CVE-2024-35350

The CVE-2024-35350 entry concerns Diño Physics School Assistant v2.3. A SQL injection vulnerability exists in the code handling the endpoint /admin/?page=borrow/view_borrow, triggered by manipulating the id parameter. Affected component is the admin borrow viewing logic; root cause is unvalidated...

CVE-2024-35351

CVE-2024-35351 affects Diño Physics School Assistant version 2.3, with a cross-site scripting vulnerability in the code path handling /classes/SystemSettings.php?f=update_settings. The root cause is unvalidated manipulation of the parameter name that can lead to stored/reflective XSS depending on...

CVE-2024-36941

In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: don't free NULL coalescing rule If the parsing fails, we can dereference a NULL pointer here...

CVE-2024-36920

In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Avoid memcpy field-spanning write WARNING When the "storcli2 show" command is executed for eHBA-9600, mpi3mr driver prints this WARNING message: memcpy: detected field-spanning write size 128 of single field...

CVE-2024-36922

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: read txq-readptr under lock If we read txq-readptr without lock, we can read the same value twice, then obtain the lock, and reclaim from there to two different places, but crucially reclaim the same entry twice,...

CVE-2024-35430

In ZKTeco ZKBio CVSecurity v6.1.1R and earlier fixed in 6.1.3R an authenticated user can bypass password checks while exporting data from the application...

CVE-2024-32029

Rejected reason: This CVE is a duplicate of another CVE...

CVE-2024-35431

CVE-2024-35431 affects ZKTeco ZKBio CVSecurity (versions around 6.1.1, with reports up to 6.4.1) via the photoBase64 parameter. Root cause: directory traversal allows an unauthenticated attacker to download local server files. Impact: confidentiality of server data is HIGH; no integrity/availabil...

CVE-2024-35352

Diño Physics School Assistant 2.3 is affected by a cross-site scripting (XSS) vulnerability in the code path /classes/Users.php?f=save. The issue is triggered by manipulating the middlename parameter, enabling XSS as described in multiple sources. CVSS 3.1 metrics indicate NETWORK attack vector w...

CVE-2024-35432

ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Cross Site Scripting (XSS) via an audio file. An authenticated user can inject malicious JavaScript to trigger the XSS. Affected component is the CVSecurity web/UI layer handling audio input; root cause is improper handling/ sanitization of audio-fil...

CVE-2024-35354

CVE-2024-35354 affects Diño Physics School Assistant v2.3. The vulnerability is in an unidentified path under /classes/Master.php?f=save_category where manipulating the id parameter enables SQL injection. The CVSS metrics indicate NETWORK access, no privileges, no user interaction, and a base sco...

CVE-2024-35355

CVE-2024-35355 concerns Diño Physics School Assistant v2.3. The issue is in an unidentified code path under the file /classes/Master.php?f=delete_category, where manipulating the argument id enables an SQL injection. This is documented across multiple sources/collections and is associated with a ...

CVE-2024-35356

Diño Physics School Assistant 2.3 is vulnerable to SQL injection in the code path /classes/Master.php?f=save_item. The issue arises when the argument id is manipulated, allowing potential data leakage or modification through the backend database. Reported CVSS details indicate a low to moderate i...

CVE-2024-35357

Diño Physics School Assistant version 2.3 contains a SQL injection vulnerability in the delete_item path. The issue arises from unvalidated input passed through /classes/Master.php?f=delete_item with the id parameter, enabling SQL injection (public details confirm CVE-2024-35357 with a base score...

CVE-2024-35345

CVE-2024-35345 affects Diño Physics School Assistant, version 2.3. The vulnerability is a cross-site scripting issue in the code path involving the argument id within the file /classes/Users.php. The available sources consistently describe an unrecognized/unvalidated code path that allows script ...

CVE-2024-35358

CVE-2024-35358 affects Diño Physics School Assistant v2.3. The vulnerability arises from an unidentified code path in /classes/Master.php?f=view_category where manipulating the id parameter enables SQL injection. Documented impact includes potential confidentiality and integrity effects (per CVSS...

CVE-2024-35430

CVE-2024-35430 affects ZKTeco ZKBio CVSecurity, specifically versions 6.1.1_R and earlier. An authenticated user can bypass password checks when exporting data from the application, indicating a severe access-control bypass in the export workflow. The fixed version is 6.1.3_R (per the provided de...

CVE-2024-36955

In CVE-2024-36955, the Linux kernel ALSA: hda: intel-sdw-acpi code had a path using device_get_named_child_node() that could leak a reference if fwnode_handle_put() was not called on the returned fwnode handle. The described fix adds a call to fwnode_handle_put() to prevent a leaked reference, ad...

CVE-2024-36956

CVE-2024-36956 affects the Linux kernel’s thermal subsystem (thermal/debugfs). The root cause is that thermal_debug_tz_remove() does not free all allocated memory for thermal zone diagnostics when a zone is removed, making some memory unreachable. The vulnerability is addressed by modifying therm...

CVE-2024-36950

CVE-2024-36950 is a Linux kernel vulnerability resolved in the FireWire OHCI driver. The issue occurred in the interrupt handler when a bus reset interrupt could be unmasked and cause a freeze if the bus reset was not yet serviced. The fix masks bus reset interrupts in the IRQ handler and unmasks...