CVE-2024-23667

Fortinet FortiWebManager is affected by CVE-2024-23667 due to improper authorization that allows an attacker to execute unauthorized code or commands via HTTP requests or CLI. Affected FortiWebManager versions include 6.0.2; 6.2.3–6.2.4; 6.3.0; 7.0.0–7.0.4; and 7.2.0. CVSS metrics indicate high i...

CVE-2024-23668

Fortinet FortiWebManager is affected by CVE-2024-23668 due to improper authorization in the HTTP Request Handler. Affected versions: 6.0.2; 6.2.3–6.2.4; 6.3.0; 7.0.0–7.0.4; 7.2.0. Exploitation via HTTP requests or CLI could allow executing unauthorized code or commands. Remediation: upgrade to th...

CVE-2024-23670

CVE-2024-23670 describes an improper authorization in Fortinet FortiWebManager affecting multiple versions (6.0.2; 6.2.3–6.2.4; 6.3.0; 7.0.0–7.0.4; 7.2.0). The underlying issue is an authorization weakness that allows an attacker to execute unauthorized code or commands via HTTP requests or the C...

CVE-2024-5404

The CVE-2024-5404 vulnerability affects the moneo appliance, where an unauthenticated remote attacker can change the admin password due to a weak password recovery mechanism. The issue is documented with a HIGH/CRITICAL impact (CVSS v3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and indicates total i...

CVE-2024-35637

CVE-2024-35637 affects the WordPress Church Admin plugin (versions n/a–4.3.6). It is a Server-Side Request Forgery (SSRF) vulnerability requiring Administrator access. The vulnerability is mitigated in version 4.4.0; CVSS 3.1 base score reported as 4.4 (Low). No exploitation or in‑the‑wild detail...

CVE-2024-35638

CVE-2024-35638 corresponds to the WordPress ActiveDEMAND plugin (versions <= 0.2.43). According to Patchstack, it is a CSRF vulnerability that can be triggered without authentication; impact is described as low severity (CVSS 4.3). The issue is fixed in version 0.2.44. This CVE entry is active...

CVE-2024-35639

CVE-2024-35639 affects the WordPress plugin Simple Spoiler (Webliberty) up to version 1.2. The vulnerability is a stored XSS via admin/settings context, enabling injected scripts in pages viewed by users. Severity is cited as low (CVSS 3.1/3.1: 5.9), and exploitation is described as unlikely. The...

CVE-2023-48789

Fortinet FortiPortal suffers a vulnerability (CVE-2023-48789) due to client-side enforcement of server-side security that can allow improper access control via specially crafted HTTP requests. Affected software: FortiPortal versions 6.0.0 through 6.0.14. Root cause: insecure client-side security ...

CVE-2024-31493

FortiSOAR is affected by CVE-2024-31493 due to an improper removal of sensitive information before storage or transfer. An authenticated low-privilege user can read connector passwords in plain text via HTTP responses. Affected versions: FortiSOAR 7.3.0, 7.2.2 and below, and 7.0.3 and below. Root...

CVE-2024-23107

FortiWeb is affected (versions 7.4.0, 7.2.4 and below, 7.0.8 and below, and 6.3 all versions) by CVE-2024-23107, a vulnerability that allows an authenticated attacker to read password hashes of other administrators via CLI commands due to exposure of sensitive information (CWE-200). The issue is ...

CVE-2024-36963

CVE-2024-36963 affects the Linux kernel tracefs feature. The issue arises from how permissions are generated for tracefs files: they default to the root inode’s permissions unless the user changes them, and a remount with permissions should update all files, but currently leaves unchanged files t...

CVE-2024-36964

CVE-2024-36964 is a Linux kernel vulnerability in the 9P filesystem (fs/9p) where garbage in plain 9P2000 perm bits could bypass permission checks and allow setting special bits (e.g., SUID). The issue is fixed by ensuring that only the RWX permissions for plain 9P2000 are translated, preventing ...

CVE-2024-36962

The CVE-2024-36962 issue affects the Linux kernel KS8851 driver for SPI-bus KS8851, where RX packets were queued in the IRQ handler with netif_rx() inside a critical section protected by a lock. This could lead to a hang by racing with the driver’s start_xmit. The fix removes BH manipulation and ...

CVE-2024-36961

The CVE-2024-36961 issue relates to the Linux kernel’s thermal debugfs code. The root cause is two locking problems in the thermal zone debugfs handling: (1) a race where user space can open the mitigations file before the thermal zone’s debugfs pointer is set, leading to a NULL pointer dereferen...

CVE-2024-36960

The CVE-2024-36960 entry maps to a Linux kernel issue in drm/vmwgfx where the length field for drm_event was incorrectly set to the parent structure, causing out-of-bounds reads when drm_read copies events to userspace. The provided documents confirm the root cause and fix: set drm_event length t...

CVE-2024-35640

CVE-2024-35640 is a stored XSS in the WordPress Safety Exit plugin affecting versions up to 1.7.0. Exploitation requires Administrator privileges. The issue has been fixed in 1.7.1; upgrading to 1.7.1 or later mitigates the vulnerability (low severity per Patchstack).

CVE-2024-35641

CVE-2024-35641 affects WordPress plugin Just Writing Statistics (versions

CVE-2024-35642

CVE-2024-35642: WordPress Site Favicon plugin <= 0.2 suffers stored XSS due to improper input handling in admin settings; fixed in 0.3. Affected: Site Favicon versions

CVE-2024-35643

CVE-2024-35643 affects the WP Back Button WordPress plugin (versions up to 1.1.3). The issue is a Stored XSS caused by insufficient input sanitization/output escaping in admin settings, exploitable by an attacker with Administrator privileges to inject scripts that run for other users. Public pat...

CVE-2024-5311

CVE-2024-5311 affects DigiWin EasyFlow .NET. The vulnerability arises from insufficient validation of certain input parameters, allowing an unauthenticated remote attacker to inject arbitrary SQL commands that can read, modify, and delete database records. The issue is rated CVSS v3.1 base score ...