CVE-2024-35342

Anpviz IPC cameras (including models such as IPC-D250, IPC-D260, IPC-B850, IPC-D850, IPC-D350, IPC-D3150, IPC-D4250, IPC-D380, IPC-D880, IPC-D280, IPC-D3180, MC800N, YM500L, YM800N_N2, YMF50B, YM800SV2, YM500L8, YM200E10) are affected. The issue allows unauthenticated users to modify or disable c...

CVE-2024-35343

Anpviz IPC cameras are affected by CVE-2024-35343: unauthenticated remote attackers can download arbitrary files from the device filesystem via HTTP GET to /playback/. Affected models include IPC-D250/260/B850/D850/D350/D3150/D4250/D380/D880/280/3180, MC800N, YM500L/800N_N2/YMF50B/YM800SV2/YM500L...

CVE-2024-30165

CVE-2024-30165 affects Amazon AWS Client VPN for macOS before version 3.9.1. It involves a buffer overflow in the macOS client that could allow a local actor to execute arbitrary commands with elevated privileges. The initial documents do not provide a confirmed remediation for this CVE; note tha...

CVE-2024-30164

CVE-2024-30164 affects Amazon AWS Client VPN. The issue is a buffer overflow in the VPN client that could allow a local attacker to execute arbitrary commands with elevated privileges. According to connected documents, the vulnerability is fixed in: Windows 3.11.1, macOS 3.9.1, and Linux 3.12.1. ...

CVE-2024-35563

CDG-Server-V5.6.2.126.139 and earlier are affected by a SQL injection flaw in the permissionId parameter of CDGTempPermissions (CVE-2024-35563). The CVE records show a high-severity impact (CVSS v3.1: 9.8, CRITICAL) with network attack vector, no user interaction required, and full confidentialit...

CVE-2024-26024

CVE-2024-26024 affects SUBNET Substation Server where vulnerabilities arise from reliance on third-party components. Affected product: Substation Server (versions up to 2.23.10). Root cause: use of out-of-date/insufficiently trustworthy libraries in third-party components. Impact: potential privi...

CVE-2024-34854

CVE-2024-34854 concerns F-logic DataCube3 v1.0 with a vulnerability in the file upload mechanism exposed via the endpoint /admin/transceiver_schedule.php . The issue is a file upload vulnerability that can potentially allow attacker-controlled file uploads, contributing to a high-severity impact ...

CVE-2024-34852

CVE-2024-34852 affects F-logic DataCube3 v1.0, where command injection occurs in the ./admin/transceiver_schedule.php file due to improper string filtering at the command execution point. An unauthenticated remote attacker can trigger the vulnerability by sending a file name containing command in...

CVE-2024-35401

TOTOLINK CP900L v4.1.5cu.798_B20221228 is affected by a command injection vulnerability in the UploadFirmwareFile function, exploitable via the FileName parameter. Root cause: insufficient filtering/validation of constructed commands in FileName leading to command execution with local privileges....

CVE-2024-35403

TOTOLINK CP900L, version 4.1.5cu.798_B20221228, contains a stack overflow in setIpPortFilterRules triggered by the desc parameter. Root cause: improper validation/length handling in the parameter leads to stack overflow, with potential denial of service as described in multiple sources. Affected ...

CVE-2024-33849

ci solution CI-Out-of-Office Manager through 6.0.0.77 uses a Hard-coded Cryptographic Key...

CVE-2024-24959

Several out-of-bounds write vulnerabilities exist in the Programming Software Connection FileSystem API functionality of AutomationDirect P3-550E 1.2.10.9. Specially crafted network packets can lead to heap-based memory corruption. An attacker can send malicious packets to trigger these...

CVE-2024-24955

Several out-of-bounds write vulnerabilities exist in the Programming Software Connection FileSystem API functionality of AutomationDirect P3-550E 1.2.10.9. Specially crafted network packets can lead to heap-based memory corruption. An attacker can send malicious packets to trigger these...

CVE-2024-24958

Several out-of-bounds write vulnerabilities exist in the Programming Software Connection FileSystem API functionality of AutomationDirect P3-550E 1.2.10.9. Specially crafted network packets can lead to heap-based memory corruption. An attacker can send malicious packets to trigger these...

CVE-2024-21785

A leftover debug code vulnerability exists in the Telnet Diagnostic Interface functionality of AutomationDirect P3-550E 1.2.10.9. A specially crafted series of network requests can lead to unauthorized access. An attacker can send a sequence of requests to trigger this vulnerability...

CVE-2024-23315

A read-what-where vulnerability exists in the Programming Software Connection IMM 01A1 Memory Read functionality of AutomationDirect P3-550E 1.2.10.9. A specially crafted network packet can lead to a disclosure of sensitive information. An attacker can send an unauthenticated packet to trigger th...

CVE-2024-30212

The CVE-2024-30212 entry concerns Microchip Harmony 3 Core library (and related Red Hat/NVD entries) that allows remote RAM access via SCSI READ(10)/WRITE commands over USB when using the maximum LBA (0xFFFFFFFF) and default 512-byte blocks. The described行为 enables reading the first 512 bytes of ...

CVE-2024-22590

CVE-2024-22590 affects Kwik, specifically version 745fd4e2, where the TLS engine does not track the current connection state. This can allow Client Hello messages to be overwritten at any time, including after a connection has been established. The PT-2024-19495 entry provides explicit details on...

CVE-2024-36472

In CVE-2024-36472, GNOME Shell up to 45.7 allows a portal helper to be launched automatically (without user confirmation) based on crafted network responses from an attacker on the local network, which can then load untrusted JavaScript. This can lead to resource consumption or other impacts depe...

CVE-2024-33808

CVE-2024-33808 describes a SQL injection vulnerability in Campcodes Complete Web-Based School Management System 1.0, exploitable via the id parameter of /model/get_timetable.php. The root cause is improper handling of input in the timetable retrieval endpoint, allowing arbitrary SQL execution. Th...