CVE-2024-3078

CVE-2024-3078 affects Qdrant prior to 1.8.3 (versions up to 1.6.1, 1.7.4, 1.8.2) and stems from path traversal in the Full Snapshot REST API handler (lib/collection/src/collection/snapshots.rs). The vulnerability allows traversal of filesystem paths due to the processing logic described in multip...

CVE-2024-3011

CVE-2024-3011 affects Tenda FH1205 (version 2.0.0.7(775)). The vulnerability is in the function formQuickIndex of the file /goform/QuickIndex , where manipulating the PPPOEPassword parameter causes a stack-based buffer overflow . Exploitation can be performed remotely, and multiple sources note t...

CVE-2024-2999

CVE-2024-2999 affects Campcodes Online Art Gallery Management System 1.0. The vulnerability lies in the uname parameter of /admin/adminHome.php, where lack of input validation enables remote SQL injection. The issue is described as critical with public exploits disclosed and a known CVE entry (VD...

CVE-2024-2894

The CVE-2024-2894 entry affects Tenda AC7, specifically the stack-based buffer overflow in the function formSetQosBand within /goform/SetNetControlList (version 15.03.06.44). The vulnerability can be triggered remotely by manipulating the list argument, leading to potential full confidentiality, ...

CVE-2024-2892 Tenda AC7 setcfm formSetCfm stack-based overflow

A vulnerability has been found in Tenda AC7 15.03.06.44 and classified as critical. Affected by this vulnerability is the function formSetCfm of the file /goform/setcfm. The manipulation of the argument funcpara1 leads to stack-based buffer overflow. The attack can be launched remotely. The explo...

Path Traversal

getgrav/grav is vulnerable to Path Traversal. The vulnerability is due to missing .. sanitization of upload file paths, which allows an attacker to replace or create files with specific extensions such as .json, .zip, .css, .gif, etc...

CVE-2024-2825 lakernote EasyAdmin saveReportFile path traversal

A vulnerability classified as critical has been found in lakernote EasyAdmin up to 20240315. This affects an unknown part of the file /ureport/designer/saveReportFile. The manipulation of the argument file leads to path traversal: '../filedir'. It is possible to initiate the attack remotely. The...

CVE-2024-2822

CVE-2024-2822 affects DedeCMS 5.7, targeting the /src/dede/vote_edit.php component. The issue arises from manipulating the parameter aid , enabling remote cross-site request forgery (CSRF). Exploitation has been disclosed publicly; no patch/versioned fix is documented in the provided sources. A p...

CVE-2024-29180

A flaw was found in the webpack-dev-middleware package, where it failed to validate the supplied URL address sufficiently before returning local files. This flaw allows an attacker to craft URLs to return arbitrary local files from the developer's machine. The lack of normalization before calling...

CVE-2024-2718

CVE-2024-2718 affects Campcodes Complete Online DJ Booking System 1.0. The vulnerability exists in the /admin/booking-bwdates-reports-details.php file, where manipulating the fromdate parameter enables cross-site scripting. Exploitation is possible remotely, and multiple sources note public discl...

CVE-2024-2714

A vulnerability has been found in Campcodes Complete Online DJ Booking System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/booking-bwdates-reports-details.php. The manipulation of the argument fromdate leads to sql injection. The...

CVE-2024-2676

A vulnerability, which was classified as critical, was found in Campcodes Online Job Finder System 1.0. Affected is an unknown function of the file /admin/company/controller.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit...

CVE-2024-2572

A vulnerability was found in SourceCodester Employee Task Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /task-details.php. The manipulation leads to execution after redirect. The attack may be initiated remotely. The exploit has been...

CVE-2024-2564 PandaXGO PandaX user.go ExportUser path traversal

A vulnerability was found in PandaXGO PandaX up to 20240310 and classified as critical. This issue affects the function ExportUser of the file /apps/system/api/user.go. The manipulation of the argument filename leads to path traversal: '../filedir'. The attack may be initiated remotely. The explo...

PandaX Code Issues Vulnerabilities

PandaX is a Go language open source low-code development framework for enterprise IoT platforms from PandaX Open Source. A code issue vulnerability exists in PandaX version 20240310 and prior versions, which stems from an incorrect manipulation of the parameter file can lead to unrestricted file...

CVE-2024-2529 MAGESH-K21 Online-College-Event-Hall-Reservation-System rooms.php unrestricted upload

A vulnerability was found in MAGESH-K21 Online-College-Event-Hall-Reservation-System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/rooms.php. The manipulation leads to unrestricted upload. The attack can be initiated remotely. The exploit has be...

CVE-2024-2483

A vulnerability, which was classified as problematic, has been found in Surya2Developer Hostel Management Service 1.0. This issue affects some unknown processing of the file /change-password.php of the component Password Change Handler. The manipulation of the argument oldpassword leads to...

CVE-2024-2406

A vulnerability, which was classified as critical, was found in Gacjie Server up to 1.0. This affects the function index of the file /app/admin/controller/Upload.php. The manipulation of the argument file leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit ha...

Path traversal

A vulnerability was found in ZKTeco ZKBio Media 2.0.0x642024-01-29-1028. It has been classified as problematic. Affected is an unknown function of the file /pro/common/download of the component Service Port 9999. The manipulation of the argument fileName with the input ../../../../zkbiomedia.sql...

Path Traversal

paddlepaddle is vulnerable to Path Traversal. The vulnerability is due to insufficient input validation, allowing attackers to manipulate file paths and overwrite arbitrary files on the system...