CVE-2022-48681

The CVE CVE-2022-48681 affects some Huawei smart speakers and is described as a memory overflow vulnerability. Huawei PSIRT advisory HWPSIRT-2022-52860 confirms this CVE ID and notes that exploitation may cause certain functions to fail. The connected documents do not provide specific affected mo...

CVE-2024-28886

OS command injection vulnerability exists in UTAU versions prior to v0.4.19. If a user of the product opens a crafted UTAU project file .ust file, an arbitrary OS command may be executed...

CVE-2024-32944

Path traversal vulnerability exists in UTAU versions prior to v0.4.19. If a user of the product installs a crafted UTAU voicebank installer .uar file, .zip file to UTAU, an arbitrary file may be placed...

CVE-2024-28886

Summary of CVE-2024-28886 : An OS command injection vulnerability exists in UTAU versions prior to v0.4.19. When a user opens a crafted UTAU project file (.ust), an arbitrary OS command may be executed. Affected software is UTAU (pre-0.4.19). Root cause is an injection flaw in handling the .ust f...

CVE-2024-29078

Incorrect permission assignment for critical resource issue exists in MosP kintai kanri V4.6.6 and earlier, which may allow a remote unauthenticated attacker with access to the product to alter the product settings...

CVE-2023-30312

CVE-2023-30312 affects OpenWrt 18.06, 19.07, 21.02, 22.03 and newer builds. The issue is an off-path TCP session hijack vulnerability caused by nf_conntrack_tcp_no_window_check being true by default, enabling denial of service and impersonation of both client and server (e.g., FTP access, finance...

CVE-2024-29078

MosP kintai kanri is affected by CVE-2024-29078 in versions 4.6.6 and earlier. The root cause is an incorrect permission assignment for a critical resource, which could allow a remote unauthenticated attacker with access to the product to alter product settings. The issue is documented across mul...

CVE-2024-28880

CVE-2024-28880 affects MosP kintai kanri, versions 4.6.6 and earlier. The issue is a path traversal vulnerability that allows a remote attacker who can log in to the product to obtain sensitive information. Multiple connected sources corroborate the affected product/version and describe the impac...

CVE-2024-36428

OrangeHRM 3.3.3 is affected by an SQL injection in the admin/viewProjects sortOrder parameter. The vulnerability stems from unsafe handling of the sortOrder input, enabling potential data exposure or modification per the CVSS 3.1 metrics (base score 8.1, HIGH). Exploitation status is not describe...

CVE-2024-36037

Zoho ManageEngine ADAudit Plus (Windows AD management tool) is affected by CVE-2024-36037 due to an insufficient access control flaw. Versions 7260 and below expose session recordings to unauthorized local agent machine users. The root cause is improper access control, enabling viewing of other u...

CVE-2024-27310

CVE-2024-27310 affects Zoho ManageEngine ADSelfService Plus prior to version 6401. The vulnerability arises from malicious LDAP input causing a denial-of-service condition, impacting availability (per CVE metrics). Connected sources corroborate that versions below 6401 are vulnerable; no explicit...

CVE-2024-36105

CVE-2024-36105 affects dbt-core prior to 1.6.15, 1.7.15, and 1.8.1. The issue arises when the docs server binds to INADDR_ANY or IN6ADDR_ANY (0.0.0.0/::) instead of localhost, exposing the HTTP server on all network interfaces. This can enable unauthorized access from other hosts on the same netw...

CVE-2024-35238

Summary: Minder by Stacklok (pre-0.0.51) is vulnerable to a DoS caused by the sigstore verifier reading an untrusted response without a size limit. An attacker can cause Minder to fetch attestations from a user-controlled GitHub endpoint (orgs/$owner/attestations/$checksumref) and feed a large re...

CVE-2024-35231

rack-contrib before 2.5.0 is vulnerable to denial of service because the profiler_runs parameter was not constrained, enabling unbounded resource consumption on the server. A patch exists in version 2.5.0. Remediation: upgrade to rack-contrib 2.5.0 or newer. Exploitation details and PoC are descr...

CVE-2024-35219

OpenAPI Generator (OpenAPI Tools) before version 7.6.0 is vulnerable to path traversal via the outputFolder option, allowing an attacker to read and delete files in arbitrary writable directories. The known impacted range is

CVE-2024-0851

CVE-2024-0851 affects Grup Arge Energy and Control Systems Smartpower (web-based Energy Management System). The vulnerability is an SQL Injection due to improper neutralization of special elements in SQL commands, affecting Smartpower up to and including V24.05.27. Documented impact indicates hig...

CVE-2023-50977

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that there was not reasonable evidence to determine the existence of a vulnerability. See also CVE-2024-36472...

CVE-2024-34477

Summary (CVE-2024-34477) : In FOG projects, the function configureNFS in lib/common/functions.sh up to version 1.5.10 allows local privilege escalation by mounting a crafted NFS share, due to insecure settings (no_root_squash). To exploit, an attacker must mount an NFS share, place an executable ...

CVE-2024-3381

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2024-5408

CVE-2024-5408: A cross-site scripting vulnerability affects RhinOS 3.0-1190, exploitable via the search parameter of /portal/search.htm. A remote attacker could potentially steal a victim’s session details by crafting a URL. The available documents confirm the affected component and endpoint, and...