CVE-2024-30292

CVE-2024-30292 pertains to Adobe FrameMaker, affecting versions 2020.5 and 2022.3 and earlier. The issue is an out-of-bounds write in GIF file parsing that could enable arbitrary code execution in the context of the current user . Exploitation requires user interaction: a victim must open a malic...

CVE-2024-30291

CVE-2024-30291 affects Adobe FrameMaker 2020.5 and 2022.3 and earlier, due to an out-of-bounds write in TIF file parsing that could lead to arbitrary code execution in the current user context. Exploitation requires user interaction (victim opens a malicious file). Public details across connected...

CVE-2024-30283

Adobe FrameMaker (versions 2020.5, 2022.3 and earlier) is affected by an out-of-bounds read vulnerability in ICO file parsing that could disclose memory contents and bypass ASLR. Impact is memory disclosure with no integrity/availability impact stated; exploitation requires user interaction (vict...

CVE-2024-30289

CVE-2024-30289 affects Adobe FrameMaker; a Stack-based Buffer Overflow in the XLS file parsing can allow arbitrary code execution in the context of the current user. Affected versions are FrameMaker 2020.5 and 2022.3 and earlier. Exploitation requires user interaction: the victim must open a mali...

CVE-2024-35299

The CVE-2024-35299 entry concerns JetBrains YouTrack prior to version 2024.1.29548, where SMTPS protocol communication lacked proper certificate hostname validation. This creates a potential exposure related to TLS hostname verification, with the NVD CVSS data indicating high impact on confidenti...

CVE-2024-4975

Summary: CVE-2024-4975 affects code-projects Simple Chat System 1.0, specifically the Message Handler component. The connected PT-2024-33661 and related sources confirm a cross-site scripting (XSS) vulnerability that can be triggered remotely. The exploit has been disclosed publicly. Affected com...

CVE-2024-4222

CVE-2024-4222 affects the Tutor LMS Pro WordPress plugin. A missing capability check in multiple functions allows unauthenticated attackers to add, modify or delete user meta and plugin options across versions up to 2.7.0. The issue enables unauthorized data access/modification and data loss. Rem...

CVE-2024-4351

CVE-2024-4351 affects Tutor LMS Pro (WordPress) where a missing capability check in the authenticate function across versions up to and including 2.7.0 allows authenticated users with subscriber-level permissions or higher to gain control of an existing administrator account. Public details confi...

CVE-2024-2366

The CVE-2024-2366 issue affects parisneo/lollms-webui, specifically the reinstall_binding function in lollms_core/lollms/server/endpoints/lollms_binding_infos.py. It arises from insufficient path sanitization, enabling path traversal to arbitrary directories. An attacker can set binding_path to a...

CVE-2024-3435

CVE-2024-3435 affects parisneo/lollms-webui prior to version 9.5. The flaw is a path traversal vulnerability in the save_settings endpoint, caused by insufficient sanitization of the config parameter in the apply_settings function. Attackers can manipulate the application’s configuration by sendi...

CVE-2024-3403

CVE-2024-3403 affects imartinez/privategpt v0.2.0 with a local file inclusion weakness that enables reading arbitrary files via manipulated file upload, exposing files through the app’s “Search in Docs” feature or AI queries. Impact notes in sources include potential remote code execution by expo...

CVE-2024-2358

The CVE-2024-2358 path-traversal vulnerability affects parisneo/lollms-webui, exposed via the /apply_settings endpoint where unsanitized user input in the extensions parameter enables navigation to arbitrary directories. An attacker could craft a payload with ../../../ sequences to load and execu...

CVE-2024-4972

The CVE-2024-4972 entry concerns code-projects Simple Chat System 1.0. Affected component: login.php, where manipulating the email/password parameters enables SQL injection. This vulnerability is exploitable remotely, and public disclosures exist. Connected documents identify the affected product...

CVE-2024-30297

CVE-2024-30297 affects Adobe Animate (versions 24.0.2, 23.0.5 and earlier). The flaw is an out-of-bounds write that could allow arbitrary code execution in the context of the current user; exploitation requires the user to open a malicious file. Remediation: Adobe released updates resolving these...

CVE-2024-30275

Adobe Aero Desktop versions 23.4 and earlier are affected by a Use-After-Free vulnerability in which parsing SVG/files can lead to arbitrary code execution in the context of the current user. Exploitation requires user interaction (victim must open a malicious file). Mitigation: apply the Adobe u...

CVE-2024-4968

CVE-2024-4968 affects SourceCodester Interactive Map with Marker 1.0, specifically the file/component described as Add Marker (Marker Name). The vulnerability is a cross-site scripting flaw introduced by the Add Marker functionality, which can be exploited remotely. Public disclosures exist and t...

CVE-2024-30307

Substance3D Painter

CVE-2024-30309

CVE-2024-30309 affects Substance3D Painter, specifically versions ≤ 9.1.2. The issue is an out-of-bounds read in the TGA file parsing path that can disclose sensitive memory and could bypass ASLR. Exploitation requires the victim to open a malicious file (user interaction). Remediation is to upda...

CVE-2024-30274

CVE-2024-30274 affects Adobe Substance 3D Painter up to version 9.1.2. It is an out-of-bounds write in ABC file parsing that could lead to arbitrary code execution in the context of the current user. Exploitation requires user interaction: a victim must open a malicious file. Affected software: S...

CVE-2024-20792

Adobe Illustrator CVE-2024-20792 is a Use-After-Free vulnerability affecting Illustrator 28.4, 27.9.3 and earlier, enabling arbitrary code execution in the context of the current user. Exploitation requires user interaction: a victim must open a malicious file. The issue is documented across mult...