CVE-2024-3906 Tenda AC500 QuickIndex formQuickIndex stack-based overflow

A vulnerability was found in Tenda AC500 2.0.1.91307. It has been declared as critical. This vulnerability affects the function formQuickIndex of the file /goform/QuickIndex. The manipulation of the argument PPPOEPassword leads to stack-based buffer overflow. The attack can be initiated remotely...

CVE-2024-1593 Path Traversal via Parameter Smuggling in mlflow/mlflow

A path traversal vulnerability exists in the mlflow/mlflow repository due to improper handling of URL parameters. By smuggling path traversal sequences using the ';' character in URLs, attackers can manipulate the 'params' portion of the URL to gain unauthorized access to files or directories. Th...

PT-2024-3045 · Oracle · Virtualbox

Name of the Vulnerable Software and Affected Versions: Oracle VM VirtualBox versions prior to 7.0.16 Description: The issue is related to errors in processing input data in the Core component of Oracle VM VirtualBox. This can be exploited by an attacker to elevate privileges or execute arbitrary...

CVE-2024-3804

A vulnerability, which was classified as critical, has been found in Vesystem Cloud Desktop up to 20240408. This issue affects some unknown processing of the file /Public/webuploader/0.1.5/server/fileupload2.php. The manipulation of the argument file leads to unrestricted upload. The attack may b...

CVE-2024-3721 TBK DVR-4104/DVR-4216 os command injection

A vulnerability was found in TBK DVR-4104 and DVR-4216 up to 20240412 and classified as critical. This issue affects some unknown processing of the file /device.rsp?opt=sys&cmd=SOSTREAMAX. The manipulation of the argument mdb/mdc leads to os command injection. The attack may be initiated remotely...

CVE-2024-3721

CVE-2024-3721 is an OS command injection affecting TBK DVR-4104 and DVR-4216 (firmware up to 20240412). The flaw stems from unsanitized parameters mdb/mdc in HTTP requests to /device.rsp?opt=sys&cmd=S_O_S_T_R_E_A_MAX . Successful exploitation allows unauthenticated remote command execution and ha...

Mautic SQL Injection in dynamic Reports

Impact Prior to the patched version, logged in users of Mautic are vulnerable to an SQL injection vulnerability in the Reports bundle. The user could retrieve and alter data like sensitive data, login, and depending on database permission the attacker can manipulate file systems. Patches Update t...

CVE-2024-3620

A vulnerability was found in SourceCodester Kortex Lite Advocate Office Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /control/adds.php. The manipulation of the argument name/gender/dob/email/mobile/address leads to sql injectio...

CVE-2024-3025

The CVE-2024-3025 entry affects mintplex-labs/anything-llm, where the logo filename handling allows path traversal due to insufficient input validation. Attackers can reference files outside the restricted directory via the logo upload endpoint, exposing the application’s database and potentially...

CVE-2024-3025 Path Traversal in mintplex-labs/anything-llm

mintplex-labs/anything-llm is vulnerable to path traversal attacks due to insufficient validation of user-supplied input in the logo filename functionality. Attackers can exploit this vulnerability by manipulating the logo filename to reference files outside of the restricted directory. This can...

CVE-2024-3524

CVE-2024-3524 affects Campcodes Online Event Management System 1.0. A cross-site scripting flaw arises from unknown processing in /views/process.php where manipulating the name argument enables XSS. The attack can be remote and the exploit has been publicly disclosed. Sources consistently referen...

CVE-2024-31454

PsiTransfer (open-source file sharing) prior to version 2.2.0 is vulnerable due to unrestricted upload-endpoint access, where an attacker who obtains a file distribution id can replace files within that distribution. This leads to integrity violations at the level of individual files, as exposed ...

CVE-2024-31454 PsiTransfer file integrity violation vulnerability

PsiTransfer is an open source, self-hosted file sharing solution. Prior to version 2.2.0, the absence of restrictions on the endpoint, which is designed for uploading files, allows an attacker who received the id of a file distribution to change the files that are in this distribution. The...

CVE-2024-3458

A vulnerability classified as critical was found in Netentsec NS-ASG Application Security Gateway 6.3. This vulnerability affects unknown code of the file /admin/addikev2.php. The manipulation of the argument TunnelId leads to sql injection. The attack can be initiated remotely. The exploit has...

CVE-2024-3457

The vulnerability CVE-2024-3457 affects Netentsec NS-ASG Application Security Gateway v6.3. The issue arises from a SQL injection in the parameter GroupId within the file /admin/config_ISCGroupNoCache.php, enabling remote attackers to manipulate input and potentially compromise data integrity, co...

CVE-2024-3436

A vulnerability was found in SourceCodester Prison Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /Admin/edit-photo.php of the component Avatar Handler. The manipulation of the argument avatar leads to unrestricted upload. The attack c...

CVE-2024-3357

A vulnerability classified as problematic has been found in SourceCodester Aplaya Beach Resort Online Reservation System 1.0. This affects an unknown part of the file admin/modreports/index.php. The manipulation of the argument end leads to cross site scripting. It is possible to initiate the...

CVE-2024-3314

A vulnerability was found in SourceCodester Computer Laboratory Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /classes/Users.php. The manipulation leads to sql injection. The attack may be initiated remotely. The identifier VDB-259385 was...

CVE-2024-3258

CVE-2024-3258 affects SourceCodester Internship Portal Management System 1.0, specifically the admin/add_activity.php file. The issue is a SQL injection via the title/description/start/end parameters, exploitable remotely. Public disclosure exists; multiple sources reference an exploit and public...

CVE-2024-3145

CVE-2024-3145 affects DedeCMS 5.7, specifically the /src/dede/makehtml_js_action.php component. The root cause is a cross-site request forgery (CSRF) vulnerability that can be triggered remotely, with public exploit disclosures noted. Multiple sources (NVD/CVE records) classify the issue as MEDIU...