CVE-2024-35240

CVE-2024-35240 affects Umbraco Commerce (dotnet e-commerce solution). A stored XSS vulnerability exists in the Print Functionality affecting versions prior to 12.1.4 and prior to 10.0.5. The underlying issue is improper input handling in the Print feature, enabling an attacker to inject malicious...

CVE-2024-35239

CVE-2024-35239 affects Umbraco Commerce through Umbraco Forms components. An authenticated user with access to edit forms can inject unsafe code into form components via TitleAndDescription rendering, enabling a stored XSS condition. Public details show patched versions: 13.0.1, 12.2.2, 10.5.3, a...

CVE-2023-30313

CVE-2023-30313 affects Wavlink QUANTUM D2G routers. The connected sources describe a vulnerability that allows an attacker to hijack TCP sessions, potentially leading to a denial of service. The available documents do not provide concrete exploit details, affected subcomponents, or patch/version ...

CVE-2024-28060

CVE-2024-28060 affects Apiris Kafeo 6.4.4. The issue is DLL hijacking that can allow arbitrary code execution when the product runs. Local attack vector with Low privileges required and User interaction needed, resulting in High impact on confidentiality, integrity, and availability per the provi...

CVE-2023-30306

CVE-2023-30306 affects Mercury x30g and Mercury YR1800XG routers. The issue enables attackers to hijack TCP sessions, with the practical consequence of potential denial of service. The connected PT-2024-12226 entry notes that affected versions are not specified and does not indicate a public fix,...

CVE-2023-30310

CVE-2023-30310 affects the Comfast CF-616AC router family. The issue enables attackers to hijack TCP sessions, which can lead to a denial of service. The NVD entry lists a network-remote attack vector with low complexity and no privileges required, resulting in high availability impact. Public se...

CVE-2024-35583

The CVE-2024-35583 entry concerns a cross-site scripting (XSS) vulnerability in Sourcecodester Laboratory Management System v1.0. Concrete details from connected sources show the issue arises in the Remarks input field where a crafted payload can cause arbitrary web scripts/HTML to execute in the...

CVE-2024-35581

CVE-2024-35581 corresponds to a stored cross-site scripting (XSS) vulnerability in Sourcecodester Laboratory Management System v1.0, where a crafted payload in the Borrower Name input field can run arbitrary web scripts/HTML. Connected sources (e.g., PT-2024-26558) confirm the affected software/v...

CVE-2023-30309

The CVE-2023-30309 entry concerns the D-Link DI-7003GV2 router family. All available documents describe a vulnerability that could let an attacker hijack a TCP session, potentially causing a denial of service. Concrete technical specifics (such as affected firmware versions, exact component or pr...

CVE-2024-35582

CVE-2024-35582 corresponds to a cross-site scripting (XSS) vulnerability in Sourcecodester Laboratory Management System v1.0, exploitable via crafted payloads injected into the Department input field. The available connected documents consistently reference the same issue and confirm the affected...

CVE-2023-30308

The CVE-2023-30308 issue affects Ruijie routers: Ruijie EG210G-P, Ruijie EG105G-V2, Ruijie NBR, and Ruijie EG105G. A TCP session hijack vulnerability could lead to denial of service. The PT-2024-12228 entry notes affected models and recommends updating to a version that addresses the TCP session ...

CVE-2024-28061

CVE-2024-28061 affects Apiris Kafeo 6.4.4. A bypass of protection allows access to data stored in the embedded database file. Concrete details in connected docs confirm the vulnerable component is the embedded data protection mechanism; the core issue is bypassing safeguards rather than remote co...

CVE-2024-35510

CVE-2024-35510 is an arbitrary file upload vulnerability in DedeCMS v5.7.114, exploitable via /dede/file_manage_control.php to execute arbitrary code. Multiple sources corroborate the issue, with core detail that uploading a crafted file leads to code execution. The CVSS3.1 vector indicates netwo...

CVE-2023-30307

The CVE-2023-30307 issue affects multiple TP-LINK routers, including TL-R473GP-AC, XDR6020, TL-R479GP-AC, TL-R4239G, TL-WAR1200L, and TL-R476G. Descriptions across sources indicate attackers can hijack TCP sessions, potentially causing a denial of service. The connected PT security entry provides...

CVE-2023-46694

Vtenext 21.02 is affected by an authentication-related flaw in the Ckeditor File Manager that allows an authenticated user to upload arbitrary files, potentially enabling remote code execution. Root cause: failure to enforce proper authentication controls when accessing the file manager. Impact: ...

CVE-2024-36110

ansibleguy-webui is an open source WebUI for using Ansible. Multiple forms in versions 0.0.21 allowed injection of HTML elements. These are returned to the user after executing job actions and thus evaluated by the browser. These issues have been addressed in version 0.0.21 0.0.21.post2 on pypi...

CVE-2024-24919

Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the internet and enabled with remote Access VPN or Mobile Access Software Blades. A Security fix that mitigates this vulnerability is available...

CVE-2024-36109

CoCalc is web-based software that enables collaboration in research, teaching, and scientific publishing. In affected versions the markdown parser allows tags to be included which execute when published. This issue has been addressed in commit 419862a9c9879c. Users are advised to upgrade. There a...

CVE-2023-30305

An issue discovered in Linksys E5600 routers allows attackers to hijack TCP sessions which could lead to a denial of service...

CVE-2023-43847

Incorrect access control in the outlet control function of web interface in Aten PE6208 2.3.228 and 2.4.232 allows remote authenticated users to control all the outlets as if they were the administrator via HTTP POST requests...