL injection vulnerability in the alerts module. This vulnerability affects versions of Zohocorp ManageEngine ADAudit Plus below 8000...

BIT-VALKEY-2021-32627 Integer overflow issue with Streams in Redis

Redis is an open source, in-memory database that persists on disk. In affected versions an integer overflow bug in Redis can be exploited to corrupt the heap and potentially result with remote code execution. The vulnerability involves changing the default proto-max-bulk-len and...

BIT-VALKEY-2021-41099 Integer overflow issue with strings in Redis

Redis is an open source, in-memory database that persists on disk. An integer overflow bug in the underlying string library can be used to corrupt the heap and potentially result with denial of service or remote code execution. The vulnerability involves changing the default proto-max-bulk-len...

BIT-VALKEY-2022-24735 Lua scripts can be manipulated to overcome ACL rules in Redis

Redis is an in-memory database that persists on disk. By exploiting weaknesses in the Lua script execution environment, an attacker with access to Redis prior to version 7.0.0 or 6.2.7 can inject Lua code that will execute with the potentially higher privileges of another Redis user. The Lua scri...

BIT-VALKEY-2022-24736 A Malformed Lua script can crash Redis

Redis is an in-memory database that persists on disk. Prior to versions 6.2.7 and 7.0.0, an attacker attempting to load a specially crafted Lua script can cause NULL pointer dereference which will result with a crash of the redis-server process. The problem is fixed in Redis versions 7.0.0 and...