CVE-2024-29998

CVE-2024-29998 is a Windows Mobile Broadband Driver Remote Code Execution vulnerability. The available documents confirm the affected product area (Windows Mobile Broadband Driver) and that exploitation could lead to code execution with high impact on confidentiality, integrity, and availability,...

CVE-2024-29997

CVE-2024-29997 concerns the Windows Mobile Broadband Driver and is characterized as a Remote Code Execution vulnerability. The primary details indicate an attacker with physical access can exploit the vulnerability with low exploit complexity and without user interaction to execute code, achievin...

CVE-2024-29996

CVE-2024-29996 affects the Windows Common Log File System Driver. The vulnerability is an Elevation of Privilege issue in CLFS, with a high base CVSS score (3.1, 7.8). It is exploitable locally, requires low privileges, and does not require user interaction. The impact is rated as high for confid...

CVE-2024-1630

CVE-2024-1630 describes a path traversal vulnerability in the getAllFolderContents() function of GE HealthCare’s Common Service Desktop, a component of GE HealthCare ultrasound devices. Affects the Common Service Desktop software; root cause is improper restriction of directory paths, enabling ac...

CVE-2024-1629

CVE-2024-1629 describes a path traversal vulnerability in the deleteFiles() function of GE HealthCare’s Common Service Desktop, part of GE HealthCare ultrasound devices. Technical details from connected sources identify the affected component as the Common Service Desktop within the device ecosys...

CVE-2023-36640

CVE-2023-36640 describes a use of externally-controlled format string in Fortinet FortiProxy and related Fortinet products, enabling an attacker to execute unauthorized code or commands via specially crafted commands. Affected software includes FortiProxy versions 7.2.0–7.2.4, 7.0.0–7.0.12, 2.0.0...

CVE-2024-31491

CVE-2024-31491 affects Fortinet FortiSandbox components (FortiSandbox 4.2.0–4.2.6 and 4.4.0–4.4.4). The issue stems from client-side enforcement of server-side security, enabling an attacker to execute unauthorized code or commands via HTTP requests. The connected sources specify the affected ver...

CVE-2023-24203

CVE-2023-24203 (XSS) affects SourceCodester Simple Customer Relationship Management System v1.0, specifically the get-quote.php handling of company and query parameters. The root cause is inadequate sanitization/encoding of user input, allowing stored XSS that can execute arbitrary JavaScript in ...

CVE-2024-1628

Technical details about CVE-2024-1628 are not publicly available in the provided connected documents. Monitor for updates from GE HealthCare advisories and security bulletins for affected products, versions, impact, and fixes.

CVE-2024-32355

CVE-2024-32355 affects TOTOLINK X5000R (firmware 9.1.0cu.2350_B20230313). The vulnerability is a command injection via the password parameter in the setSSServer function, enabling arbitrary command execution. Multiple sources describe the flaw and its origin in /cgi-bin/cstecgi.cgi handling; CVSS...

CVE-2024-34243

CVE-2024-34243 affects Konga v0.14.9 with Cross-Site Scripting (XSS) via the username parameter. The linked sources indicate the underlying issue is inadequate input validation on the username field, enabling injected scripts. The CVE is recorded with a CVSS v3.1 base score of 5.4 (Medium) and sh...

CVE-2024-34914

The CVE-2024-34914 issue affects php-censor, specifically version 2.1.4 (fixed in 2.1.5). The underlying problem is a weak hashing algorithm used to generate the remember_key, enabling brute-force attempts to access accounts that have the Remember Me option enabled. Public sources (Red Hat, Verac...

CVE-2024-1486

CVE-2024-1486 is a confirmed vulnerability in GE Healthcare ultrasound devices caused by a misconfigured access control list that enables elevation of privileges. The Red Hat/PT-security entries corroborate the flaw as an ACL misconfiguration that allows an attacker with local access to gain high...

CVE-2024-1598

Affected software: Phoenix SecureCore for Intel Gemini Lake (versions 4.1.0.1 up to 4.1.0.566). Root cause / issue: Potential buffer overflow in unsafe UEFI variable handling. Impact: Not explicitly quantified beyond the vulnerability description in cited sources. Mitigation / remediation: Update...

CVE-2024-34256

CVE-2024-34256 affects OFCMS V1.1.2 and is caused by SQL Injection via the new table function in OFCMS. Multiple sources (NVD, CVE listings, Red Hat, CNNVD, PT Security) consistently describe a high-severity issue with potential total impact if exploited, but exploitation details and confirmed at...

CVE-2024-34713

Summary : The vulnerability affects sshproxy, used to transparently proxy SSH connections through a gateway. Before version 1.6.3, any user authorized to connect to an SSH server via sshproxy could inject options into the ssh command executed by sshproxy; all versions are impacted. The issue is m...

CVE-2024-34712

Oceanic (NodeJS) vulnerability CVE-2024-34712 affects versions prior to 1.10.4. Input to functions like Client.rest.channels.removeBan is not URL-encoded, allowing crafted input such as ../../../channels/{id} to be normalized into /api/v10/channels/{id}, potentially causing unintended channel act...

CVE-2024-4871

Satellite (Foreman) remote execution vulnerability: when running a remote job, the host SSH key is not checked due to -o StrictHostKeyChecking=no, enabling potential MITM, DoS, and secret leakage. Affected: Red Hat Satellite/Foreman; root cause: SSH key verification disabled in remote execution w...

CVE-2024-34358

TYPO3 ShowImageController vulnerability: the frame parameter is not cryptographically HMAC-signed, allowing an attacker to trigger server-side generation of thumbnails and potentially exhaust resources. Affected are TYPO3 versions 9.0.0 up to, but not including, 9.5.48 ELTS; 10.4.45 ELTS; 11.5.37...

CVE-2024-34357

TYPO3 shows a cross-site scripting vulnerability in the ShowImageController (eID tx_cms_showpic ) caused by improper encoding of user-controlled values in file entities. The issue affects versions 9.0.0 up to but not including fixed releases: 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, a...