CVE-2024-40549

PublicCMS v4.0.202302.e is affected by CVE-2024-40549 due to an arbitrary file upload vulnerability in the /admin/cmsTemplate/savePlace component, which can allow an attacker to execute arbitrary code via a crafted file. The CVE is documented across multiple feeds (NVD, Red Hat, CNNVD, OSV, etc.)...

CVE-2024-40548

An arbitrary file upload vulnerability in the component /admin/cmsTemplate/save of PublicCMS v4.0.202302.e allows attackers to execute arbitrary code via uploading a crafted file...

CVE-2024-40549

An arbitrary file upload vulnerability in the component /admin/cmsTemplate/savePlace of PublicCMS v4.0.202302.e allows attackers to execute arbitrary code via uploading a crafted file...

CVE-2024-40548

An arbitrary file upload vulnerability in the component /admin/cmsTemplate/save of PublicCMS v4.0.202302.e allows attackers to execute arbitrary code via uploading a crafted file...

Maipu MyPower VC8100 Security Vulnerability

Maipu MyPower VC8100 is a core softswitch control platform from Maipu, China. A security vulnerability exists in Maipu MyPower VC8100 version V100R001C00B030, which originates from a Read Arbitrary File via Component vulnerability...

The vulnerability of the Dawn component in Microsoft Edge and Google Chrome browsers allows a hacker to execute arbitrary code.

The vulnerability of the Dawn component in Microsoft Edge and Google Chrome relates to the use of memory after it is freed. Exploiting this vulnerability allows a remote attacker to execute arbitrary code through a specially created HTML page...

CVE-2024-39251

An issue in the component ControlCenter.sys/ControlCenter64.sys of ThundeRobot Control Center v2.0.0.10 allows attackers to access sensitive information, execute arbitrary code, or escalate privileges via sending crafted IOCTL requests...

CVE-2024-4576

Summary for CVE-2024-4576 : A directory traversal vulnerability in TIBCO EBX, affecting EBX Add-ons across multiple versions. The issue allows an attacker to access sensitive files and potentially disclose system configuration data. Root cause: directory traversal in EBX Add-ons components, enabl...

The vulnerability of the Dawn component in browsers such as Google Chrome and Microsoft Edge allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of the Dawn component in Google Chrome and Microsoft Edge relates to the use of memory after it is freed. Exploiting this vulnerability allows a remote attacker to compromise the confidentiality, integrity, and accessibility of protected information by loading a specially create...

Vulnerability of the Server component: The DML of the Oracle MySQL Server database management system, which allows a hacker to cause a service failure.

The vulnerability of the Oracle MySQL Server component relates to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause service interruptions...

The vulnerability of the Compiler component in Oracle GraalVM Enterprise Edition and Oracle GraalVM for JDK allows attackers to disclose protected information.

The vulnerability of the Compiler component in Oracle GraalVM Enterprise Edition and Oracle GraalVM for JDK relates to insufficient protection of service data. Exploiting this vulnerability can allow a malicious actor to disclose the protected information remotely...

CVE-2024-35570

An arbitrary file upload vulnerability in the component \controller\ImageUploadController.class of inxedu v2.0.6 allows attackers to execute arbitrary code via uploading a crafted jsp file...

CVE-2024-35570

The connected PT-2024-26551 entry confirms an arbitrary-file-upload vulnerability in inxedu v2.0.6, specifically the ImageUploadController.class component, enabling code execution via a crafted JSP upload. No fix version is provided; workaround advises avoiding the file-upload feature and restric...

CVE-2024-33222

CVE-2024-33222 affects the ASUS ATSZIO Driver (v0.2.1.7) via its ATSZIO64.sys component. The issue enables local privilege escalation and arbitrary code execution by sending crafted IOCTL requests. Public sources in connected documents confirm the affected driver and the vulnerability’s nature; e...

CVE-2024-35109

idccms v1.35 was discovered to contain a Cross-Site Request Forgery CSRF via the component /homeProdeal.php?mudi=add&nohrefStr=close...

CVE-2024-35108

idccms v1.35 was discovered to contain a Cross-Site Request Forgery CSRF via the component /admin/homeProdeal.php?mudi=del&dataType=&dataTypeCN...

The vulnerability of the Core component of the Oracle VM VirtualBox software allows a hacker to gain increased privileges.

The vulnerability of the Core component of the Oracle VM VirtualBox software is related to lack of access control. Exploiting this vulnerability can allow attackers to enhance their privileges...

CVE-2024-25355

s3-url-parser 1.0.3 is vulnerable to Denial of service via the regexes component...

CVE-2024-33102

A stored cross-site scripting XSS vulnerability in the component /pubs/counter.php of ThinkSAAS v3.7.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the code parameter...

The vulnerability of the Prompts component in Microsoft Edge and Google Chrome browsers allows a perpetrator to access confidential information.

The vulnerability of the Prompts component in Microsoft Edge and Google Chrome is related to improper security checks for standard elements. Exploiting this vulnerability can allow a malicious actor to gain access to confidential information remotely...