CVE-2024-35056

The NASA AIT-Core software suite (version v2.5.2 ) contains multiple SQL injection vulnerabilities. The root cause is the improper neutralization of special elements used in SQL commands within the query_packets and insert functions. This is a Python-based software suite organized by NASA. No spe...

CVE-2024-35057

NASA AIT-Core version v2.5.2 , a Python-based software suite, contains a vulnerability that allows an attacker to execute arbitrary code via a crafted packet . While the specific root cause is not detailed in the provided documents, the impact is categorized as high with a total technical impact....

CVE-2024-35058

The NASA AIT-Core v2.5.2 software suite contains a vulnerability in its API wait function . This flaw allows an attacker to achieve remote code execution by providing a crafted string . While the exact technical root cause of the string processing error is not detailed, the impact is categorized ...

CVE-2024-35059

NASA AIT-Core v2.5.2 is vulnerable to Remote Code Execution (RCE) due to the unsafe loading of untrusted Pickle Python files. This flaw allows an attacker to execute arbitrary commands on the affected system. While exploitation details are not explicitly provided in the documents, the vulnerabili...

CVE-2024-35191

CVE-2024-35191 affects the verbb/formie Craft CMS plugin. Before version 2.1.6, users who can access a form’s settings could insert malicious Twig code into fields that support Twig (e.g., Submission Title or Success Message). The injected Twig could be executed when a submission is created or wh...

CVE-2024-29651

A Prototype Pollution issue in API Dev Tools json-schema-ref-parser v.11.0.0 and v.11.1.0 allows a remote attacker to execute arbitrary code via the bundle, parse, resolve, dereference functions...

CVE-2024-31714

Buffer Overflow vulnerability in Waxlab wax v.0.9-3 and before allows an attacker to cause a denial of service via the Lua library component...

CVE-2023-49334

Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL Injection while exporting a full summary report...

CVE-2023-49335

CVE-2023-49335 affects Zoho ManageEngine ADAudit Plus before build 7271. The issue is a SQL injection vulnerability when obtaining file server details, as documented across multiple sources. Impact is stated as high, with potential disclosure/integrity/availability concerns for affected installat...

CVE-2023-49334

Zoho ManageEngine ADAudit Plus is vulnerable prior to build 7271 due to an SQL Injection in the full summary report export. Affected component: ADAudit Plus report export. Impact: potential unauthorized data disclosure and modification (high), in line with CVSS metrics. Root cause: improper input...

CVE-2023-49333

CVE-2023-49333 affects Zoho ManageEngine ADAudit Plus versions below 7271, where the dashboard graph feature is vulnerable to SQL injection due to insufficient input handling. This could enable unauthorized access to data or manipulation via the dashboard graph component. A fixed version is 7271;...

CVE-2023-49331

CVE-2023-49331 concerns Zoho ManageEngine ADAudit Plus, with versions below 7271 affected by SQL injection in the aggregate reports search option. The vulnerability description across sources consistently states that the issue allows injection through user-controllable input in the aggregate repo...

CVE-2024-34193

Smanga version 3.2.7 is susceptible to a path traversal vulnerability because the file parameter at the PHP/get file flow.php interface is not properly filtered. This flaw allows an attacker to perform arbitrary file reading . While no updated version with a fix is currently available, the recomm...

CVE-2024-0401

ASUS routers supporting custom OpenVPN profiles are vulnerable to a code execution vulnerability. An authenticated and remote attacker can execute arbitrary operating system commands by uploading a crafted OVPN profile. Known affected routers include ASUS ExpertWiFi, ASUS RT-AX55, ASUS RT-AX58U,...

CVE-2024-24294

A Prototype Pollution issue in Blackprint @blackprint/engine v.0.9.0 allows an attacker to execute arbitrary code via the utils.setDeepProperty function of engine.min.js...

CVE-2024-0401

CVE-2024-0401 affects multiple ASUS routers that support custom OpenVPN profiles. An authenticated, remote attacker can execute arbitrary OS commands by uploading a crafted OVPN profile, with impact on confidentiality, integrity, and availability per the cited sources. Affected models include: AS...

CVE-2024-34947

The Quanxun Huiju Network Technology (Beijing) Co.,Ltd IK-Q3000 router, specifically version 3.7.10 x64 Build202401261655 , is vulnerable to an ICMP redirect attack . This vulnerability allows an attacker to potentially manipulate network traffic paths through ICMP redirection. No information reg...

CVE-2024-34953

An issue in taurusxin ncmdump v1.3.2 allows attackers to cause a Denial of Service DoS via memory exhaustion by supplying a crafted .ncm file...

Exploit for Improper Restriction of Excessive Authentication Attempts in Netgate Pfsense_Plus

CVE-2023-27100 - pfSense Anti-brute force protection bypass...

CVE-2024-27312

Zohocorp ManageEngine PAM360 version 6601 is vulnerable to authorization vulnerability which allows a low-privileged user to perform admin actions. Note: This vulnerability affects only the PAM360 6600 version. No other versions are applicable to this vulnerability...