CVE-2024-35672

CVE-2024-35672 is a Missing Authorization / Broken Access Control vulnerability in WordPress Netgsm plugin (versions n/a–2.9.19). Patchstack documents a fix in 2.9.20; other sources reiterate the issue as Missing Authorization affecting Netgsm up to 2.9.19. No exploit details are provided in the ...

CVE-2024-37273

CVE-2024-37273 affects the Jan project, specifically version 0.4.12 . The vulnerability lies in the /v1/app/appendFileSync interface, where uploading a crafted file can lead to arbitrary code execution on the server. The available connected document details confirm this arbitrary-file-upload flaw...

CVE-2024-36858

Summary: CVE-2024-36858 affects Jan v0.4.12 via the /v1/app/writeFileSync endpoint, where an arbitrary file upload vulnerability allows an attacker to execute arbitrary code. The root cause is an insecure file upload interface that does not sufficiently validate uploaded content. The impact is de...

CVE-2024-36857

CVE-2024-36857 affects Jan v0.4.12, which contains an arbitrary file read vulnerability exposed through the /v1/app/readFileSync interface. The connected template details a path traversal flaw that allows unauthenticated attackers to read arbitrary files on the system, via a vulnerable readFileSy...

CVE-2024-36604

CVE-2024-36604 affects Tenda O3V2 v1.0.0.12(3880). The vulnerability is a Blind Command Injection in the stpEn parameter of the SetStp function, enabling arbitrary commands to run with root privileges. The Red Hat/PT-Security entry corroborates the affected version and the SetStp/stpEn vector; NV...

CVE-2024-29004

CVE-2024-29004: SolarWinds Platform web console stored cross-site scripting vulnerability. Root cause: stored XSS in the web UI. A high-privileged user must interact with the page to exploit; authenticated access is required. Potential impact includes browser-side script execution with the user’s...

CVE-2024-28999

CVE-2024-28999 is a race-condition vulnerability in SolarWinds Platform web console. Public materials (exploit-db, GitHub exploit, Nessus plugin) confirm a login-page race condition affecting SolarWinds Platform 2024.1 SR1 and earlier; several related advisories (Red Hat, ENISA ENISA EUVD, NCSC) ...

CVE-2024-28996

The CVE-2024-28996 entry concerns SolarWinds Platform SWQL Injection Vulnerability. The vulnerability is described as high impact with attack complexity: high, requiring no user interaction but adjacent access, and affects confidentiality, integrity, and availability. Connected sources confirm th...

CVE-2024-36550

CVE-2024-36550 affects idccms V1.35 and describes a Cross-Site Request Forgery (CSRF) vulnerability accessible via /admin/vpsCompany_deal.php?mudi=add&nohrefStr=close. The NVD entry lists CVSSv3.1 scores of 8.8 (HIGH) for the NVD view with network attack vector, user interaction required, and hig...

CVE-2024-36549

CVE-2024-36549 affects idccms v1.35 with a Cross-Site Request Forgery (CSRF) vulnerability in the /admin/vpsCompany_deal.php?mudi=rev&nohrefStr=close endpoint. The connected PT-2024-27067 entry specifies the vulnerable software version (idccms 1.35) and identifies the CSRF issue related to the /a...

CVE-2024-36548

CVE-2024-36548 affects idccms v1.35, with a CSRF vulnerability reachable at admin/vpsCompany_deal.php?mudi=del. The issue is documented across multiple feeds (NVD/Red Hat/CVE pages and PT-2024-27066) and is not accompanied by public exploit details in the provided documents. PT-2024-27066 suggest...

CVE-2024-36547

CVE-2024-36547 affects idccms V1.35 with a Cross-Site Request Forgery (CSRF) in the admin/vpsClass_deal.php?mudi=add component. The CVSS baseline from NVD (ATT&CK not stated) indicates high impact on confidentiality, integrity, and availability with network attack vector and user interaction requ...

CVE-2024-32871

Pimcore’s vulnerability CVE-2024-32871 concerns the thumbnail generation endpoint. Attackers can cause server resource exhaustion by requesting thumbnails whose file extension or scale factor yields files much larger than the original, enabling a Denial of Service-like impact. The fixed version i...

CVE-2024-0756

CVE-2024-0756 concerns the WordPress plugin Insert or Embed Articulate Content into WordPress, affected through v4.3000000023. The issue stems from insufficient URL validation when adding iframes, enabling an attacker to inject an iframe and load arbitrary content from any page. Public references...

CVE-2024-35649

CVE-2024-35649 describes a Stored XSS in the Pdfcrowd Save as PDF plugin for WordPress. The initial description indicates vulnerability in the plugin from versions up to 3.2.3 (inclusive). Connected CVE data confirm that this is a stored XSS in web page generation via user input, with remediation...

CVE-2024-35651

CVE-2024-35651 concerns the WP Flow Plus WordPress plugin (Spiffy Plugins) withStored Cross-Site Scripting (XSS) vulnerability in versions

CVE-2024-35652

CVE-2024-35652 is a reflected XSS in the WordPress plugin Event Tickets with Ticket Scanner. According to the description, the vulnerability arises from Improper Neutralization of Input During Web Page Generation and affects Event Tickets with Ticket Scanner versions from n/a up to 2.3.1. The inc...

CVE-2024-36400

CVE-2024-36400 (nano-id, Rust) : Affected nano-id versions incorrectly generated IDs by using a reduced character set in base62 (32 symbols instead of 62) and base58 (16 symbols instead of 58), substantially reducing entropy. The nano_id::gen macro is also affected when a non-power-of-two charact...

CVE-2024-35653

Technical details for CVE-2024-35653 are not publicly provided in the connected documents. No explicit affected product/version, root cause, impact, or fixes are described here. Monitor for updates.

CVE-2024-35654

CVE-2024-35654 is a Stored XSS in the Responsive WordPress Theme by CyberChimps, affecting versions up to 5.0.3. The connected Wordfence entry confirms the issue is authenticated (Contributor+) and patched; remediation is to upgrade to a later version. No exploit details are provided in the conne...