PT-2024-19838 · Qualcomm · Qualcomm

Name of the Vulnerable Software and Affected Versions: Qualcomm products affected versions not specified Description: The issue is related to information disclosure while decoding Tracking Area Update Accept or Attach Accept messages received from the network. This can lead to information...

CVE-2024-8344

A vulnerability has been found in Campcodes Supplier Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/editarea.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The...

Campcodes Supplier Management System SQL注入漏洞

Campcodes Supplier Management System is a supplier management system from Campcodes, Inc. A SQL injection vulnerability exists in Campcodes Supplier Management System version 1.0, which stems from a parameter id in the file /admin/editarea.php that can lead to SQL injection...

PT-2024-38959 · Unknown · Campcodes Supplier Management System

Name of the Vulnerable Software and Affected Versions: Campcodes Supplier Management System version 1.0 Description: A critical issue has been found in the system, affecting an unknown functionality of the file /admin/edit area.php. The manipulation of the id argument leads to SQL injection. This...

CVE-2024-6449 Arbitrary cross-domain file inclusion in HyperView Geoportal Toolkit

HyperView Geoportal Toolkit in versions lower than 8.5.0 does not restrict cross-domain requests when fetching remote content pointed by one of GET request parameters. An unauthenticated remote attacker can prepare links, which upon opening will load scripts from a remote location controlled by t...

CVE-2024-6449 Arbitrary cross-domain file inclusion in HyperView Geoportal Toolkit

HyperView Geoportal Toolkit in versions lower than 8.5.0 does not restrict cross-domain requests when fetching remote content pointed by one of GET request parameters. An unauthenticated remote attacker can prepare links, which upon opening will load scripts from a remote location controlled by t...

CVE-2024-6449

HyperView Geoportal Toolkit (versions

D-Link DIR-846W Command Execution Vulnerability (CNVD-2025-18481)

D-Link DIR-846W is a dual-band Gigabit wireless router with second-generation 11AC technology and MU-MIMO technology, supporting dual-band concurrent transmission rates up to 1200Mbps for 200M and above broadband users. A command execution vulnerability exists in the D-Link DIR-846W. The...

CVE-2024-42775

An Incorrect Access Control vulnerability was found in /admin/addroomcontroller.php in Kashipara Hotel Management System v1.0, which allows an unauthenticated attacker to add the valid hotel room entries in the administrator section via the direct URL access...

fork: defer linking file vma until vma is fully initialized

...

PHOENIX CONTACT CHARX SEC 安全漏洞

PHOENIX CONTACT CHARX SEC is a series of AC charge controllers from PHOENIX CONTACT, Germany. A security vulnerability exists in PHOENIX CONTACT CHARX SEC. An attacker could use the firmware update function on the LAN interface of the device to reset the password of the user with low privileges...

CVE-2024-42625

FrogCMS v0.9.5 was discovered to contain a Cross-Site Request Forgery CSRF vulnerability via /admin/?/layout/add...

net: can: j1939: Initialize unused data in j1939_send_one()

...

kernel: ensure definition of the fixmap area is in a limit

A flaw was found in the Linux kernel. The fixmap area that was defined for the PPC64 architecture was invalid...

kernel: userfaultfd: fix a race between writeprotect and exit_mmap()

A possible race condition flaw was found in the Linux kernel. When a process exits, its virtual memory areas VMAs are removed by exitmmap, and at the same time, userfaultfdwriteprotect is called...

CVE-2024-7264

A flaw was found in libcurl, where libcurl's ASN1 parser code has the GTime2str function, used for parsing an ASN.1 Generalized Time field. If a syntactically incorrect field is given, the parser can use -1 for the length of the time fraction, leading to a strlen performed on a pointer to a heap...

The vulnerability of the smb2_get_data_area_len() function in the implementation of the SMB protocol server for Linux operating systems allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the smb2getdataarealen function in the fs/smb/server/smb2misc.c module of the SMB protocol server implementation in Linux operating systems is related to accessing memory beyond the allocated buffer. Exploiting this vulnerability could allow an attacker to compromise the...

WordPress Ajax Search Lite plugin < 4.12.1 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Krugov Artyom in WordPress Plugin Ajax Search Lite versions 4.12.1...

SUSE CVE-2024-42076

In the Linux kernel, the following vulnerability has been resolved: net: can: j1939: Initialize unused data in j1939sendone syzbot reported kernel-infoleak in rawrecvmsg 1. j1939sendone creates full frame including unused data, but it doesn't initialize it. This causes the kernel-infoleak issue...

SUSE CVE-2024-42126

In the Linux kernel, the following vulnerability has been resolved: powerpc: Avoid nmienter/nmiexit in real mode interrupt. nmienter/nmiexit touches per cpu variables which can lead to kernel crash when invoked during real mode interrupt handling e.g. early HMI/MCE interrupt handler if percpu...