CVE-2024-33402

A SQL injection vulnerability in /model/approvepettycash.php in campcodes Complete Web-Based School Management System 1.0 allows attacker to execute arbitrary SQL commands via the id parameter...

CVE-2024-33402

CVE-2024-33402 affects Campcodes Complete Web-Based School Management System 1.0. A SQL injection exists in /model/approve_petty_cash.php via the id parameter, allowing arbitrary SQL commands. CVSS 3.1 BASE score 8.1 (HIGH) with network attack vector, low complexity, low privileges required, no u...

CVE-2024-34852

F-logic DataCube3 v1.0 is affected by command injection due to improper string filtering at the command execution point in the ./admin/transceiverschedule.php file. An unauthenticated remote attacker can exploit this vulnerability by sending a file name containing command injection. Successful...

CVE-2024-30165

Amazon AWS Client VPN before 3.9.1 on macOS has a buffer overflow that could potentially allow a local actor to execute arbitrary commands with elevated permissions, a different vulnerability than CVE-2024-30164...

CVE-2024-26024

SUBNET Solutions Inc. has identified vulnerabilities in third-party components used in Substation Server...

CVE-2024-35344

The CVE-2024-35344 entry concerns several Anpviz IP cameras (e.g., IPC-D250/260, B850, D850, D350, D3150, D4250, D380, D880, D280, D3180, MC800N, YM500L/800N_N2, YMF50B, YM800SV2, YM500L8, YM200E10) whose firmware (v3.2.2.2 and earlier) stores a hardcoded cryptographic key. The root cause is the ...

CVE-2024-35341

Anpviz IPC series devices are affected by CVE-2024-35341, allowing unauthenticated access to the running configuration via HTTP GET to /ConfigFile.ini or /config.xml. The configuration file exposes usernames and encrypted passwords (encrypted with a hardcoded key common to all devices). Affected ...

CVE-2024-35342

Anpviz IPC cameras (including models such as IPC-D250, IPC-D260, IPC-B850, IPC-D850, IPC-D350, IPC-D3150, IPC-D4250, IPC-D380, IPC-D880, IPC-D280, IPC-D3180, MC800N, YM500L, YM800N_N2, YMF50B, YM800SV2, YM500L8, YM200E10) are affected. The issue allows unauthenticated users to modify or disable c...

CVE-2024-35343

Anpviz IPC cameras are affected by CVE-2024-35343: unauthenticated remote attackers can download arbitrary files from the device filesystem via HTTP GET to /playback/. Affected models include IPC-D250/260/B850/D850/D350/D3150/D4250/D380/D880/280/3180, MC800N, YM500L/800N_N2/YMF50B/YM800SV2/YM500L...

CVE-2024-30165

CVE-2024-30165 affects Amazon AWS Client VPN for macOS before version 3.9.1. It involves a buffer overflow in the macOS client that could allow a local actor to execute arbitrary commands with elevated privileges. The initial documents do not provide a confirmed remediation for this CVE; note tha...

CVE-2024-30164

CVE-2024-30164 affects Amazon AWS Client VPN. The issue is a buffer overflow in the VPN client that could allow a local attacker to execute arbitrary commands with elevated privileges. According to connected documents, the vulnerability is fixed in: Windows 3.11.1, macOS 3.9.1, and Linux 3.12.1. ...

CVE-2024-35563

CDG-Server-V5.6.2.126.139 and earlier are affected by a SQL injection flaw in the permissionId parameter of CDGTempPermissions (CVE-2024-35563). The CVE records show a high-severity impact (CVSS v3.1: 9.8, CRITICAL) with network attack vector, no user interaction required, and full confidentialit...

CVE-2024-26024

CVE-2024-26024 affects SUBNET Substation Server where vulnerabilities arise from reliance on third-party components. Affected product: Substation Server (versions up to 2.23.10). Root cause: use of out-of-date/insufficiently trustworthy libraries in third-party components. Impact: potential privi...

CVE-2024-34854

CVE-2024-34854 concerns F-logic DataCube3 v1.0 with a vulnerability in the file upload mechanism exposed via the endpoint /admin/transceiver_schedule.php . The issue is a file upload vulnerability that can potentially allow attacker-controlled file uploads, contributing to a high-severity impact ...

CVE-2024-34852

CVE-2024-34852 affects F-logic DataCube3 v1.0, where command injection occurs in the ./admin/transceiver_schedule.php file due to improper string filtering at the command execution point. An unauthenticated remote attacker can trigger the vulnerability by sending a file name containing command in...

CVE-2024-35401

TOTOLINK CP900L v4.1.5cu.798_B20221228 is affected by a command injection vulnerability in the UploadFirmwareFile function, exploitable via the FileName parameter. Root cause: insufficient filtering/validation of constructed commands in FileName leading to command execution with local privileges....

CVE-2024-35403

TOTOLINK CP900L, version 4.1.5cu.798_B20221228, contains a stack overflow in setIpPortFilterRules triggered by the desc parameter. Root cause: improper validation/length handling in the parameter leads to stack overflow, with potential denial of service as described in multiple sources. Affected ...

CVE-2024-33849

ci solution CI-Out-of-Office Manager through 6.0.0.77 uses a Hard-coded Cryptographic Key...

CVE-2024-24955

Several out-of-bounds write vulnerabilities exist in the Programming Software Connection FileSystem API functionality of AutomationDirect P3-550E 1.2.10.9. Specially crafted network packets can lead to heap-based memory corruption. An attacker can send malicious packets to trigger these...

CVE-2024-24959

Several out-of-bounds write vulnerabilities exist in the Programming Software Connection FileSystem API functionality of AutomationDirect P3-550E 1.2.10.9. Specially crafted network packets can lead to heap-based memory corruption. An attacker can send malicious packets to trigger these...