231590 matches found
CVE-2024-5121
SourceCodester Event Registration System 1.0 contains a cross-site scripting vulnerability in the /registrar/?page=registration endpoint, caused by unsafe handling of the e parameter. The vulnerability is exploitable remotely and has been publicly disclosed. Several sources confirm the issue, inc...
CVE-2024-5111
The CVE-2024-5111 affects Campcodes Complete Web-Based School Management System 1.0. The vulnerability arises from SQL injection in an unknown part of the file /view/student_payment_invoice1.php, triggered by manipulating the date argument. It is exploitable remotely and the exploit has been disc...
CVE-2024-5106
CVE-2024-5106 affects Campcodes Complete Web-Based School Management System 1.0. The vulnerability is a SQL injection in the file /view/student_payment_details3.php, caused by manipulating the index parameter. It is exploitable remotely and an exploit has been disclosed publicly. Various sources ...
CVE-2024-5105
CVE-2024-5105 affects Campcodes Complete Web-Based School Management System 1.0. The vulnerability exists in an unknown portion of the file /view/student_payment_details.php, where manipulation of the argument index enables a SQL injection. Exploitation is possible remotely, and the exploit has b...
CVE-2024-4284
CVE-2024-4284 affects mintplex-labs/anything-llm (versions prior to 1.0.0). The vulnerability allows a DoS by changing a user’s id to 0, enabling a manager/admin to render a target account inaccessible and cause uncontrolled resource consumption. Root cause: lack of input validation/sanitization ...
CVE-2024-5103
CVE-2024-5103 affects Campcodes Complete Web-Based School Management System v1.0. The vulnerability is an SQL injection in the file /view/student_first_payment.php caused by manipulation of the grade parameter. It is exploitable remotely, with the exploit publicly disclosed. Details across source...
CVE-2024-36076
SysReptor versions 2024.28 through 2024.30 (and other versions prior to 2024.40 ) are vulnerable to Cross-Site WebSocket Hijacking . This flaw allows an attacker to escalate privileges and obtain sensitive information when a logged-in user visits a malicious same-site subdomain within the same br...
CVE-2024-5100
CVE-2024-5100 is a SQL injection in SourceCodester Simple Inventory System 1.0, affecting the file tableedit.php . The issue arises from improper handling of the from and to parameters, allowing an attacker to manipulate input values to execute arbitrary SQL. The vulnerability is exploitable remo...
CVE-2024-35946
CVE-2024-35946 affects the Linux kernel’s wifi rt89 (rtw89) driver, where a null pointer dereference could occur during abort/cancel of a scan because the code might reference a vif that wasn’t scanning. The public description and connected advisories confirm the issue and cite resolving it by en...
CVE-2024-35944
CVE-2024-35944: In the Linux kernel VMCI path, a run-time warning triggered by memcpy was observed when a field-spanning write occurred in vmci_datagram.c. The code copies a vmci_datagram dg into a local dg_info->msg with memcpy(&dg_info->msg, dg, dg_size), while dg_size = VMCI_DG_HEADERSIZ...
CVE-2024-35945
CVE-2024-35945 (Linux kernel) is reported as resolved in OSV entries for Root:Ubuntu 22.04 via ROOT-OS-UBUNTU-2204-CVE-2024-35945, with multiple fixed ROOT rootio-linux versions available. Other OSVs (ROOT-OS-DEBIAN-11-CVE-2024-35945, ROOT-OS-DEBIAN-12-CVE-2024-35945) also indicate patches in roo...
CVE-2024-35943
The CVE-2024-35943 entry pertains to the Linux kernel, specifically a vulnerability in TI-related pmdomain handling where omap_prm_domain_init lacked a null-pointer check after a dynamic allocation. The issue arises because devm_kasprintf() can return NULL on allocation failure, and without verif...
CVE-2024-35942
CVE-2024-35942 relates to the Linux kernel and affects the imx8mp block clock handling. The issue occurs when the fdcc clock, intended for the HDMI RX domain, is added to the hdmimix domain while HDMI TX/LCDIF probe sequencing can disable it. If the clock is disabled before HDMI/LCDIF probe, LCDI...
CVE-2024-35940
The Linux kernel contains a vulnerability in the pstore/zone component due to a missing null pointer check in the psz_kmsg_read function. The kasprintf() function may return a NULL pointer upon allocation failure; failing to validate this pointer before use can result in a NULL pointer dereferenc...
CVE-2024-35937
CVE-2024-35937 affects the Linux kernel wifi stack: cfg80211 A-MSDU handling can read data out of bounds if a subframe header appears but is not fully present. The vulnerability root cause is insufficient validation of A-MSDU subframes; the fix tightens checks to ensure a subframe header can actu...
CVE-2024-35936
CVE-2024-35936. In the Linux kernel, the btrfs relocation code (btrfs_relocate_sys_chunks) contains an unhandled corruption case in its chunk-tree lookup loop. The issue arises from two theoretically impossible conditions: (1) an inexact search yields a key with offset -1 for a chunk-tree item, a...
CVE-2024-35934
The CVE-2024-35934 issue affects the Linux kernel net/smc subsystem. Affected component: smc_pnet-related code in net/smc (pnet IDs list creation). Root cause: excessive RTNL (rtnl) lock pressure during net namespace/pnet initialization, caused by smc_pnet_create_pnetids_list() acquiring rtnl in ...
CVE-2024-35930
CVE-2024-35930 concerns the Linux kernel SCSI lpfc driver. It fixes a memory leak in lpfc_rcv_padisc() where a failed return from lpfc_sli4_resume_rpi() could leave an elsiocb unreleased and its resources leaked. The remediation is to check the return value of lpfc_sli4_resume_rpi() and, on failu...
CVE-2024-35925
The CVE-2024-35925 issue concerns the Linux kernel blk_rq_stat_sum() path. The root cause is a potential division by zero when computing stats, caused by the expression dst->nr_samples + src->nr_samples reaching zero due to overflow. Multiple connected advisories (Unity Linux security updat...