CVE-2024-5233

CVE-2024-5233 affects Campcodes Complete Web-Based School Management System 1.0. The issue is an SQL injection caused by manipulation of the index argument in the file /view/teacher_salary_details3.php. The vulnerability can be triggered remotely and the exploit has been disclosed publicly. The c...

CVE-2024-3201

The WP DSGVO Tools GDPR plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'pplink' shortcode in all versions up to, and including, 3.1.32 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticat...

CVE-2023-6844

CVE-2023-6844 affects the iframe WordPress plugin (all versions up to 5.0) and is a Stored Cross-Site Scripting vulnerability via shortcode attributes. The issue arises from insufficient input sanitization and output escaping, allowing authenticated attackers with contributor-level permissions to...

CVE-2024-29853

An authentication bypass vulnerability in Veeam Agent for Microsoft Windows allows for local privilege escalation...

CVE-2024-22026

A local privilege escalation vulnerability in EPMM before 12.1.0.0 allows an authenticated local user to bypass shell restriction and execute arbitrary commands on the appliance...

CVE-2024-29850

Veeam Backup Enterprise Manager allows account takeover via NTLM relay...

CVE-2024-29850

Vulnerability CVE-2024-29850 affects Veeam Backup Enterprise Manager (VBEM) and enables account takeover via NTLM relay. The issue is tied to VBEM, which is optional in the Veeam ecosystem; environments without VBEM installed are not impacted. According to the connected sources, the vulnerabiliti...

CVE-2024-29852

Veeam Backup Enterprise Manager (VBEM) is affected by CVE-2024-29852, where high-privilege users can read backup session logs. The issue is addressed in VBEM version 12.1.2.172 (bundled with Veeam Backup & Replication 12.1.2.172). VBEM is optional; environments without VBEM installed are not impa...

CVE-2024-22026

CVE-2024-22026 is a local privilege-escalation flaw in Ivanti EPMM (MobileIron Core) prior to 12.1.0.0. The root cause is inadequate validation in the software-update CLI, which can fetch an unverified RPM from a remote URL and execute it with root privileges, enabling arbitrary code execution. A...

CVE-2024-29853

CVE-2024-29853 affects Veeam Agent for Windows (VAW). The vulnerability is an authentication bypass leading to Local Privilege Escalation. Public details across connected docs confirm the issue is addressed in Veeam releases: VAW was fixed starting with build 6.1.2.134, and broader product remedi...

CVE-2024-4453

GStreamer EXIF Metadata Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary...

CVE-2024-27264

IBM Performance Tools for i 7.2, 7.3, 7.4, and 7.5 could allow a local user to gain elevated privileges due to an unqualified library call. A malicious actor could cause user-controlled code to run with administrator privilege. IBM X-Force ID: 284563...

CVE-2024-31894

CVE-2024-31894 affects IBM App Connect Enterprise 12.0.1.0–12.0.12.1 and allows an authenticated user to obtain sensitive user information via an expired access token (information disclosure). The issue is discussed across multiple sources (IBM X-Force ID 288175; Red Hat security page; IBM bullet...

CVE-2023-51637

CVE-2023-51637 concerns Sante PACS Server PG. The vulnerability is in the DICOM service (default port 11122) where the NAME element of a PATIENT record is parsed to build SQL queries without proper input validation, enabling remote code execution with NETWORK SERVICE privileges. Impact is high (n...

CVE-2024-31895

CVE-2024-31895 affects IBM App Connect Enterprise versions 12.0.1.0 through 12.0.12.1 . The vulnerability allows an authenticated user to obtain sensitive user information by exploiting an expired access token, representing a confidentiality impact (CVSS base score ~4.3–6.5 depending on source). ...

CVE-2024-31904

IBM App Connect Enterprise 11.0.0.1 through 11.0.0.25 and 12.0.1.0 through 12.0.12.0 integration nodes could allow an authenticated user to cause a denial of service due to an uncaught exception. IBM X-Force ID: 289647...

CVE-2024-31893

IBM App Connect Enterprise 12.0.1.0 through 12.0.12.1 could allow an authenticated user to obtain sensitive calendar information using an expired access token. IBM X-Force ID: 288174...

CVE-2024-4454

CVE-2024-4454 affects WithSecure Elements Endpoint Protection . The flaw is in the WithSecure plugin hosting service : an attacker can abuse a symbolic link to create a file and escalate privileges to SYSTEM . It is a local vulnerability requiring administrator interaction , with high impact. Doc...

CVE-2024-35627

TileServer-GL up to v4.4.10 is affected by a cross-site scripting (XSS) vulnerability via the /data/v3/?key component. The issue enables injection of malicious scripts and is described in the Nuclei template and CVE record as affecting tileserver-gl with potential impact to user sessions or sensi...

CVE-2024-25738

Vulnerability summary : Open Library Foundation VuFind versions 2.0–9.1 before 9.1.1 have a Server-Side Request Forgery (SSRF) in the /Upgrade/FixConfig route. The issue lets a remote attacker overwrite local configuration files and could lead to Remote Code Execution, enabled when allow_url_incl...