CVE-2024-31329

CVE-2024-31329 is documented in the Wear OS June 2024 security bulletin as a System-component elevation of privilege (EoP) with High severity. The bulletin notes it could lead to local EoP with no additional execution privileges. Affected devices should apply the 2024-06-01 patch level (or later)...

CVE-2024-36674

CVE-2024-36674 affects LyLme_spage v1.9.5, with a Cross Site Scripting (XSS) vulnerability exploitable via the admin/link.php endpoint. The NVD entry lists CVSS v3.1 base score 6.1 (Medium), with a network attack vector, low complexity, no privileges required, user interaction needed, and a chang...

CVE-2024-4540

CVE-2024-4540 affects Keycloak deployments using OAuth 2.0 Pushed Authorization Requests (PAR). The vulnerability is that client-provided parameters can be exposed in plain text in the KC_RESTART cookie returned in the HTTP response to a request_uri-based authorization request, enabling informati...

CVE-2024-32983

Misskey (open source decentralized microblogging platform) is affected by a vulnerability in the handling of incoming signed ActivityPub activity objects: improper normalization of JSON structures allowed spoofing of signed content and impersonation of original authors. Root cause: lack of proper...

CVE-2024-36128

Directus (Real-time API/dashboard for SQL databases) is affected by CVE-2024-36128 prior to version 10.11.2. Providing a non-numeric length to the random string generation utility triggers a memory issue that disrupts random session IDs, causing a denial of service where logged-in sessions can no...

CVE-2024-36127

The CVE pertains to the apko tool (apk-based OCI image builder) where HTTP basic auth credentials from repository and keyring URLs were exposed in log output. The issue is fixed in v0.14.5. Impact is High (log exposure of credentials) with CVSS 3.1 base score 7.5. Connected sources corroborate th...

CVE-2024-36124

Summary: CVE-2024-36124 affects the iq80 Snappy compression/decompression library. During uncompression, data may read outside the bounds of input byte arrays because Snappy uses sun.misc.Unsafe for memory access, skipping bounds checks and enabling out-of-bounds behavior that can cause non-deter...

CVE-2024-36123

Citizen is a MediaWiki skin. The page MediaWiki:Tagline can render unescaped content, enabling stored cross-site scripting via editing the MediaWiki namespace (e.g., users with editinterface or sysop privileges). Root cause: unescaped output in MediaWiki:Tagline. Impact: potential HTML/JavaScript...

CVE-2024-0336

CVE-2024-0336 affects EMTA Grup PDKS (V3.04 and earlier, before 20240603). The root cause is Missing Authentication for Critical Function due to Incorrectly Configured Access Control, described as an improper access-control misconfiguration that enables unauthorized access to sensitive functions....

CVE-2024-36728

CVE-2024-36728 affects TRENDnet TEW-827DRU devices up to firmware 2.06B04. The issue is a stack-based buffer overflow in the embedded ssi binary that an authenticated user can trigger by sending a POST to apply.cgi with the action vlan_setting and a sufficiently long dns1 or dns2 key, potentially...

CVE-2024-36729

TRENDnet TEW-827DRU routers (≤2.06B04) contain a stack-based overflow in the ssi binary. An authenticated user can trigger arbitrary code execution by POSTing to apply.cgi via the wizard_ipv6 action with a sufficiently long reboot_type key. The vulnerability affects the ssi binary and is exploita...

CVE-2024-5197

Summary: Multiple connected advisories confirm CVE-2024-5197 affects libvpx with integer overflows in vpx_img_alloc() and vpx_img_wrap(), leading to overflowed buffer calculations and potentially invalid fields in vpx_image_t for versions prior to 1.14.1. The issue is described across Amazon Linu...

CVE-2024-36569

CVE-2024-36569 affects Sourcecodester Gas Agency Management System v1.0. The vulnerability is described as arbitrary code execution via the editClientImage.php file. Documents indicate a high-severity issue (CVSS 8.1, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). Root cause/details are not explicitly pro...

CVE-2024-36568

Sourcecodester Gas Agency Management System v1.0 is vulnerable to SQL Injection via /gasmark/editbrand.php?id=. The root cause is unsanitized input in the id parameter, enabling attackers to manipulate queries. This vulnerability is rated critical (CVSS 3.1: 9.8) with potential impact on confiden...

CVE-2024-35632

CVE-2024-35632 describes a Cross-Site Request Forgery (CSRF) in the WordPress plugin suite “Integration for Constant Contact and Contact Form 7, WPForms, Elementor, Ninja Forms” (affected versions up to 1.1.5). The vulnerability can be exploited via forged requests, with a CVSS v3.1 base score of...

CVE-2024-34385

CVE-2024-34385 is a stored XSS vulnerability in the YITH WooCommerce Wishlist plugin for WordPress. It affects versions

CVE-2024-34764

CVE-2024-34764 is marked as rejected by the CVE-Numbering Authority (collision with another CVE). Nevertheless, connected sources show a related vulnerability: Essential Addons for Elementor

CVE-2024-34766

CVE-2024-34766 is an XSS flaw in the ChaosTheory WordPress theme (affected: ChaosTheory <= 1.3). The root cause is improper neutralization of input during web page generation, enabling stored XSS when an authenticated user interacts with or views pages generated by the theme. Public documentat...

CVE-2024-34767

CVE-2024-34767 is a Stored XSS vulnerability in the ShopLentor WordPress plugin (formerly WooLentor), affecting ShopLentor up to version 2.8.7. The root cause is improper input neutralization during web page generation, enabling stored XSS. The vulnerability has a patched status in the connected ...

CVE-2024-34769

CVE-2024-34769 affects the WordPress plugin Elegant Blocks (Elegant Blocks – Amazing Gutenberg Blocks). Root cause: Improper neutralization of input during web page generation, enabling Stored XSS. Affected version range: up to 1.7. Impact: Stored XSS in pages generated by the plugin. Patch statu...