CVE-2024-32850

Improper neutralization of special elements used in a command 'Command Injection' exists in SkyBridge MB-A100/MB-A110 firmware Ver. 4.2.2 and earlier and SkyBridge BASIC MB-A130 firmware Ver. 1.5.5 and earlier. If the remote monitoring and control function is enabled on the product, an attacker...

CVE-2024-36843

CVE-2024-36843 affects libmodbus in version 3.1.6, describing a heap overflow in the modbus_mapping_free() function. Multiple connected advisories/OSV entries corroborate the issue and note remediations or duplicates (e.g., Debian 3.1.6-2+deb11u1 fixes). Impact is described as a heap overflow; pr...

CVE-2024-37032

CVE-2024-37032 affects Ollama before 0.1.34. The vulnerability stems from improper validation of the digest format (sha256, 64 hex digits) when resolving the model path, causing incorrect handling of inputs in TestGetBlobsPath (fewer or more than 64 hex digits, or a leading ../). This can enable ...

CVE-2024-5495

Use after free in Dawn in Google Chrome prior to 125.0.6422.141 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

CVE-2024-5497

Out of bounds memory access in Browser UI in Google Chrome prior to 125.0.6422.141 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

CVE-2024-5498

Use after free in Presentation API in Google Chrome prior to 125.0.6422.141 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security severity: High...

CVE-2024-5494

CVE-2024-5494 is a vulnerability described as a “Use after free in Dawn” in Google Chrome before 125.0.6422.141, which could enable a remote attacker to trigger heap corruption via a crafted HTML page. The connected documents confirm affected software is Chrome’s Dawn component with the underlyin...

CVE-2024-5493

CVE-2024-5493 describes a heap buffer overflow in WebRTC within Google Chrome/Chromium before version 125.0.6422.141. The issue allows a remote attacker to potentially corrupt the heap via a crafted HTML page, with high-severity impact. Public advisories across multiple vendors corroborate this C...

CVE-2024-5271

Fuji Electric Monitouch V-SFT is vulnerable to an out-of-bounds write because of a type confusion, which could result in arbitrary code execution...

CVE-2024-4842

Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. Reason: Not a vulnerability...

CVE-2024-34171

CVE-2024-34171 affects Fuji Electric Monitouch V-SFT. The issue is a stack-based buffer overflow in the parsing of V9C/V10 files (and related input handling), which can permit execution of arbitrary code. Some sources note that exploitation requires user interaction (visiting a malicious page or ...

CVE-2024-5271

Fuji Electric Monitouch V-SFT is affected by CVE-2024-5271, a type confusion that enables an out-of-bounds write leading to arbitrary code execution. Affected products are Monitouch V-SFT versions prior to 6.2.3.0. The root cause is a type confusion in processing certain input (V9C files in some ...

CVE-2024-2420

LenelS2 NetBox access control and event monitoring system was discovered to contain Hardcoded Credentials in versions prior to and including 5.6.1 which allows an attacker to bypass authentication requirements...

CVE-2024-35469

CVE-2024-35469 affects SourceCodester Human Resource Management System v1.0. A SQL injection occurs in the /hrm/user/ endpoint through the password parameter due to improper handling, enabling attackers to execute arbitrary SQL commands. Practical impact is high (as described in sources). Mitigat...

CVE-2024-35468

CVE-2024-35468 affects SourceCodester Human Resource Management System v1.0. A SQL injection flaw exists in the /hrm/index.php endpoint, exploitable through the password parameter to execute arbitrary SQL commands. Root cause: improper handling/sanitization of input to the SQL query in that API p...

CVE-2024-5537

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2024-35431

ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via photoBase64. An unauthenticated user can download local files from the server. NOTE: Third parties have indicated other versions are also vulnerable including up to 6.4.1...

CVE-2024-35352

A vulnerability has been discovered in Diño Physics School Assistant version 2.3. This vulnerability impacts unidentified code within the file /classes/Users.php?f=save. Manipulating the parameter middlename results in cross-site scripting...

CVE-2024-35350

A vulnerability has been discovered in Diño Physics School Assistant version 2.3. The vulnerability impacts an unidentified code within the file /admin/?page=borrow/viewborrow. Manipulating the argument id can result in SQL injection...

CVE-2024-35428

CVE-2024-35428 affects ZKTeco ZKBio CVSecurity 6.1.1. The issue is a Directory Traversal via BaseMediaFile, allowing an authenticated user to delete local server files, leading to a Denial of Service. Documents consistently identify the vulnerable component as BaseMediaFile handling and do not pr...