CVE-2024-42472

Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.14.0 and 1.15.10, a malicious or compromised Flatpak app using persistent directories could access and write files outside of what it would otherwise have access to, which is an attack on integrity and...

PT-2024-37695 · Directus · Directus

Name of the Vulnerable Software and Affected Versions: Directus version 10.13.0 Description: The issue allows an authenticated external attacker to execute arbitrary JavaScript on the client. This is possible because the application injects an attacker-controlled parameter into an unsanitized DOM...

PT-2024-30103 · Unknown · Super Easy Enterprise Management System

Name of the Vulnerable Software and Affected Versions: Super easy enterprise management system versions 1.0.0 and earlier Description: The issue allows a local attacker to execute arbitrary code via a crafted script to the "/WebSet/DlgGridSet.html" component. This enables the attacker to perform...

PT-2024-9654 · Adobe · Experience Manager

Name of the Vulnerable Software and Affected Versions: Adobe Experience Manager versions 6.5.21 and earlier Description: The issue is related to insufficient protection of the web page structure in Adobe Experience Manager, which could allow a remote attacker to execute arbitrary code. This is a...

PT-2024-30106 · Unknown · Super Easy Enterprise Management System

Name of the Vulnerable Software and Affected Versions: Super easy enterprise management system versions 1.0.0 and earlier Description: An issue in the system allows a local attacker to obtain the server absolute path by entering a single quotation mark. This can be exploited to gain sensitive...

Dovecot 2.2.x < 2.3.21.1 Multiple Vulnerabilities

Dovecot is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:dovecot:dovecot"; ifdescription...

GHSA-F67Q-WR6W-23JQ Boa has an uncaught exception when transitioning the state of `AsyncGenerator` objects

A wrong assumption made when handling ECMAScript's AsyncGenerator operations can cause an uncaught exception on certain scripts. Details Boa's implementation of AsyncGenerator makes the assumption that the state of an AsyncGenerator object cannot change while resolving a promise created by method...

Boa has an uncaught exception when transitioning the state of `AsyncGenerator` objects

A wrong assumption made when handling ECMAScript's AsyncGenerator operations can cause an uncaught exception on certain scripts. Details Boa's implementation of AsyncGenerator makes the assumption that the state of an AsyncGenerator object cannot change while resolving a promise created by method...

Cortex XSOAR: Command Injection in CommonScripts Pack

A command injection issue in Palo Alto Networks Cortex XSOAR CommonScripts Pack allows an unauthenticated attacker to execute arbitrary commands within the context of an integration container. Work around: Remove any integration usage of the ScheduleGenericPolling or GenericPollingScheduledTask...

PT-2024-38595 · Unknown · Code-Projects Job Portal

Name of the Vulnerable Software and Affected Versions: code-projects Job Portal version 1.0 Description: A critical issue was found in the logindbc.php file, where an unknown function is affected. The manipulation of the email argument leads to SQL injection. It is possible to launch the attack...

PT-2024-26330 · Ibm · Ibm Db2

Name of the Vulnerable Software and Affected Versions: IBM Db2 for Linux, UNIX and Windows includes DB2 Connect Server federated server versions 10.5, 11.1, and 11.5 Description: The issue is a denial of service vulnerability that can be triggered with a specially crafted query under certain...

Security Bulletin: IBM OpenPages may write sensitive information with System tracing enabled (CVE-2024-35117)

Summary IBM OpenPages may write sensitive data to server log files when the 'UI API' tracing is enabled per the System Tracing feature. Vulnerability Details CVEID:CVE-2024-35117 DESCRIPTION: IBM OpenPages may write sensitive information, under specific configurations, in clear text to the system...

PT-2024-6010 · Adobe · Commerce

Name of the Vulnerable Software and Affected Versions: Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier Description: The issue is related to an Unrestricted Upload of File with Dangerous Type, which could result in arbitrary code execution by an attacker. An attacker cou...

PT-2024-29624 · Unknown · Sinec Traffic Analyzer

Name of the Vulnerable Software and Affected Versions: SINEC Traffic Analyzer versions prior to V2.0 Description: A vulnerability has been identified in the SINEC Traffic Analyzer where the affected application does not properly enforce restrictions on excessive authentication attempts. This coul...

PT-2024-29625 · Unknown · Sinec Traffic Analyzer

Name of the Vulnerable Software and Affected Versions: SINEC Traffic Analyzer versions prior to V2.0 Description: The affected application does not properly handle cacheable HTTP responses in the web service, which could allow an attacker to read and modify data stored in the local cache...

PT-2024-30116 · Totolink · Totolink X5000R

Name of the Vulnerable Software and Affected Versions: TOTOLINK X5000r version 9.1.0cu.2350 b20230313 Description: The issue is related to an OS command injection vulnerability in the addBlacklist function of the /cgi-bin/cstecgi.cgi file. Authenticated attackers can send malicious packets to...

PT-2024-27836 · Themesphere · Themesphere Smartmag

Name of the Vulnerable Software and Affected Versions: ThemeSphere SmartMag versions prior to 9.3.0 Description: The issue is related to Exposure of Sensitive Information to an Unauthorized Actor and Missing Authorization vulnerability. It allows excavation and accessing functionality not properl...

PT-2024-34336

Name of the Vulnerable Software and Affected Versions Easy Digital Downloads versions through 3.2.12 Description The software contains a flaw related to the improper handling of special characters within SQL commands, leading to a potential SQL injection issue. This allows for the execution of...

PT-2024-30078 · Frog Cms · Frog Cms

Name of the Vulnerable Software and Affected Versions: FrogCMS version 0.9.5 Description: A Cross-Site Request Forgery CSRF issue was discovered in FrogCMS. The vulnerability can be exploited via the "/admin/?/snippet/edit/3" endpoint. Recommendations: For FrogCMS version 0.9.5, as a temporary...

PT-2024-26730 · Soliloquy · Slider By Soliloquy

Name of the Vulnerable Software and Affected Versions: Slider by Soliloquy versions n/a through 2.7.6 Description: The issue affects the Soliloquy Team Slider, allowing Cross-Site Scripting XSS due to Improper Neutralization of Input During Web Page Generation and Improper Authentication...