CVE-2024-23579

HCL DRYiCE Optibot Reset Station is impacted by insecure encryption of security questions. This could allow an attacker with access to the database to recover some or all encrypted values...

CVE-2023-30312

An issue discovered in OpenWrt 18.06, 19.07, 21.02, 22.03, and beyond allows off-path attackers to hijack TCP sessions, which could lead to a denial of service, impersonating the client to the server e.g., for access to files over FTP, and impersonating the server to the client e.g., to deliver...

CVE-2023-30314

CVE-2023-30314 affects 360 V6G, 360 T5G, 360 T6M and 360 P1 routers. The issue enables attackers to hijack TCP sessions, potentially causing denial of service. Root cause and scope are documented in sources such as PT-2024-12233, which lists affected models and describes the impact as TCP session...

CVE-2024-23580

The CVE-2024-23580 entry concerns HCL DRYiCE Optibot Reset Station. Affected component: the OTP handling/encryption mechanism, where insecure encryption could allow an attacker with database access to recover some or all encrypted OTP values. Documented impact focuses on confidentiality (HIGH) wi...

CVE-2024-23579

The CVE-2024-23579 entry concerns HCL DRYiCE Optibot Reset Station, where insecure encryption of security questions could let an attacker with database access recover some or all encrypted values. According to CVSS 3.1, the issue has a base score of 6.5 (Medium) with Network attack vector, Low at...

CVE-2024-35548

A SQL injection vulnerability in Mybatis plus versions below 3.5.6 allows remote attackers to obtain database information via a Boolean blind injection. NOTE: the vendor's position is that this can only occur in a misconfigured application; the documentation discusses how to develop applications...

CVE-2024-35226

Smarty (PHP template engine) is affected; in affected versions, template authors can inject PHP code by supplying a malicious file name to an extends-tag, enabling potential code execution. Debian/Ubuntu advisories indicate patches exist (e.g., smarty4 fix in Debian DSA-5830; Ubuntu USN- has secu...

CVE-2024-35511

The CVE affects phpgurukul Men Salon Management System v2.0. The vulnerable component is the /msms/admin/index.php endpoint, where the username parameter is susceptible to SQL Injection due to insufficient input handling. This can enable an attacker to manipulate queries and potentially gain unau...

CVE-2024-35548

CVE-2024-35548 is a SQL injection vulnerability in MyBatis-Plus versions below 3.5.6. The issue allows remote attackers to obtain database information via a Boolean blind injection. The vendor notes this can only occur in misconfigured applications, and guidance exists to develop applications tha...

CVE-2024-22641

CVE-2024-22641 affects TCPDF and causes Regular Expression Denial of Service when parsing specially crafted SVG files. Public reports show multiple distributions addressing it: Debian (bookworm: 6.6.2+dfsg1-1+deb12u1; bullseye: 6.3.5+dfsg1-1+deb11u1), Fedora (6.7.7), and Debian LTS DSAs provide f...

CVE-2024-28060

An issue was discovered in Apiris Kafeo 6.4.4. It permits DLL hijacking, allowing a user to trigger the execution of arbitrary code every time the product is executed...

CVE-2023-30308

An issue discovered in Ruijie EG210G-P, Ruijie EG105G-V2, Ruijie NBR, and Ruijie EG105G routers allows attackers to hijack TCP sessions which could lead to a denial of service...

CVE-2022-45171

An issue was discovered in LIVEBOX Collaboration vDesk through v018. An Unrestricted Upload of a File with a Dangerous Type can occur under the vShare web site section. A remote user, authenticated to the product, can arbitrarily upload potentially dangerous files without restrictions...

CVE-2024-35240

CVE-2024-35240 affects Umbraco Commerce (dotnet e-commerce solution). A stored XSS vulnerability exists in the Print Functionality affecting versions prior to 12.1.4 and prior to 10.0.5. The underlying issue is improper input handling in the Print feature, enabling an attacker to inject malicious...

CVE-2024-35239

CVE-2024-35239 affects Umbraco Commerce through Umbraco Forms components. An authenticated user with access to edit forms can inject unsafe code into form components via TitleAndDescription rendering, enabling a stored XSS condition. Public details show patched versions: 13.0.1, 12.2.2, 10.5.3, a...

CVE-2023-30313

CVE-2023-30313 affects Wavlink QUANTUM D2G routers. The connected sources describe a vulnerability that allows an attacker to hijack TCP sessions, potentially leading to a denial of service. The available documents do not provide concrete exploit details, affected subcomponents, or patch/version ...

CVE-2024-28060

CVE-2024-28060 affects Apiris Kafeo 6.4.4. The issue is DLL hijacking that can allow arbitrary code execution when the product runs. Local attack vector with Low privileges required and User interaction needed, resulting in High impact on confidentiality, integrity, and availability per the provi...

CVE-2023-30306

CVE-2023-30306 affects Mercury x30g and Mercury YR1800XG routers. The issue enables attackers to hijack TCP sessions, with the practical consequence of potential denial of service. The connected PT-2024-12226 entry notes that affected versions are not specified and does not indicate a public fix,...

CVE-2023-30310

CVE-2023-30310 affects the Comfast CF-616AC router family. The issue enables attackers to hijack TCP sessions, which can lead to a denial of service. The NVD entry lists a network-remote attack vector with low complexity and no privileges required, resulting in high availability impact. Public se...

CVE-2024-35583

The CVE-2024-35583 entry concerns a cross-site scripting (XSS) vulnerability in Sourcecodester Laboratory Management System v1.0. Concrete details from connected sources show the issue arises in the Remarks input field where a crafted payload can cause arbitrary web scripts/HTML to execute in the...