CVE-2024-36241

Mattermost Server vulnerable versions: 8.1.x up to 8.1.12; 9.5.x up to 9.5.3; 9.6.x up to 9.6.1. Issue: improper access controls allow viewing arbitrary post contents via the /playbook add slash command. Root cause: failure to enforce access restrictions. Impact: exposure of post content to unaut...

CVE-2024-34152

CVE-2024-34152 affects Mattermost Server releases: 8.1.x up to 8.1.12, 9.5.x up to 9.5.3, and 9.6.x up to 9.6.1. The issue is improper access control that lets a guest retrieve metadata of a public playbook run linked to a channel the guest is in by sending an RHSRuns GraphQL query. The connected...

CVE-2024-34029

Mattermost suffers an authorization bypass in /api/v4/groups//channels//link, allowing a user to learn members of an AD/LDAP group linked to a team without having access to that team. Affected are Mattermost Server/Mattermost releases: 9.5.x up to 9.5.3, 9.7.x up to 9.7.1, and 8.1.x up to 8.1.12....

CVE-2024-5365

CVE-2024-5365 affects SourceCodester Best House Rental Management System up to version 1.0. The vulnerability lies in the manage_payment.php file where manipulating the id parameter leads to an SQL injection. It can be triggered remotely, and public exploits have been disclosed. Multiple sources ...

CVE-2024-5364

CVE-2024-5364 affects SourceCodester Best House Rental Management System v1.0 and earlier, with a SQL injection in the manage_tenant.php file triggered by modifying the id parameter. The vulnerability is exploitable remotely and has public disclosures. The issue stems from improper handling of th...

CVE-2024-5363

CVE-2024-5363 affects SourceCodester Best House Rental Management System up to v1.0. The vulnerability is in the manage_user.php file where manipulating the id parameter leads to a SQL injection. Exploitation can be performed remotely; public disclosure cited. No remediation details (patch/versio...

CVE-2024-5361

CVE-2024-5361 refers to a SQL injection vulnerability in PHPGurukul Zoo Management System 2.1, specifically in the file /admin/normal-bwdates-reports-details.php where the parameter fromdate can be manipulated to trigger database injection. Several connected records corroborate remote exploitatio...

CVE-2024-5360

PHPGurukul Zoo Management System 2.1 contains a SQL injection in /admin/foreigner-bwdates-reports-details.php via the fromdate parameter. The vulnerability allows remote exploitation and has been publicly disclosed. Several sources corroborate impact and scope but do not provide an available fix/...

CVE-2024-5358

CVE-2024-5358 affects PHPGurukul Zoo Management System 2.1, specifically the /admin/normal-search.php file. The vulnerability arises from unsafely manipulating the searchdata argument, leading to SQL injection. Exploitation is described as remote, with public disclosure. Remediation or patches ar...

CVE-2024-5357

CVE-2024-5357 concerns a SQL injection in PHPGurukul Zoo Management System 2.1, triggered by manipulating the email parameter in /admin/forgot-password.php. The attack is remotely exploitable and affects an unknown functionality, with multiple sources labeling it as critical/high impact. Connecte...

CVE-2024-5355

CVE-2024-5355 affects anji-plus AJ-Report up to version 1.4.1, with the IGroovyHandler function vulnerable to command injection that can be exploited remotely. Public exploit information exists. A practical mitigation from PT-security suggests disabling the IGroovyHandler function as a temporary ...

CVE-2024-5354

Summary: CVE-2024-5354 affects the anji-plus AJ-Report product (versions up to 1.4.1). The vulnerability exists in the /reportShare/detailByCode endpoint, where manipulating the shareToken can disclose information. It is exploitable remotely over a network. Public exploitation has been disclosed....

CVE-2024-5353

CVE-2024-5353 affects anji-plus AJ-Report up to 1.4.1. The issue is a path traversal in the ZIP File Handler decompress function, allowing remote initiation. Exploit has been disclosed publicly. No remediation details are provided in the connected documents; no explicit fixes or patched versions ...

CVE-2024-5351

CVE-2024-5351 affects anji-plus AJ-Report up to 1.4.1. The vulnerability is in the Javascript Handler’s getValueFromJs function, where a deserialization issue can be triggered. This allows a remote attacker to exploit the flaw, with public disclosure of the exploit, per the CVE description and re...

CVE-2024-30056

Microsoft Edge Chromium-based Information Disclosure Vulnerability...

CVE-2024-30056

Microsoft Edge (Chromium-based) information disclosure vulnerability CVE-2024-30056 is reported across multiple sources (NVD/CNVD/Nessus/NVD references). Affected product: Microsoft Edge (Chromium-based). Issue: information disclosure vulnerability; exact root cause is not detailed in the provide...

CVE-2024-5336

CVE-2024-5336 affects Ruijie RG-UAC up to 20240516. The vulnerability resides in the addVlan function at /view/networkConfig/vlan/vlan_add_commit.php, where manipulation of the phyport argument leads to an OS command injection. It is a network-facing issue with remote exploitation; the exploit ha...

CVE-2024-35232

github.com/huandu/facebook is a Go package that fully supports the Facebook Graph API with file upload, batch request and marketing API. accesstoken can be exposed in error message on fail in HTTP request. This issue has been patched in version 2.7.2...

CVE-2024-35373

Mocodo Mocodo Online 4.2.6 and below is vulnerable to Remote Code Execution via /web/rewrite.php...

CVE-2024-33471

An issue in the Sensor Settings of AVTECH Room Alert 4E v4.4.0 allows attackers to gain access to SMTP credentials in plaintext via a crafted AJAX request. NOTE: This vulnerability only affects products that are no longer supported by the maintainer...