CVE-2024-4907

The CVE-2024-4907 vulnerability affects Campcodes Complete Web-Based School Management System 1.0. It resides in the file /view/show_student2.php and stems from manipulation of the grade parameter, enabling SQL injection. This was described as exploitable remotely and publicly disclosed, with evi...

CVE-2024-4906

CVE-2024-4906 affects Campcodes Complete Web-Based School Management System 1.0. A SQL injection vulnerability exists in the /view/show_student1.php file via the grade parameter, enabling remote exploitation. Exploit has been disclosed publicly; no remediation details are provided in the connecte...

CVE-2024-20383

Cisco Secure Email and Web Manager (Cisco AsyncOS) web-based management interface is affected by a stored XSS vulnerability due to insufficient input validation. An authenticated, remote attacker can lure a user to click a crafted link, potentially executing arbitrary script code in the interface...

CVE-2024-20257

Cisco AsyncOS Web-based management interface in Cisco Secure Email Gateway is affected by an XSS vulnerability due to insufficient input validation. An authenticated remote attacker could entice a user to click a crafted link, leading to arbitrary script execution within the interface or exposure...

CVE-2024-25743

A vulnerability in the Linux kernel (through version 6.9) allows an untrusted hypervisor to bypass security restrictions via improper input validation. By injecting specially crafted virtual interrupts 0 and 14 , an attacker can make arbitrary changes to the EAX register while an AMD SEV VM is ru...

CVE-2024-20369

CVE-2024-20369 affects Cisco Crosswork Network Services Orchestrator (NSO) Web UI. The issue is improper input validation of a parameter in an HTTP request, enabling an unauthenticated, remote attacker to persuade a user to click a crafted link and be redirected to a malicious website. Documented...

CVE-2024-20394

CVE-2024-20394 affects Cisco AppDynamics Network Visibility Agent. The vulnerability allows an unauthenticated, local attacker to trigger a DoS by sending an HTTP request to the targeted service, due to an inability to handle unexpected input. This can stop the Network Agent Service on the local ...

CVE-2024-4837

CVE-2024-4837 affects Progress Telerik Report Server (Progress) on IIS, with the 2024 Q1 release (10.0.24.305) or earlier vulnerable to a trust boundary violation that lets an unauthenticated attacker access restricted functionality. Connected sources identify the affected product, version range,...

CVE-2024-4357

Progress Telerik Report Server (versions 10.0.24.305 and earlier, i.e., 2024 Q1) suffers an XML External Entity Processing (XXE) information-disclosure vulnerability in the ValidateMetadaUri path. A low-privilege attacker could read system files; an authenticated context is required but may be by...

CVE-2024-4200

Progress Telerik Reporting (prior to 2024 Q2; 18.1.24.2.514) is affected by an insecure deserialization vulnerability that can lead to code execution by a local attacker. The issue affects the remote Windows host running the product, with the root cause being insecure deserialization in the appli...

CVE-2024-4202

CVE-2024-4202 affects Progress Telerik Reporting versions prior to 2024 Q2 (18.1.24.514). The vulnerability is described as an insecure instantiation vulnerability that enables code execution. The CVE details in the provided documents indicate high impact (confidentiality, integrity, and availabi...

CVE-2024-3485

The CVE-2024-3485 entry describes a Server-Side Request Forgery in OpenText iManager 3.2.6.0200. Affected software: OpenText iManager (version 3.2.6.0200). Issue: SSRF in the iManager component that could lead to disclosure of sensitive information. Documented exploit characteristics include CVSS...

CVE-2024-3484

CVE-2024-3484 affects OpenText iManager 3.2.6.0200 and is a path traversal vulnerability that can lead to privilege escalation or file disclosure. The available connected documents confirm the affected product and the underlying issue (path traversal) but do not provide concrete exploit details o...

CVE-2024-28042

CVE-2024-28042 relates to SUBNET PowerSYSTEM Center’s reliance on third‑party components. The vulnerability affects PowerSYSTEM Center prior to update 5.20.x.x, arising from untrusted third‑party libraries used by the product. Impact per CISA ICS advisory includes potential privilege escalation, ...

CVE-2024-3970

OpenText iManager 3.2.6.0200 is affected by a Server-Side Request Forgery vulnerability that could lead to sensitive information disclosure via directory traversal. The CVE-2024-3970 entry notes an exploitable condition with impact on confidentiality and requires no user interaction (CVSS v3.1: b...

CVE-2023-7258

CVE-2023-7258 describes a denial-of-service issue in the Gvisor Sandbox. A bug in the reference counting for mount point tracking could cause a panic, enabling a root user with mount-permission to terminate the sandbox. Affected component is the Gvisor Sandbox’s mount-tracking logic; root-privile...

CVE-2023-5937

CVE-2023-5937 affects Arc before version 1.6.0 on Windows, where configuration files are world-readable, enabling local information disclosure. Multiple sources describe this as a local-access risk that could exfiltrate sensitive data from Arc’s configuration files. The issue is linked to Arc’s W...

CVE-2024-25079

A memory corruption vulnerability exists in the HddPassword component of the Insyde InsydeH2O firmware. This flaw could allow an attacker to achieve privilege escalation within the SMM (System Management Mode) . The affected versions include kernels 5.2 (before 05.29.09), 5.3 (before 05.38.09), 5...

CVE-2024-27353

A memory corruption vulnerability exists in the SdHost and SdMmcDevice components of the Insyde InsydeH2O kernel. This flaw could allow an attacker to achieve privilege escalation in SMM (System Management Mode). Affected versions include kernel 5.2 before 05.29.09 , 5.3 before 05.38.09 , 5.4 bef...

CVE-2024-34955

Code-projects Budget Management 1.0 is vulnerable to SQL Injection due to improper neutralization of special elements used in an SQL command. The vulnerability is triggered via the delete parameter , which could allow an attacker to manipulate database queries. As a temporary workaround, it is re...