CVE-2024-3970

OpenText iManager 3.2.6.0200 is affected by a Server-Side Request Forgery vulnerability that could lead to sensitive information disclosure via directory traversal. The CVE-2024-3970 entry notes an exploitable condition with impact on confidentiality and requires no user interaction (CVSS v3.1: b...

CVE-2023-7258

CVE-2023-7258 describes a denial-of-service issue in the Gvisor Sandbox. A bug in the reference counting for mount point tracking could cause a panic, enabling a root user with mount-permission to terminate the sandbox. Affected component is the Gvisor Sandbox’s mount-tracking logic; root-privile...

CVE-2023-5937

CVE-2023-5937 affects Arc before version 1.6.0 on Windows, where configuration files are world-readable, enabling local information disclosure. Multiple sources describe this as a local-access risk that could exfiltrate sensitive data from Arc’s configuration files. The issue is linked to Arc’s W...

CVE-2024-25079

CVE-2024-25079 affects InsydeH2O kernel (Insyde InsydeH2O) with a memory corruption in HddPassword that could lead to SMM privilege escalation. Affected versions and fixed targets per PT-2024-20730/CDS: 5.2 before 05.29.09 → update to 05.29.09 or later; 5.3 before 05.38.09 → update to 05.38.09 or...

CVE-2024-27353

Insyde InsydeH2O kernel vulnerabilities (CVE-2024-27353) involve a memory corruption issue in SdHost and SdMmcDevice that could lead to privilege escalation in SMM. Affected software ranges are Insyde InsydeH2O kernel 5.2 before 05.29.09, 5.3 before 05.38.09, 5.4 before 05.46.09, 5.5 before 05.54...

CVE-2024-34955

CVE-2024-34955 affects Code-projects Budget Management 1.0. The vulnerability is SQL Injection via the delete parameter in the application, with a CVSS v3.1 base score of 9.8 (Critical); impact on confidentiality, integrity, and availability is High. Exploitation is possible without authenticatio...

CVE-2024-34954

CVE-2024-34954 affects Code-projects Budget Management 1.0. The vulnerability is Cross Site Scripting (XSS) exploitable via the budget parameter. According to the CVE, the base CVSS v3.1 score is 6.1 (Medium): Network attack vector, no privileges, user interaction required, with confidentiality/i...

CVE-2024-25078

Insyde InsydeH2O contains a memory corruption vulnerability in StorageSecurityCommandDxe that could lead to privilege escalation in SMM. Affected: Insyde InsydeH2O before kernel 5.2 (fix IB19130163 in 05.29.07), before kernel 5.3 (fix in 05.38.07), before kernel 5.4 (fix in 05.46.07), before kern...

CVE-2023-6323

CVE-2023-6323 affects ThroughTek Kalay SDK, where the SDK does not verify the authenticity of received messages, enabling an attacker to impersonate an authoritative server. Documentation consistently identifies this as a message-authentication failure with impact on confidentiality (through pote...

CVE-2023-6322

CVE-2023-6322 affects the Roku Indoor Camera SE (v3.0.2.4679) and Wyze Cam v3 (v4.36.11.5859). The root cause is a stack-based buffer overflow in the message parsing functionality . An attacker who can make authenticated requests can trigger the overflow, potentially leading to impact on confiden...

CVE-2024-34101

CVE-2024-34101 affects Adobe Acrobat Reader (versions 20.005.30574, 24.002.20736 and earlier). The issue is an out-of-bounds read that could disclose sensitive memory and potentially bypass ASLR. Exploitation requires user interaction: a victim must open a malicious file. Connected advisories con...

CVE-2024-34096

Technical details for CVE-2024-34096 are not publicly available in the provided connected documents; monitor for updates from official advisories. The provided sources mention affected Acrobat versions but do not disclose vulnerability specifics in this dataset.

CVE-2024-30310

CVE-2024-30310 affects Adobe Acrobat Reader: out-of-bounds write in the PDF rendering path could lead to arbitrary code execution in the current user context. Affected: Acrobat Reader 20.005.30574, 24.002.20736 and earlier. Exploitation requires user interaction (opening a malicious file). CVSSv3...

CVE-2024-4010

CVE-2024-4010 affects the WordPress plugin Email Subscribers by Icegram Express (all versions up to 5.7.19). The root cause is a missing capability check in handle_ajax_request, enabling authenticated users with subscriber-level access and above to perform unauthorized actions that compromise con...

CVE-2024-3823

CVE-2024-3823 affects the WordPress plugin Base64 Encoder/Decoder (versions ≤ 0.9.2). The underlying issue is lack of CSRF protection when updating settings, combined with insufficient sanitization and escaping. This could allow a logged-in attacker to trigger a CSRF that enables Stored XSS paylo...

CVE-2024-3748

CVE-2024-3748 affects the SP Project & Document Manager WordPress plugin (versions ≤ 4.71). The issue is an IDOR in the upload function where an attacker can manipulate the user_id to make a file appear uploaded by another user, enabling potential unauthorized access or attribution. Connected sou...

CVE-2024-3630

CVE-2024-3630 concerns the HL Twitter WordPress plugin (versions up to 2014.1.18). It arises from insufficient sanitization and escaping of certain plugin settings, which could allow Stored XSS by high-privilege users (e.g., admins), even when unfiltered_html is disabled (such as in multisite set...

CVE-2024-3407

WP Prayer WordPress plugin versions 2.0.9 and earlier have CSRF protection gaps, allowing logged-in users to trigger unintended actions (e.g., arbitrary deletion) via CSRF. Patch/mitigation guidance in provided sources points to upgrading to a version that includes CSRF checks; no exact fixed ver...

CVE-2024-3548

CVE-2024-3548 affects the WordPress plugin “WP Shortcodes Plugin — Shortcodes Ultimate” (versions prior to 7.1.2). The issue is that a parameter is not properly sanitized/escaped before being echoed in the page, resulting in a Reflected Cross-Site Scripting vulnerability that could target high-pr...

CVE-2024-3406

CVE-2024-3406 affects WP Prayer WordPress plugin up to version 2.0.9 and older, lacking CSRF protection when updating email settings. This enables a logged-in admin to change settings via CSRF. CVSSv3.1 base score 8.8 (HIGH). Remediation noted across sources as updating to a version that adds a C...