CVE-2024-35581

CVE-2024-35581 corresponds to a stored cross-site scripting (XSS) vulnerability in Sourcecodester Laboratory Management System v1.0, where a crafted payload in the Borrower Name input field can run arbitrary web scripts/HTML. Connected sources (e.g., PT-2024-26558) confirm the affected software/v...

CVE-2023-30309

The CVE-2023-30309 entry concerns the D-Link DI-7003GV2 router family. All available documents describe a vulnerability that could let an attacker hijack a TCP session, potentially causing a denial of service. Concrete technical specifics (such as affected firmware versions, exact component or pr...

CVE-2024-35582

CVE-2024-35582 corresponds to a cross-site scripting (XSS) vulnerability in Sourcecodester Laboratory Management System v1.0, exploitable via crafted payloads injected into the Department input field. The available connected documents consistently reference the same issue and confirm the affected...

CVE-2023-30308

The CVE-2023-30308 issue affects Ruijie routers: Ruijie EG210G-P, Ruijie EG105G-V2, Ruijie NBR, and Ruijie EG105G. A TCP session hijack vulnerability could lead to denial of service. The PT-2024-12228 entry notes affected models and recommends updating to a version that addresses the TCP session ...

CVE-2024-28061

CVE-2024-28061 affects Apiris Kafeo 6.4.4. A bypass of protection allows access to data stored in the embedded database file. Concrete details in connected docs confirm the vulnerable component is the embedded data protection mechanism; the core issue is bypassing safeguards rather than remote co...

CVE-2024-35510

CVE-2024-35510 is an arbitrary file upload vulnerability in DedeCMS v5.7.114, exploitable via /dede/file_manage_control.php to execute arbitrary code. Multiple sources corroborate the issue, with core detail that uploading a crafted file leads to code execution. The CVSS3.1 vector indicates netwo...

CVE-2023-30307

The CVE-2023-30307 issue affects multiple TP-LINK routers, including TL-R473GP-AC, XDR6020, TL-R479GP-AC, TL-R4239G, TL-WAR1200L, and TL-R476G. Descriptions across sources indicate attackers can hijack TCP sessions, potentially causing a denial of service. The connected PT security entry provides...

CVE-2023-46694

Vtenext 21.02 is affected by an authentication-related flaw in the Ckeditor File Manager that allows an authenticated user to upload arbitrary files, potentially enabling remote code execution. Root cause: failure to enforce proper authentication controls when accessing the file manager. Impact: ...

CVE-2024-36110

ansibleguy-webui is an open source WebUI for using Ansible. Multiple forms in versions 0.0.21 allowed injection of HTML elements. These are returned to the user after executing job actions and thus evaluated by the browser. These issues have been addressed in version 0.0.21 0.0.21.post2 on pypi...

CVE-2024-36109

CoCalc is web-based software that enables collaboration in research, teaching, and scientific publishing. In affected versions the markdown parser allows tags to be included which execute when published. This issue has been addressed in commit 419862a9c9879c. Users are advised to upgrade. There a...

CVE-2024-24919

Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the internet and enabled with remote Access VPN or Mobile Access Software Blades. A Security fix that mitigates this vulnerability is available...

CVE-2023-43847

Incorrect access control in the outlet control function of web interface in Aten PE6208 2.3.228 and 2.4.232 allows remote authenticated users to control all the outlets as if they were the administrator via HTTP POST requests...

CVE-2023-43848

Incorrect access control in the firewall management function of web interface in Aten PE6208 2.3.228 and 2.4.232 allows remote authenticated users to alter local firewall settings of the device as if they were the administrator via HTTP POST request...

CVE-2023-30305

An issue discovered in Linksys E5600 routers allows attackers to hijack TCP sessions which could lead to a denial of service...

CVE-2023-43849

Incorrect access control in firmware upgrade function of web interface in Aten PE6208 2.3.228 and 2.4.232 allows remote authenticated users to submit a firmware image via HTTP POST requests. This may result in DoS or remote code execution...

CVE-2023-30305

The CVE-2023-30305 entry concerns Linksys E5600 routers. Affected component: the router’s TCP session handling, where an issue allows an attacker to hijack TCP sessions, potentially leading to a denial of service. Public details across connected records confirm the core impact but do not specify ...

CVE-2023-30311

The CVE-2023-30311 issue affects H3C Magic R365 and H3C Magic R100 routers. A TCP session hijacking vulnerability could allow an attacker to cause a denial of service. Root cause details are not provided in the documents. Exploitation status is not described; no in-wild exploit information is inc...

CVE-2024-33450

Finereport v8.0 is affected by an SQL injection vulnerability that enables a remote attacker to obtain sensitive information. The issue stems from insecure SQL handling in Finereport 8.0. No exploit details are provided in the documents. Remediation is to update to a version that includes a fix, ...

CVE-2024-36107

MinIO (MinIO object storage) contains a information-disclosure vulnerability (CVE-2024-36107) where anonymous GET requests using If-Modified-Since/If-Unmodified-Since can reveal object existence and metadata (Last-Modified, Etag, x-amz-version-id, Expires, Cache-Control) without proper validation...

CVE-2024-5434

CVE-2024-5434 affects Campbell Scientific CSI Web Server (and RTMC Pro in affected scope). The vulnerability concerns storing web authentication credentials in a file with a specific name where passwords are weakly encoded. If an attacker gains access to that file, passwords could be decoded and ...