CVE-2024-48659

Digital China Networks DCME-320-L wireless routers (versions 9.3.2.114 and earlier) are vulnerable to a command injection flaw in the log_u_umount.php component. A remote attacker can exploit this issue to execute arbitrary code on the affected device. To mitigate this risk, users are recommended...

KLA74117 Multiple vulnerabilities in Microsoft Browser

Multiple vulnerabilities were found in Microsoft Browser. Malicious users can exploit these vulnerabilities to execute arbitrary code, cause denial of service, spoof user interface, bypass security restrictions. Below is a complete list of vulnerabilities: 1. Use after free vulnerability in Parce...

CVE-2024-27766

MariaDB v11.1 is vulnerable to Remote Code Execution (RCE) via the lib_mysqludf_sys.so function. An attacker with sufficient database privileges, specifically the FILE privilege and write access to the plugin directory, can register a malicious User-Defined Function (UDF) to execute arbitrary OS ...

CVE-2024-48781

Wanxing Technology Yitu Project Management Kirin Edition 2.3.6 is vulnerable to remote code execution due to an unrestricted upload of a file with a dangerous type (CWE-434). A remote attacker can execute arbitrary code by providing a specially constructed .so file to the /opt/EdrawProj-2/plugins...

Adobe Animate Memory Misreference Vulnerability (CNVD-2024-41261)

Adobe Animate is a set of Flash animation software from the American company Audobee Adobe. Adobe Animate suffers from a memory misreference vulnerability that can be exploited by an attacker to execute arbitrary code in the context of the current user...

Adobe Framemaker Code Issue Vulnerability (CNVD-2024-40916)

Adobe Framemaker is the United States of America Odooby Adobe company's set of page layout software for writing and editing large or complex documents including structured documents. A code issue vulnerability exists in Adobe Framemaker. An attacker could exploit this vulnerability to execute...

CVE-2024-46088

The Zhejiang University Entersoft Customer Resource Management System versions v2002 through v2024 are affected by an arbitrary file upload vulnerability in the ProductAction.entphone interface. This flaw allows an attacker to upload a crafted file to execute arbitrary code . To remediate this, u...

Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS : libgsf vulnerabilities (USN-7062-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7062-1 advisory. It was discovered that libgsf incorrectly handled certain Compound Document Binary files. If a user or automated system were...

CVE-2024-34668

Out-of-bounds write in parsing h.263 format in librtppayload.so prior to SMR Oct-2024 Release 1 allows remote attackers to execute arbitrary code with system privilege. User interaction is required for triggering this vulnerability...

CVE-2024-41593

CVE-2024-41593 affects DrayTek Vigor310 devices up to version 4.3.2.6. The vulnerability is a heap-based buffer overflow in the web interface function ft_payload_dns due to a byte sign-extension in the length argument of a memcpy call, enabling remote code execution. Connected sources confirm the...

CVE-2024-45965

Contao before 5.5.6 allows XSS via an SVG document. This affects in contao/core-bundle in Composer 4.x before 4.13.54, 5.0.x through 5.3.x before 5.3.30, and 5.4.x and 5.5..x before 5.5.6...

Security Bulletin: Vulnerability in libxml2 affects IBM Integrated Analytics System [CVE-2021-3518]

Summary Redhat provided libxml2 is used by IBM Integrated Analytics System. IBM Integrated Analytics System has addressed the applicable CVE CVE-2021-3518 Vulnerability Details CVEID:CVE-2021-3518 DESCRIPTION: GNOME libxml2 could allow a remote attacker to execute arbitrary code on the system,...

CVE-2024-33368

An issue in Plasmoapp RPShare Fabric mod v.1.0.0 allows a remote attacker to execute arbitrary code via the build method in DonwloadPromptScreen...

CVE-2024-46441

An arbitrary file upload vulnerability in YPay 1.2.0 allows attackers to execute arbitrary code via a ZIP archive to themePutFile in app/common/util/Upload.php called from app/admin/controller/ypay/Home.php. The file extension of an uncompressed file is not checked...

ROS-20240927-01

Vulnerability of FFmpeg multimedia library function loadinputpicture is related to buffer copying without checking input data size. checking the size of the input data. Exploitation of the vulnerability could allow an attacker to execute arbitrary code Vulnerability in interpolate component...

USN-7044-1: libcupsfilters vulnerability

Simone Margaritelli discovered that libcupsfilters incorrectly sanitized IPP data when creating PPD files. A remote attacker could possibly use this issue to manipulate PPD files and execute arbitrary code when a printer is used...

CVE-2024-40125

An arbitrary file upload vulnerability in the Media Manager function of Closed-Loop Technology CLESS Server v4.5.2 allows attackers to execute arbitrary code via uploading a crafted PHP file to the upload endpoint...

K000141090: SQLite vulnerability CVE-2020-13630

Security Advisory Description ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow, related to the snippet feature. CVE-2020-13630 Impact When this vulnerability is exploited, an attacker can cause SQLite to crash, resulting in a denial-of-service DoS, or possibly execu...

Adobe Acrobat Reader DC Continuous Security Update (APSB24-70) - Windows

Adobe Acrobat Reader DC Continuous is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

CVE-2024-45695

CVE-2024-45695 affects D-Link DIR-X4860 wireless routers. The web service exposes a stack-based buffer overflow in unauthenticated context, enabling remote code execution. Public sources confirm the DIR-X4860 as affected and describe the root cause as a stack-based overflow in the device’s web se...