CVE-2024-5245

CVE-2024-5245 — NETGEAR ProSAFE Network Management System involves a local privilege-escalation vulnerability caused by default MySQL credentials in the product installer. An attacker who can run low-privileged code locally can leverage these credentials to escalate privileges to SYSTEM and execu...

CVE-2024-5299

The CVE-2024-5299 entry concerns D-Link D-View, a web-based network device management software. The flaw resides in the execMonitorScript method, due to an exposed dangerous method, enabling remote code execution. Attackers can execute code in the context of root; the advisory notes that authenti...

CVE-2024-5298

Affected product : D-Link D-View. Vulnerability : Remote Code Execution via the exposed dangerous method in the queryDeviceCustomMonitorResult function. The flaw allows an attacker to execute code in the context of root. Although authentication is required, the authentication mechanism can be byp...

CVE-2024-5297

The CVE-2024-5297 issue affects D-Link D-View with a flaw in the executeWmicCmd method. The vulnerability stems from insufficient validation of a user-supplied string before it is used to perform a system call, allowing an attacker to execute code with root privileges on affected installations. A...

CVE-2024-5296

CVE-2024-5296 concerns D-Link D-View, where the TokenUtils class uses a hard-coded cryptographic key, enabling remote authentication bypass on affected installations. Multiple sources (ZDI advisory ZDI-24-447, NVD entry) describe the flaw as a hard-coded key leading to authentication bypass, with...

CVE-2024-5295

CVE-2024-5295 affects the D-Link G416 wireless router. The flaw is a command injection in the HTTP service on TCP port 80, caused by improper validation of a user-supplied string before it is used to execute a system call. This allows network-adjacent attackers to execute arbitrary code with root...

CVE-2024-5294

The CVE-2024-5294 entry concerns the D-Link DIR-3040 router. The vulnerable component is prog.cgi (HNAP handler for the lighttpd server on ports 80/443). The root cause is improper memory management when processing HTTP cookie values, causing a memory leak that enables a denial-of-service conditi...

CVE-2024-5292

CVE-2024-5292 concerns the D-Link Network Assistant. The DNACore service loads a file from an unsecured location, enabling a local attacker who can run low-privileged code to escalate to SYSTEM and execute arbitrary code. Public disclosures (ZDI-24-443, NVD entry) confirm local privilege escalati...

CVE-2024-5201

CVE-2024-5201 describes a privilege escalation in OpenText Dimensions RM where an authenticated user can elevate to another user’s privileges via an HTTP request. The affected product is OpenText Dimensions RM; the underlying root cause and exact exploit path are not detailed in the provided docu...

CVE-2024-35079

Inxedu v2024.4 contains an arbitrary file upload vulnerability in the uploadAudio method, exploitable by uploading a crafted .jsp file to achieve arbitrary code execution. The CVE indicates network access with no authentication is required and impact to confidentiality, integrity, and availabilit...

CVE-2024-35090

J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in SysUreportFileMapper.xml...

CVE-2024-35086

J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in BpmTaskFromMapper.xml...

CVE-2024-35084

J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in SysMsgPushMapper.xml...

CVE-2024-35083

J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in SysLoginInfoMapper.xml...

CVE-2024-35082

J2EEFAST v2.7.0 was discovered to contain a SQL injection vulnerability via the findPage function in SysOperLogMapper.xml...

CVE-2024-35081

LuckyFrameWeb v3.5.2 was discovered to contain an arbitrary file deletion vulnerability via the fileName parameter in the fileDownload method...

CVE-2024-2301

Certain HP LaserJet Pro devices are potentially vulnerable to a Cross-Site Scripting XSS attack via the web management interface of the device...

CVE-2024-35081

LuckyFrameWeb v3.5.2 is affected by CVE-2024-35081: an arbitrary file deletion vulnerability exposed through the fileName parameter in the fileDownload method. The issue allows deletion of files and is described as a security vulnerability with high integrity impact (I: high) while confidentialit...

CVE-2024-35082

CVE-2024-35082 concerns J2EEFAST v2.7.0, where a SQL injection flaw exists in the SysOperLogMapper.xml file’s findPage function. The root cause per CNVD/Red Hat style descriptions is lack of input SQL statement validation for that function, enabling potential manipulation of database queries. Rep...

CVE-2024-35084

CVE-2024-35084 affects J2EEFAST v2.7.0. The vulnerability is a SQL injection in SysMsgPushMapper.xml’s findPage function caused by lack of validation for external input SQL statements. Reported impact indicates high confidentiality, integrity, and availability risk (base score 9.8, CVSS3.1: AV:N/...