CVE-2024-24583

CVE-2024-24583 affects libigl v2.5.0. The vulnerability is an out-of-bounds read in readMSH when processing MshLoader::ELEMENT_TRI, triggered by a specially crafted .msh file. Multiple connected sources (NVD/NVV publications and related CVE aggregations) report this exact issue and its associatio...

CVE-2024-24685

CVE-2024-24685 affects the open‑source geometry library libigl, specifically the readOFF parser in version v2.5.0. A specially crafted .off file can trigger a stack‑based buffer overflow by exploiting how comments in the vertex section are parsed during readOFF. The connected documents confirm th...

CVE-2024-24686

CVE-2024-24686 concerns multiple stack-based buffer overflows in the readOFF parser of libigl v2.5.0. The vulnerability arises when parsing comments within the faces section of an .off file, which a malicious file can trigger. Affected component: libigl’s readOFF function (libigl v2.5.0). Impacts...

CVE-2024-24684

libigl v2.5.0 readOFF contains multiple stack-based buffer overflows in header parsing. A 1000-byte fixed-size header buffer and a unsafe fscanf on the header and on comment lines can overflow when processing specially crafted .off files, enabling potential memory corruption. Connected reports (T...

CVE-2024-22181

CVE-2024-22181 concerns libigl v2.5.0, where the readNODE function is vulnerable to an out-of-bounds write triggered by a specially crafted .node file. Multiple connected sources confirm the vulnerability exists in this library/version, with attacker-provided files as the trigger. The TALOS advis...

CVE-2024-29072

The CVE refers to a privilege-escalation flaw in Foxit Reader 2024.2.0.25138 caused by improper certification validation of the updater executable before it runs. The issue allows a low-privilege user to trigger an update action, potentially elevating privileges (local access, user interaction re...

CVE-2024-5428

The CVE-2024-5428 entry applies to SourceCodester Simple Online Bidding System 1.0. The vulnerability is in the HTTP POST Request Handler, specifically the save_product function in /admin/index.php?page=manage_product, where a cross-site request forgery (CSRF) can be triggered remotely. Credible ...

CVE-2024-5027

CVE-2024-5027 affects Citrix Workspace app for Mac (pre-2402.10). Elevation of privilege from a local authenticated user to root is possible. Remedy: upgrade to Citrix Workspace app for Mac 2402.10 or later (per CTX675851). If details on root-cause are not provided, note that explicit root-cause ...

CVE-2024-3657

The CVE-2024-3657 entry affects 389-ds-base and is described as a denial-of-service vulnerability via a specially crafted LDAP query that can cause the directory server to fail. The connected advisories (Amazon Linux 2, MiracleLinux, TencentOS, etc.) confirm affected 389-ds-base versions and refe...

CVE-2024-5415

PhpMyBackupPro 2.3 is affected by a cross‑site scripting (XSS) vulnerability in the /phpmybackuppro/backup.php endpoint via the comments and db parameters. The issue allows crafting a URL to exfiltrate session details; CVSSv3.1 vectors indicate Network attack, low complexity, no privileges, user ...

CVE-2024-5414

CVE-2024-5414 affects PhpMyBackupPro v2.3. A cross-site scripting (XSS) flaw exists in the /phpmybackuppro/get_file.php endpoint via the view parameter, enabling an attacker to craft a URL that may exfiltrate a victim’s session details. Exploitation details are not provided in the core CVE text, ...

CVE-2024-5413

CVE-2024-5413 concerns a cross-site scripting (XSS) vulnerability in PhpMyBackupPro version 2.3. The issue is disclosed as an XSS in the endpoint "/phpmybackuppro/scheduled.php" that processes multiple parameters, enabling an attacker to craft a URL that could reveal a victim’s session details. T...

CVE-2024-2199

A denial of service vulnerability was found in 389-ds-base ldap server. This issue may allow an authenticated user to cause a server crash while modifying userPassword using malformed input...

CVE-2023-37411

CVE-2023-37411 affects IBM Aspera Faspex 5.0.0–5.0.6, where an input validation/escaping flaw enables stored cross-site scripting in the Web UI, potentially leading to credential disclosure within a trusted session. The issue stems from inadequate filtering of user-supplied data in Faspex and is ...

CVE-2024-2199

CVE-2024-2199 affects 389-ds-base (LDAP server). An authenticated user could cause a server crash while modifying the userPassword field with malformed input, resulting in a denial of service. Connected advisories confirm the issue across multiple distributions (e.g., Red Hat, Debian, Amazon Linu...

CVE-2024-28793

IBM Engineering Workflow Management (EWM) versions 7.0.2 and 7.0.3 are vulnerable to a stored cross-site scripting flaw in the Team Concert Git Jenkins plugin, caused by insufficient input cleanup and output escaping in the Web UI. This could allow injection of arbitrary JavaScript that may lead ...

CVE-2024-5411

Missing input validation and OS command integration of the input in the ORing IAP-420 web-interface allows authenticated command injection.This issue affects IAP-420 version 2.01e and below...

CVE-2024-5411

Summary: CVE-2024-5411 affects ORing IAP-420 web interface (version 2.01e and earlier). The root cause is missing input validation and OS command integration of user input, enabling authenticated command injection and potentially full device compromise. Exploitation requires authentication to the...

CVE-2024-5410

CVE-2024-5410 affects ORing IAP-420 web-interface (version 2.01e and earlier). The stored XSS vulnerability can be triggered by injecting JavaScript into the SSID input field, and the filename parameter in a configuration file upload is prone to command injection, potentially giving an attacker c...

CVE-2023-52712

Various Issues Due To Exposed SMI Handler in AmdPspP2CmboxV2. The first issue can be leveraged to bypass the protections that have been put in place by previous UEFI phases to prevent direct access to the SPI flash. The second issue can be used to both leak and corrupt SMM memory, thus potentiall...