CVE-2024-11858: Improper Neutralization of Special Elements used in an OS Command

A flaw was found in Radare2, which contains a command injection vulnerability caused by insufficient input validation when handling Pebble Application files. Maliciously crafted inputs can inject shell commands during command parsing, leading to unintended behavior during file processing​...

CVE-2024-11820

CVE-2024-11820 affects the open-source project Code-Projects Crud Operation System 1.0 . The vulnerability is a cross-site scripting (XSS) flaw in the handling of the saddress parameter of the file /add.php . The root cause is indicated as the manipulation of this argument leading to XSS. The iss...

CVE-2024-11742

A vulnerability, which was classified as problematic, has been found in SourceCodester Best House Rental Management System 1.0. This issue affects some unknown processing of the file /rental/ajax.php?action=savetenant. The manipulation of the argument lastname/firstname/middlename leads to cross...

Hugging Face Transformers 代码问题漏洞

Hugging Face Transformers is advanced natural language processing built for Jax, PyTorch and TensorFlow. A code issue vulnerability exists in Hugging Face Transformers that stems from improper data validation in model file processing, which could lead to untrusted data deserialization and allow a...

CVE-2024-11256

CVE-2024-11256 details (NORMAL) : Affects 1000 Projects Portfolio Management System MCA 1.0. The vulnerability is a SQL injection in the login.php flow caused by unsafely handling the username parameter, enabling remote abuse. Descriptions consistently classify this as critical with potential rem...

webkitgtk: Processing a file may lead to unexpected app termination or arbitrary code execution

A flaw was found in WebKitGTK. Processing malicious web content can cause unexpected app termination or arbitrary code execution due to improper checks...

Fedora 37 : nginx (2022-12721789aa)

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-12721789aa advisory. Security: processing of a specially crafted mp4 file by the ngxhttpmp4module might cause a worker process crash, worker process memory disclosure, o...

CVE-2024-11070

CVE-2024-11070 affects Sanluan PublicCMS 5.202406.d. The issue is a cross-site scripting vulnerability in the Tag Type Handler, specifically in the /admin/cmsTagType/save endpoint where manipulation of the argument name enables XSS. The vulnerability can be triggered remotely and the exploit has ...

CVE-2024-10809

CVE-2024-10809 impacts the Code-Projects E-Health Care System v1.0. The vulnerability lies in the web endpoint /Doctor/chat.php, where manipulating the parameters name (and by indication, also message ) enables an SQL injection. This remote-access issue is described across multiple sources (NVD, ...

CVE-2024-10730

A vulnerability, which was classified as critical, has been found in Tongda OA up to 11.6. This issue affects some unknown processing of the file /pda/appcenter/webshow.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been...

CVE-2024-10618

CVE-2024-10618 affects Tongda OA 2017 up to 11.10. The vulnerability is a SQL injection in the repid parameter of /pda/reportshop/record_detail.php, exploitable remotely. Public exploit disclosure is noted. Connected sources (Red Hat/CVE lists, CNNVD, PT-Security, and Vuldb) consistently describe...

CVE-2024-44144

A buffer overflow was addressed with improved size validation. This issue is fixed in iOS 17.7.1 and iPadOS 17.7.1, macOS Sequoia 15, macOS Sonoma 14.7.1, tvOS 18, watchOS 11, visionOS 2, iOS 18 and iPadOS 18. Processing a maliciously crafted file may lead to unexpected app termination...

CVE-2024-44218

This issue was addressed with improved checks. This issue is fixed in iOS 17.7.1 and iPadOS 17.7.1, iOS 18.1 and iPadOS 18.1, macOS Sequoia 15.1, macOS Sonoma 14.7.1. Processing a maliciously crafted file may lead to heap corruption...

webkitgtk: Processing a file may lead to unexpected app termination or arbitrary code execution

A flaw was found in WebKitGTK. Processing malicious web content can cause unexpected app termination or arbitrary code execution due to improper checks...

CVE-2024-10416

The CVE-2024-10416 vulnerability affects Code-Projects Blood Bank Management System 1.0, in the processing of /file/cancel.php. The root cause is improper handling of the reqid parameter, leading to SQL injection. Exploitation can be remote, and public disclosure exists. No patch/version details ...

CVE-2024-9807

A vulnerability was found in Craig Rodway Classroombookings 2.8.7 and classified as problematic. This issue affects some unknown processing of the file /sessions of the component Session Page. The manipulation of the argument Name leads to cross site scripting. The attack may be initiated remotel...

CVE-2024-9481

An out-of-bounds write in the engine module in AVG/Avast Antivirus signature 24092400 released on 24/Sep/2024 on MacOS allows a malformed eml file to crash the application during file processing...

CVE-2024-9481

An out-of-bounds write in the engine module in AVG/Avast Antivirus signature 24092400 released on 24/Sep/2024 on MacOS allows a malformed eml file to crash the application during file processing...

CVE-2024-9482

An out-of-bounds write in the engine module in AVG/Avast Antivirus signature 24092400 released on 24/Sep/2024 on MacOS allows a malformed Mach-O file to crash the application during file processing...

CVE-2024-9484

An null-pointer-derefrence in the engine module in AVG/Avast Antivirus signature 24092400 released on 24/Sep/2024 on MacOS allows a malformed xar file to crash the application during file processing...