CVE-2024-48868

CVE-2024-48868 is a CRLF injection vulnerability reported to affect QNAP QTS and QuTS hero. The flaw permits remote modification of application data when exploited. Affected versions have been fixed: QTS 5.1.9.2954 build 20241120 and later; QTS 5.2.2.2950 build 20241114 and later; QuTS hero h5.1....

CVE-2024-48867

CVE-2024-48867 concerns CRLF injection in QNAP QTS and QuTS Hero. Affected products/versions include QTS 5.1.9.2954 (build 20241120) and later, QTS 5.2.2.2950 (build 20241114) and later, QuTS hero h5.1.9.2954 (build 20241120) and later, and QuTS hero h5.2.2.2952 (build 20241116) and later. The CW...

CVE-2024-12254

Starting in Python 3.12.0, the asyncio.SelectorSocketTransport.writelines method would not "pause" writing and signal to the Protocol to drain the buffer to the wire once the write buffer reached the "high-water mark". Because of this, Protocols would not periodically drain the write buffer...

CVE-2024-54137 liboqs has a correctness error in HQC decapsulation

liboqs is a C-language cryptographic library that provides implementations of post-quantum cryptography algorithms. A correctness error has been identified in the reference implementation of the HQC key encapsulation mechanism. Due to an indexing error, part of the secret key is incorrectly treat...

CVE-2024-54747

creationtimestamp| type| source ---|---|--- 2024-12-06 15:37:04+00:00| seen| https://infosec.exchange/users/cve/statuses/113606618227054679 2024-12-06 18:07:56+00:00| seen| https://t.me/cvedetector/12236...

CVE-2024-54216

creationtimestamp| type| source ---|---|--- 2024-12-06 15:35:37+00:00| seen| https://infosec.exchange/users/cve/statuses/113606612461395647 2024-12-06 16:27:21+00:00| seen| https://t.me/cvedetector/12216 2024-12-09 17:44:20+00:00| seen|...

CVE-2024-54207

creationtimestamp| type| source ---|---|--- 2024-12-06 15:05:33+00:00| seen| https://infosec.exchange/users/cve/statuses/113606494323979888 2024-12-06 16:27:26+00:00| seen| https://t.me/cvedetector/12218...

CVE-2024-53813

creationtimestamp| type| source ---|---|--- 2024-12-06 14:35:30+00:00| seen| https://infosec.exchange/users/cve/statuses/113606376192074229...

CVE-2024-52335

CVE-2024-52335 affects syngo.plaza VB30E (all versions before VB30E_HF05). The issue is failure to sanitize input data before sending to the SQL server, enabling arbitrary SQL commands that could compromise the entire database. Affected software: syngo.plaza VB30E; root cause: unsanitized SQL que...

CVE-2024-10771

creationtimestamp| type| source ---|---|--- 2024-12-06 12:28:27+00:00| seen| https://infosec.exchange/users/cve/statuses/113605876542214022 2024-12-06 15:37:13+00:00| seen| https://t.me/cvedetector/12211...

CVE-2024-11450 ONLYOFFICE Docs <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The ONLYOFFICE Docs plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'onlyoffice' shortcode in all versions up to, and including, 2.0.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticate...

CVE-2024-11585

creationtimestamp| type| source ---|---|--- 2024-12-06 05:33:05+00:00| seen| https://infosec.exchange/users/cve/statuses/113604243254897725 2024-12-06 08:05:27+00:00| seen| https://t.me/cvedetector/12172...

CVE-2024-6219

Mark Laing discovered in LXD's PKI mode, until version 5.21.1, that a restricted certificate could be added to the trust store with its restrictions not honoured...

CVE-2024-30961

creationtimestamp| type| source ---|---|--- 2024-12-05 22:47:59+00:00| seen| https://infosec.exchange/users/cve/statuses/113602650343478336 2024-12-06 01:23:57+00:00| seen| https://t.me/cvedetector/12149...

CVE-2017-13308

In tscpuwriteGPIOout and mtktsAbtswrite of mtktsAbts.c, there is a possible buffer overflow in an sscanf due to improper input validation. This could lead to a local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation...

CVE-2024-53442

creationtimestamp| type| source ---|---|--- 2024-12-05 20:05:33+00:00| seen| https://infosec.exchange/users/cve/statuses/113602011667812173 2024-12-05 22:03:14+00:00| seen| https://t.me/cvedetector/12134...

CVE-2024-11156

creationtimestamp| type| source ---|---|--- 2024-12-05 17:38:07+00:00| seen| https://infosec.exchange/users/cve/statuses/113601431903458166 2024-12-05 20:22:51+00:00| seen| https://t.me/cvedetector/12128 2024-12-10 05:00:00+00:00| seen| http://www.zerodayinitiative.com/advisories/ZDI-24-1655/...

CVE-2024-53857

rPGP is a pure Rust implementation of OpenPGP. Prior to 0.14.1, rPGP allows attackers to trigger resource exhaustion vulnerabilities in rpgp by providing crafted messages. This affects general message parsing and decryption with symmetric keys...

CVE-2024-11942

A vulnerability in Drupal Core allows File Manipulation.This issue affects Drupal Core: from 10.0.0 before 10.2.10...

CVE-2024-51544

creationtimestamp| type| source ---|---|--- 2024-12-05 13:22:58+00:00| seen| https://infosec.exchange/users/cve/statuses/113600428634440876 2024-12-05 15:21:29+00:00| seen| https://t.me/cvedetector/12092 2025-01-07 11:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-25-007-...