CVE-2024-51520

Vulnerability of input parameters not being verified in the HDC module Impact: Successful exploitation of this vulnerability may affect availability...

kernel: ethtool: check device is present when getting link settings

A flaw was found in ethtool in the Linux kernel, where sysfs reader getting link settings can attempt to read the device state on a device that is not present, leading to a crash...

CVE-2024-20107

In da, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS09124360; Issue ID: MSV-1823...

CVE-2024-20109

In ccu, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS09065928; Issue ID: MSV-1763...

CVE-2024-20118

A security vulnerability exists in the mms component of MediaTek Chipsets due to an incorrect bounds check, which can result in an out-of-bounds write . An attacker can exploit this flaw to achieve local escalation of privilege , requiring System execution privileges . Exploitation does not requi...

PT-2024-25076 · Qualcomm · Snapdragon +16

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: There is a memory corruption issue when handling the request to update SIM PB records. This issue occurs while processing the update SIM PB records...

GridGain Security update in Brocade SANnav version 2.3.1a (CVE-2023-32732, CVE-2023-34462, CVE-2023-33953, CVE-2023-40167, CVE-2023-36479, CVE-2023-41900, CVE-2022-2048, CVE-2023-26048, CVE-2023-26049)

Brocade has provided a Security update to the following GridGain related CVEs in Brocade SANnav version 2.3.1a. CVE-2023-32732, CVE-2023-34462, CVE-2023-33953, CVE-2023-40167, CVE-2023-36479, CVE-2023-41900, CVE-2022-2048, CVE-2023-26048, CVE-2023-26049 Products Confirmed Not Affected. Brocade...

ASB-A-341256043

In installExistingPackageAsUser of InstallPackageHelper.java, there is a possible carrier restriction bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2024-27402 · Unknown · Hercules Core

Name of the Vulnerable Software and Affected Versions: Hercules Core versions n/a through 6.5 Description: The issue is related to a Missing Authorization vulnerability, which allows the exploitation of incorrectly configured Access Control Security Levels. Recommendations: For versions n/a throu...

PT-2024-30323 · WordPress · Waitlist Woocommerce

Name of the Vulnerable Software and Affected Versions: Waitlist Woocommerce Back in stock notifier versions n/a through 2.6 Description: The issue affects the Waitlist Woocommerce Back in stock notifier plugin due to a Missing Authorization vulnerability. This vulnerability allows exploitation of...

PT-2024-27584 · Unknown · Newspack Newsletters

Name of the Vulnerable Software and Affected Versions: Newspack Newsletters versions n/a through 2.13.2 Description: The issue is related to a Missing Authorization vulnerability, which allows accessing functionality not properly constrained by ACLs. Recommendations: For versions n/a through...

CVE-2024-39719

An issue was discovered in Ollama through 0.3.14. File existence disclosure can occur via api/create. When calling the CreateModel route with a path parameter that does not exist, it reflects the "File does not exist" error message to the attacker, providing a primitive for file existence on the...

CVE-2024-10452

CVE-2024-10452 affects Grafana (open‑source platform). The issue allows Organization administrators to delete pending invites in an organization they are not part of, representing an Authorization Bypass/Improper Access protection described in the connected advisories. Exploitation details are no...

PT-2024-33616 · Unknown · Chatplusjp

Name of the Vulnerable Software and Affected Versions: chatplusjp versions n/a through 1.02 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, which allows Reflected XSS. This means that an attacker can inject malicious scripts into a website,...

K000148278: Spring framework CVE-2024-38820 vulnerability

Security Advisory Description The fix for CVE-2022-22968 made disallowedFields patterns in DataBinder case insensitive. However, String.toLowerCase has some Locale dependent exceptions that could potentially result in fields not protected as expected. CVE-2024-38820 Impact There is no impact; F5...

PT-2024-34181 · Unknown · Namaste! Lms

Name of the Vulnerable Software and Affected Versions: Namaste! LMS versions n/a through 2.6.3 Description: The issue is related to Deserialization of Untrusted Data, which allows Object Injection. This can potentially lead to security breaches by injecting malicious objects into the system...

PT-2024-33680

Name of the Vulnerable Software and Affected Versions: MPXJ versions prior to 13.5.1 Description: The patch for a historical issue in MPXJ is incomplete, allowing a malicious path to be constructed that could enable files to be written to arbitrary locations. Recommendations: For versions prior t...

PT-2024-34270 · Scottcart · Scottcart

Name of the Vulnerable Software and Affected Versions: ScottCart versions n/a through 1.1 Description: The issue is related to improper control of generation of code, also known as 'Code Injection'. This allows for code injection in ScottCart. Recommendations: For versions n/a through 1.1, consid...

CVE-2024-10428

The CVE-2024-10428 issue affects WAVLINK WN530H4, WN530HG4 and WN572HG3 (firmware up to 20221028). Root cause: command injection in the set_ipv6 function of firewall.cgi triggered by manipulating the dhcpGateway argument. Impact: potential remote execution with high confidentiality/integrity/avai...

PT-2024-10795 · Unknown · Commonregexjs

Name of the Vulnerable Software and Affected Versions: CommonRegexJS versions all available versions Description: The issue concerns Regular Expression Denial of Service ReDoS due to vulnerable regular expressions in CommonRegexJS. No known patches are available as of the time of publication...