CVE-2024-11051 AMTT Hotel Broadband Operation System online_status.php sql injection

A vulnerability was found in AMTT Hotel Broadband Operation System up to 3.0.3.151204. It has been classified as critical. Affected is an unknown function of the file /manager/frontdesk/onlinestatus.php. The manipulation of the argument AccountID leads to sql injection. It is possible to launch t...

CVE-2024-10596 ESAFENET CDG EncryptPolicyTypeService.java delEntryptPolicySort sql injection

A vulnerability was found in ESAFENET CDG 5. It has been rated as critical. Affected by this issue is the function delEntryptPolicySort of the file /com/esafenet/servlet/system/EncryptPolicyTypeService.java. The manipulation of the argument id leads to sql injection. The attack may be launched...

CVE-2024-10546

The CVE-2024-10546 entry concerns open-scratch Teaching 在线教学平台 (versions up to 2.7). The vulnerability exists in the URL Handler’s API endpoint /api/sys/ng-alain/getDictItemsByTable/ and is due to an SQL injection in that API. It is exploitable remotely and an exploit has been disclosed publicly....

CVE-2024-10503 Klokan MapTiler tileserver-gl URL cross site scripting

A vulnerability was found in Klokan MapTiler tileserver-gl 2.3.1 and classified as problematic. This issue affects some unknown processing of the component URL Handler. The manipulation of the argument key leads to cross site scripting. The attack may be initiated remotely. The exploit has been...

CVE-2024-10502 ESAFENET CDG FileDirectoryService.java getOneFileDirectory sql injection

A vulnerability has been found in ESAFENET CDG 5 and classified as critical. This vulnerability affects the function getOneFileDirectory of the file /com/esafenet/servlet/fileManagement/FileDirectoryService.java. The manipulation of the argument directoryId leads to sql injection. The attack can ...

ABB Cylon Aspect 3.08.01 (jsonProxy.php) Unauthenticated Remote SSH Service Control

Summary ASPECT is an award-winning scalable building energy management and control solution designed to allow users seamless access to their building data through standard building protocols including smart devices. Description The jsonProxy.php endpoint on the ABB BMS/BAS controller is vulnerabl...

CVE-2024-10372 chidiwilliams buzz model_loader.py download_model temp file

A vulnerability classified as problematic was found in chidiwilliams buzz 1.1.0. This vulnerability affects the function downloadmodel of the file buzz/modelloader.py. The manipulation leads to insecure temporary file. It is possible to launch the attack on the local host. The complexity of an...

PT-2024-16226 · Unknown · Chidiwilliams Buzz

Name of the Vulnerable Software and Affected Versions: chidiwilliams buzz version 1.1.0 Description: A problematic vulnerability was found in the download model function of the buzz/model loader.py file. This issue leads to an insecure temporary file and can be exploited locally, with a high...

CVE-2024-10193

The CVE-2024-10193 issue affects WAVLINK WN530H4, WN530HG4, and WN572HG3 up to 20221028, with a vulnerability in the ping_ddns function of internet.cgi. The DDNS parameter manipulation enables command injection, and the attack may be initiated remotely; exploits have been disclosed publicly. Conn...

CVE-2024-10073

flairNLP flair 0.14.0 is affected by a code-injection vulnerability in the ClusteringModel function located in flair/models/clustering.py (Mode File Loader). The issue allows remote code execution and is described as high severity; attack complexity is listed as high and exploitation has been dis...

CVE-2024-10069 ESAFENET CDG MailDecryptApplicationService.java actionPassMainApplication sql injection

A vulnerability was found in ESAFENET CDG 5. It has been rated as critical. Affected by this issue is the function actionPassMainApplication of the file /com/esafenet/servlet/client/MailDecryptApplicationService.java. The manipulation of the argument id leads to sql injection. The attack may be...

CVE-2024-9917 HuangDou UTCMS template_creat.php deserialization

A vulnerability, which was classified as critical, was found in HuangDou UTCMS V9. This affects an unknown part of the file app/modules/ut-template/admin/templatecreat.php. The manipulation of the argument content leads to deserialization. It is possible to initiate the attack remotely. The explo...

CVE-2024-9790 LyLme_spage sou.php sql injection

A vulnerability was found in LyLmespage 1.9.5. It has been classified as critical. Affected is an unknown function of the file /admin/sou.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and...

CVE-2024-9001 TOTOLINK T10 cstecgi.cgi setTracerouteCfg os command injection

A vulnerability was found in TOTOLINK T10 4.1.8cu.5207. It has been declared as critical. This vulnerability affects the function setTracerouteCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument command leads to os command injection. The attack can be initiated remotely. The...

CVE-2024-8863

The CVE-2024-8863 issue affects aimhubio Aim up to 3.24, where the Text Explorer component’s textbox.tsx uses dangerouslySetInnerHTML. The root cause is manipulation of the query argument that enables cross-site scripting. The vulnerability is remote-exploitable and public exploits have been disc...

CVE-2024-8692 TDuckCloud TDuckPro password recovery

A vulnerability classified as critical was found in TDuckCloud TDuckPro up to 6.3. Affected by this vulnerability is an unknown functionality. The manipulation leads to weak password recovery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The...

CVE-2024-8692 TDuckCloud TDuckPro password recovery

A vulnerability classified as critical was found in TDuckCloud TDuckPro up to 6.3. Affected by this vulnerability is an unknown functionality. The manipulation leads to weak password recovery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The...

CVE-2024-8577

A vulnerability was found in TOTOLINK AC1200 T8 and AC1200 T10 4.1.5cu.861B20230220/4.1.8cu.5207. It has been declared as critical. Affected by this vulnerability is the function setStaticDhcpRules of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument desc leads to buffer overflow. T...

CVE-2024-8410

A vulnerability classified as problematic was found in ABCD ABCD2 up to 2.2.0-beta-1. This vulnerability affects unknown code of the file /abcd/opac/php/otrossitios.php. The manipulation of the argument sitio leads to path traversal. The attack can be initiated remotely. The exploit has been...

CVE-2024-8409 ABCD ABCD2 show_image.php path traversal

A vulnerability classified as problematic has been found in ABCD ABCD2 up to 2.2.0-beta-1. This affects an unknown part of the file /common/showimage.php. The manipulation of the argument image leads to path traversal: '../filedir'. It is possible to initiate the attack remotely. The exploit has...