CVE-2024-36109

CVE-2024-36109 affects CoCalc. In affected versions, the markdown parser allows embedded HTML [removed] tags to be executed when published, enabling cross-site scripting (XSS). Root cause: markdown rendering flaw that permits script execution. Impact stated as high confidentiality and integrity r...

CVE-2024-5433

The CVE-2024-5433 vulnerability affects Campbell Scientific CSI Web Server (and RTMC Pro) and is caused by a path traversal flaw in a command that returns the most recent file matching a given expression. Versions 1.6 and earlier of the CSI Web Server (and RTMC Pro 5.x/4.x) are affected. An attac...

CVE-2024-36110

CVE-2024-36110 affects the open-source web UI for Ansible named ansibleguy-webui. The vulnerability arises from multiple HTML injection points in forms for versions earlier than 0.0.21, with injected elements being returned to users and rendered by browsers after job actions. The issue has been a...

CVE-2024-24919

CVE-2024-24919 is a zero-day-like vulnerability in Check Point Security Gateways (Remote Access VPN/Mobile Access blades) allowing unauthenticated remote readers to fetch arbitrary files via path traversal (e.g., aCSHELL/../../../../../../../etc/shadow). Public PoCs and in-the-wild mentions exist...

CVE-2023-43850

CVE-2023-43850 affects ATEN PE6208 web interface (versions 2.3.228 and 2.4.232). The issue is improper input validation in the user management function, allowing remote authenticated users to trigger a partial denial of service via HTTP POST requests. The connected documents corroborate the affec...

CVE-2023-43849

CVE-2023-43849 concerns Aten PE6208 devices, where the web interface firmware upgrade function has incorrect access control. Affected firmware versions are 2.3.228 and 2.4.232. Remote authenticated users can submit a firmware image via HTTP POST, with potential outcomes including DoS or remote co...

CVE-2023-43848

CVE-2023-43848 affects Aten PE6208 firewall management in the web interface. The issue is incorrect access control that lets remote authenticated users alter local firewall settings as if they were an administrator via HTTP POST. Affected versions include 2.3.228 and 2.4.232. Documented impact is...

CVE-2023-43847

CVE-2023-43847 (Aten PE6208) affects PE6208 devices, versions 2.3.228 through 2.4.232. The root cause is incorrect access control in the web interface’s outlet control function, enabling remote authenticated users to control all outlets as if they were administrators via HTTP POST requests. Publi...

CVE-2023-43846

The CVE-2023-43846 issue affects Aten PE6208 web interface logs management. Affected versions: 2.3.228 through 2.4.232. Description from multiple sources indicates improper access control in the web UI logs management function allows remote attackers to retrieve device logs via HTTP GET, exposing...

CVE-2023-43845

CVE-2023-43845 affects Aten PE6208 devices, specifically versions 2.3.228 and 2.4.232, where default credentials for the privileged telnet account allow login with administrator privileges if unchanged after first login. The root cause is default credentials not being enforced to be changed, enab...

CVE-2023-43844

CVE-2023-43844 affects Aten PE6208 devices (versions 2.3.228 and 2.4.232). The issue is default credentials on the privileged web interface; users are not forced to change them after first login, enabling an attacker with access to log in and gain administrator privileges. The risk is supported b...

CVE-2023-43843

CVE-2023-43843 affects Aten PE6208 web interface: improper access control in the account management function on versions 2.3.228 and 2.4.232 allows remote authenticated users to read user and administrator passwords via HTTP GET. Impact is passwords exposed; CVSS 3.1 base score 7.3 (HIGH) with ne...

CVE-2023-43842

CVE-2023-43842 concerns Aten PE6208 web interface: the account-management function has incorrect access control, allowing remote authenticated users to alter user and administrator credentials via an HTTP POST request. Affected versions are 2.3.228 through 2.4.232. The root cause is improper acce...

CVE-2024-33402

A SQL injection vulnerability in /model/approvepettycash.php in campcodes Complete Web-Based School Management System 1.0 allows attacker to execute arbitrary SQL commands via the id parameter...

CVE-2024-33402

CVE-2024-33402 affects Campcodes Complete Web-Based School Management System 1.0. A SQL injection exists in /model/approve_petty_cash.php via the id parameter, allowing arbitrary SQL commands. CVSS 3.1 BASE score 8.1 (HIGH) with network attack vector, low complexity, low privileges required, no u...

CVE-2024-30165

Amazon AWS Client VPN before 3.9.1 on macOS has a buffer overflow that could potentially allow a local actor to execute arbitrary commands with elevated permissions, a different vulnerability than CVE-2024-30164...

CVE-2024-34852

F-logic DataCube3 v1.0 is affected by command injection due to improper string filtering at the command execution point in the ./admin/transceiverschedule.php file. An unauthenticated remote attacker can exploit this vulnerability by sending a file name containing command injection. Successful...

CVE-2024-26024

SUBNET Solutions Inc. has identified vulnerabilities in third-party components used in Substation Server...

CVE-2024-35344

The CVE-2024-35344 entry concerns several Anpviz IP cameras (e.g., IPC-D250/260, B850, D850, D350, D3150, D4250, D380, D880, D280, D3180, MC800N, YM500L/800N_N2, YMF50B, YM800SV2, YM500L8, YM200E10) whose firmware (v3.2.2.2 and earlier) stores a hardcoded cryptographic key. The root cause is the ...

CVE-2024-35341

Anpviz IPC series devices are affected by CVE-2024-35341, allowing unauthenticated access to the running configuration via HTTP GET to /ConfigFile.ini or /config.xml. The configuration file exposes usernames and encrypted passwords (encrypted with a hardcoded key common to all devices). Affected ...