CVE-2024-29826

CVE-2024-29826 is an unspecified SQL Injection in the Core server of Ivanti Endpoint Manager (EPM) 2022 SU5 and earlier. The vulnerability allows an unauthenticated attacker on the same network to execute arbitrary code. Affected component: Core server SQL logic. Impact: remote code execution wit...

CVE-2024-22059

CVE-2024-22059 describes a SQL injection in the web component of Ivanti Neurons for ITSM. The vulnerability is exploitable by a remote authenticated user and can allow reading, modification, or deletion of information in the underlying database, with potential denial of service. Affected product:...

CVE-2024-29824

CVE-2024-29824 affects Ivanti Endpoint Manager (EPM) Core server. A SQL injection in the RecordGoodApp flow (via un-sanitized md5 in ReportedGoodApps handling) allows an unauthenticated attacker on the same network to execute arbitrary code, enabling unauthenticated remote code execution. Vulnera...

CVE-2024-29827

CVE-2024-29827 is an SQL injection vulnerability in the Core server of Ivanti Endpoint Manager (EPM) 2022 SU5 and earlier. An unauthenticated, adjacent-network attacker can execute arbitrary code due to improper input handling in the Core server (PTSecurity notes involve the GetDBPatchProducts fu...

CVE-2024-29825

CVE-2024-29825 describes an unauthenticated SQL Injection vulnerability in the Core server of Ivanti Endpoint Manager (EPM) 2022 SU5 and prior . The underlying issue allows an attacker on the same network to execute arbitrary code, with high impact to confidentiality, integrity, and availability ...

CVE-2024-29823

CVE-2024-29823 is an unspecified SQL Injection vulnerability in the Core server of Ivanti Endpoint Manager (Ivanti EPM) 2022 SU5 and earlier. An unauthenticated attacker on the same network can execute arbitrary code. The cited sources consistently describe this as part of a broader set of SQL in...

CVE-2024-5176

CVE-2024-5176 affects Baxter/ Welch Allyn Configuration Tool, version 1.9.4.1 and earlier. The underlying issue is insufficiently protected credentials , which could enable remote services to operate with stolen credentials. According to the sources, the vulnerability is rated with a high impact:...

CVE-2024-35196

Sentry’s Slack integration leaks sensitive data by logging the incoming request_body, including the deprecated Slack verification token, under specific log patterns. Affected: self-hosted Sentry installations; SaaS users are unaffected. Impact in the public advisories (GHSA, Red Hat, OSV, CVE rec...

CVE-2024-1275

CVE-2024-1275 affects Baxter Welch Allyn Connex Spot Monitor (CSM) prior to version 1.52. The vulnerability stems from a default cryptographic key, enabling an attacker to modify device configuration and firmware data, with potential impact on patient care. The ICS advisory notes remote exploitat...

CVE-2024-36120

javascript-deobfuscator removes common JavaScript obfuscation techniques. In affected versions crafted payloads targeting expression simplification can lead to code execution. This issue has been patched in version 1.1.0. Users are advised to update. Users unable to upgrade should disable the...

CVE-2024-35142

In the available documents, CVE-2024-35142 affects IBM Security Verify Access Docker versions 10.0.0 and 10.0.6. The root cause is execution of unnecessary privileges that allows a local user to escalate privileges, yielding a HIGH impact (confidentiality, integrity, and availability). IBM’s bull...

CVE-2024-35140

CVE-2024-35140 affects IBM Security Verify Access Docker versions 10.0.0–10.0.6. The root cause is improper certificate validation that could allow a local user to escalate privileges. The IBM PSIRT and related advisories indicate a fix released with 10.0.7 (and ISVA 10.0.7-ISS-ISVA-FP0000 for 10...

CVE-2024-36120

CVE-2024-36120 concerns the javascript-deobfuscator library. Affected versions allow crafted payloads that target the expression simplification feature to cause code execution. The issue is mitigated by updating to version 1.1.0; if upgrading is not possible, users should disable the expression s...

CVE-2022-25037

An issue in wanEditor v4.7.11 and fixed in v.4.7.12 and v.5 was discovered to contain a cross-site scripting XSS vulnerability via the image upload function...

CVE-2022-25038

wanEditor v4.7.11 was discovered to contain a cross-site scripting XSS vulnerability via the video upload function...

CVE-2022-25037

The CVE-2022-25037 entry concerns wanEditor. A cross-site scripting (XSS) vulnerability exists in wanEditor version 4.7.11 exposed via the image upload function. The issue is fixed in version 4.7.12 and in version 5.0.0 (listed as v.5). Impact details in the provided sources indicate an XSS flaw ...

CVE-2022-25038

CVE-2022-25038 concerns wanEditor up to version 4.7.11, where a cross-site scripting (XSS) vulnerability is triggered via the video upload function. The CVSS 3.1 base score is 6.1 (MEDIUM) with network attack, low attack complexity, and user interaction required. Affected component: wanEditor vid...

CVE-2024-28736

The CVE-2024-28736 entry concerns Debezium Community debezium-ui v2.5. The connected documents provide concrete details: a local attacker can execute arbitrary code through the application’s refresh page function, indicating a local-privilege/execution path with low privileges required and no use...

CVE-2024-1980

Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2023-6876. Reason: This candidate is a reservation duplicate of CVE-2023-6876. Notes: All CVE users should reference CVE-2023-6876 instead of this candidate. All references and descriptions in this candidate have been remov...

CVE-2024-36108

Summary: CVE-2024-36108 affects casgate, an open source identity and access management system. Affected: casgate versions with a broken function-level authorization vulnerability that allows remote, unauthenticated attackers to read sensitive information via GET requests to an API endpoint by man...