CVE-2024-35231

rack-contrib before 2.5.0 is vulnerable to denial of service because the profiler_runs parameter was not constrained, enabling unbounded resource consumption on the server. A patch exists in version 2.5.0. Remediation: upgrade to rack-contrib 2.5.0 or newer. Exploitation details and PoC are descr...

CVE-2024-35219

OpenAPI Generator (OpenAPI Tools) before version 7.6.0 is vulnerable to path traversal via the outputFolder option, allowing an attacker to read and delete files in arbitrary writable directories. The known impacted range is

CVE-2024-0851

CVE-2024-0851 affects Grup Arge Energy and Control Systems Smartpower (web-based Energy Management System). The vulnerability is an SQL Injection due to improper neutralization of special elements in SQL commands, affecting Smartpower up to and including V24.05.27. Documented impact indicates hig...

CVE-2023-50977

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that there was not reasonable evidence to determine the existence of a vulnerability. See also CVE-2024-36472...

CVE-2024-34477

Summary (CVE-2024-34477) : In FOG projects, the function configureNFS in lib/common/functions.sh up to version 1.5.10 allows local privilege escalation by mounting a crafted NFS share, due to insecure settings (no_root_squash). To exploit, an attacker must mount an NFS share, place an executable ...

CVE-2024-3381

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2024-5408

CVE-2024-5408: A cross-site scripting vulnerability affects RhinOS 3.0-1190, exploitable via the search parameter of /portal/search.htm. A remote attacker could potentially steal a victim’s session details by crafting a URL. The available documents confirm the affected component and endpoint, and...

CVE-2024-5406

CVE-2024-5406 affects WinNMP 19.02, where an XSS flaw exists in the index page via the from, subject, text, and hash parameters. A remote attacker could send a specially crafted query to an authenticated user, potentially stealing session details. The NVD entry lists CVSSv3.1: AV:N/AC:L/PR:N/UI:R...

CVE-2023-6349

CVE-2023-6349 (libvpx) describes a heap overflow when VP9 encodes frames wider than the configured size. Connected advisories/plugins confirm libvpx is affected in multiple Linux distributions (e.g., Amazon Linux 2/3, MiracleLinux, TencentOS Server) and commonly reference upgrading to libvpx 1.13...

CVE-2024-26289

Deserialization of Untrusted Data vulnerability in PMB Services PMB allows Remote Code Inclusion.This issue affects PMB: from 7.5.1 before 7.5.6-2, from 7.4.1 before 7.4.9, from 7.3.1 before 7.3.18...

CVE-2024-26289

The CVE-2024-26289 issue is a Deserialization of Untrusted Data vulnerability in PMB Services PMB that enables Remote Code Inclusion. Concrete details from connected documents: affected PMB versions are 7.3.1–7.3.18, 7.4.1–7.4.9, and 7.5.1–7.5.6-2. Root cause is deserialization of untrusted data....

CVE-2024-4532

The Business Card WordPress plugin through 1.0.0 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions such as deleting cards via CSRF attacks...

CVE-2024-4533

The KKProgressbar2 Free WordPress plugin through 1.1.4.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admin users to perform SQL injection attacks...

CVE-2024-4531

The Business Card WordPress plugin through 1.0.0 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions such as editing cards via CSRF attacks...

CVE-2024-4532

CVE-2024-4532 concerns the WordPress plugin “Business Card” (≤1.0.0) by Esterox. The issue is a CSRF vulnerability due to missing CSRF checks in certain actions, which could allow an attacker to cause logged-in users to delete cards via CSRF. Public sources identify the affected software and desc...

CVE-2024-4535

CVE-2024-4535 : The WordPress plugin KKProgressbar2 Free (versions

CVE-2024-4531

CVE-2024-4531: The WordPress Business Card plugin (

CVE-2024-4533

CVE-2024-4533 affects the KKProgressbar2 Free WordPress plugin up to version 1.1.4.2, where an unsanitized parameter is used directly in a SQL statement, enabling admin users to perform SQL injection. The connected documents confirm the issue but do not provide a remediation version or patch deta...

CVE-2024-4534

CVE-2024-4534 affects KKProgressbar2 Free WordPress plugin (versions

CVE-2024-4530

CVE-2024-4530 concerns the WordPress plugin “Business Card” up to version 1.0.0, which lacks CSRF checks in several areas. The public records state this could enable attackers to induce logged-in users to perform actions such as editing card categories via CSRF attacks. Technical details from con...