PT-2024-14362 · Totolink · Totolink A3700R

Name of the Vulnerable Software and Affected Versions: TOTOlink A3700R version 9.1.2u.5822 B20200513 Description: The issue is related to a remote command execution RCE vulnerability. It can be exploited via the setTracerouteCfg function. Recommendations: For TOTOlink A3700R version 9.1.2u.5822...

PT-2024-14366 · Totolink · Totolink Ex1200T

Name of the Vulnerable Software and Affected Versions: TOTOlink EX1200T version 4.1.2cu.5232 B20210713 Description: The issue is related to a remote command execution RCE vulnerability. It is exploited via the main function. Recommendations: For TOTOlink EX1200T version 4.1.2cu.5232 B20210713,...

PT-2024-1446 · Unknown · Rapid Scada

Name of the Vulnerable Software and Affected Versions: Rapid SCADA versions prior to 5.8.4 Description: The issue is related to shortcomings in the error reporting mechanism of the SCADA system. It allows a remote attacker to gain unauthorized access to protected information by sending a speciall...

CRI-O's pods can break out of resource confinement on cgroupv2

Impact What kind of vulnerability is it? Who is impacted? All versions of CRI-O running on cgroupv2 nodes. Unchecked access to an experimental annotation allows a container to be unconfined. Back in 2021, support was added to support an experimental annotation that allows a user to request specia...

PT-2024-13804 · Wwbn · Avideo

Name of the Vulnerable Software and Affected Versions: WWBN AVideo dev master commit 15fed957fb Description: A login attempt restriction bypass issue exists in the checkLoginAttempts functionality. This can be triggered by a specially crafted HTTP request, leading to captcha bypass. An attacker c...

PT-2024-19008 · Pimcore · Pimcore Customer Management Framework

Name of the Vulnerable Software and Affected Versions: Pimcore Customer Management Framework versions prior to 4.0.6 Description: The issue allows an authenticated and unauthorized user to access the list of potential duplicate users and see their data. This occurs because permissions are not...

PT-2024-1485 · Cisco · Cisco Prime Infrastructure +1

Name of the Vulnerable Software and Affected Versions: Cisco Prime Infrastructure affected versions not specified Cisco Evolved Programmable Network EPN Manager affected versions not specified Description: A vulnerability in the web-based management interface could allow an authenticated, remote...

PT-2024-13826 · Wwbn · Avideo

Name of the Vulnerable Software and Affected Versions: WWBN AVideo dev master commit 15fed957fb Description: An information disclosure issue exists in the aVideoEncoderReceiveImage.json.php image upload functionality. A specially crafted HTTP request can lead to arbitrary file read. This issue is...

PT-2024-14341 · Tenda · Tenda Ax1803

Name of the Vulnerable Software and Affected Versions: Tenda AX1803 version 1.0.0.1 Description: The issue is related to a stack overflow that can occur via the iptv.city.vlan parameter in the formSetIptv function. Recommendations: For Tenda AX1803 version 1.0.0.1, as a temporary workaround,...

PT-2024-12283 · Hyland +1 · Hyland Perceptive Filters +2

Name of the Vulnerable Software and Affected Versions: Hyland Perceptive Filters versions prior to 2023-12-08 Cisco IronPort Email Security Appliance Software affected versions not specified Cisco Secure Email Gateway affected versions not specified Description: The issue allows attackers to...

GHSA-RV9J-C866-GP5H Microsoft.IdentityModel.Protocols.SignedHttpRequest remote code execution vulnerability

Impact What kind of vulnerability is it? Who is impacted? Anyone leveraging the SignedHttpRequestprotocol or the SignedHttpRequestValidatoris vulnerable. Microsoft.IdentityModel trusts the jkuclaim by default for the SignedHttpRequestprotocol. This raises the possibility to make any remote or loc...

PT-2024-15488

Name of the Vulnerable Software and Affected Versions Likeshop versions up to 2.5.7.20210311 Description A critical vulnerability was found in the function FileServer::userFormImage of the file server/application/api/controller/File.php, which is part of the HTTP POST Request Handler component. T...

PT-2024-13534 · Freeimage +1 · Freeimage +1

Name of the Vulnerable Software and Affected Versions: Freeimage version 3.18.0 Description: An integer overflow vulnerability in the LoadPixelDataRLE4 function in PluginBMP.cpp allows attackers to obtain sensitive information, cause a denial of service, and/or run arbitrary code. Recommendations...

GHSA-8959-RFXH-R4J4 XWiki vulnerable to Denial of Service attack through attachments

Impact A user able to attach a file to a page can post a malformed TAR file by manipulating file modification times headers, which when parsed by Tika, could cause a denial of service issue via CPU consumption. Patches This vulnerability has been patched in XWiki 14.10.18, 15.5.3 and 15.8 RC1...

GHSA-XH35-W7WG-95V3 XWiki has no right protection on rollback action

Impact The rollback action is missing a right protection: it means that a user can rollback to a previous version of the page to gain rights they don't have anymore. This vulnerability impacts all version of XWiki since rollback action is available. Patches The problem has been patched in XWiki...

PT-2024-19031 · WordPress · Mapster Wp Maps

Name of the Vulnerable Software and Affected Versions: Mapster WP Maps versions 1.2.38 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows stored cross-site scripting XSS. This means that an attacker can inject malicious scrip...

PT-2024-1677

Name of the Vulnerable Software and Affected Versions Evernote for MacOS version 10.68.2 Description An issue in Evernote for MacOS allows a remote attacker to execute arbitrary code via the RunAsNode and enableNodeClilnspectArguments components. This is related to a buffer overflow in memory. Th...

PT-2024-1280

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 2.11.5 FreeRDP versions prior to 3.2.0 Description The issue is related to an integer overflow in the freerdp bitmap planar context reset function, leading to a heap-buffer overflow. This affects FreeRDP based clients...

PT-2024-12502 · Gtkwave · Gtkwave

Name of the Vulnerable Software and Affected Versions: GTKWave version 3.3.115 Description: An integer overflow vulnerability exists in the fstReaderIterBlocks2 time table tsec nitems functionality. A specially crafted .fst file can lead to memory corruption. A victim would need to open a malicio...

PT-2024-12508 · Gtkwave · Gtkwave

Name of the Vulnerable Software and Affected Versions: GTKWave version 3.3.115 Description: Multiple stack-based buffer overflow vulnerabilities exist in the FST LEB128 varint functionality. A specially crafted .fst file can lead to arbitrary code execution. A victim would need to open a maliciou...