CVE-2024-27829

CVE-2024-27829 affects macOS Sonoma prior to 14.5. The issue is a memory handling defect that could cause an app to terminate unexpectedly or allow arbitrary code execution when processing a file. Apple fixed it in macOS Sonoma 14.5 with updated memory handling. In public disclosures, the CVE is ...

CVE-2024-27825

CVE-2024-27825 concerns a downgrade issue in Intel-based macOS, where an app may bypass certain Privacy preferences. It was mitigated by added code-signing restrictions and is fixed in macOS Sonoma 14.5. The vulnerability’s impact is privacy-related, enabling potential bypass of privacy controls ...

CVE-2024-31810

The CVE-2024-31810 entry affects TOTOLINK EX200 with version 4.0.3c.7646_B20201211, where a hardcoded root password exists in the file /etc/shadow.sample. This root-credential vulnerability enables high-privilege access and aligns with the documented CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I...

CVE-2024-28276

Sourcecodester School Task Manager 1.0 is affected by a Cross-Site Scripting (XSS) flaw exploitable via add-task.php?task_name=. The vulnerability is documented across multiple sources (NVD, Red Hat, CVE/CVEList, CVE enrichment feeds) with the same root cause: unsanitized input in the task_name p...

CVE-2024-34709

Directus before version 10.11.0 does not invalidate session tokens on logout. The directus_session cookie is destroyed, but if the cookie value is captured, it remains valid for the token’s full expiry (1 day by default), effectively making it a long-lived, unrevokable stateless token. The issue ...

CVE-2024-34708

Directus 10.x is affected by a Sensitive Information Disclosure vulnerability where a user with permission to view any collection can bypass redaction via the alias API parameter (alias[workaround]=redacted), exposing plaintext values of hashed fields. The root cause is improper handling of the a...

CVE-2024-35099

TOTOLINK LR350, version 9.3.5u.6698_B20230810, contains a stack overflow in the loginAuth function triggered by the password parameter. Root cause: improper input validation of the password in loginAuth leading to a stack overflow. Impact per sources: potential arbitrary code execution or unautho...

CVE-2024-34921

The CVE-2024-34921 entry applies to TOTOLINK X5000R firmware version 9.1.0cu.2350_B20230313, where a command injection is possible via the disconnectVPN function. Connected sources attribute the root cause to inadequate input sanitization (notably in the pid parameter of /cgi-bin/cstecgi.cgi), en...

CVE-2024-34231

CVE-2024-34231 affects Sourcecodester Laboratory Management System v1.0 with a cross-site scripting (XSS) flaw exploitable via a crafted payload in the System Short Name parameter. The issue enables attackers to execute arbitrary web scripts or HTML, with CVSSv3.1 base score 7.1 (HIGH) and user i...

CVE-2024-34230

Sourcecodester Laboratory Management System v1.0 is affected by a cross-site scripting (XSS) vulnerability in the System Information parameter. The root cause is improper handling/sanitization of user-supplied input, allowing attackers to inject arbitrary web scripts or HTML. Impact disclosed in ...

CVE-2024-25662

CVE-2024-25662 affects Oxygen XML Web Author (prior to v26.0.0) and Oxygen Content Fusion (prior to v6.1). The vulnerability is Cross‑Site Scripting (XSS) triggered by malicious URLs, as described in multiple sources (e.g., Oxygen advisory). The core issue is an XSS exposure in handling URLs with...

CVE-2024-28285

CVE-2024-28285 is a fault injection vulnerability in Crypto++ 8.9, affecting the SymmetricDecrypt function in cryptopp/elgamal.h. An attacker co-residing on the same system can disclose information and escalate privileges. Multiple feeds (openSUSE/SUSE advisories) describe a fix in libcryptopp/li...

CVE-2024-31771

TotalAV 6.0.740 is affected by an Insecure Permission vulnerability enabling local privilege escalation via crafting a file. The connected exploit documentation (GitHub) details a local attacker writing a DLL (via a junction trick to map a user-controlled path to C:\Windows\System32) and triggeri...

CVE-2024-34226

The CVE-2024-34226 issue affects SourceCodester Visitor Management System 1.0, specifically the /php-sqlite-vms/?page=manage_visitor&id=1 endpoint. A SQL injection in the id parameter enables attackers to execute arbitrary SQL commands, with potential data leakage or manipulation. Exploitation is...

CVE-2024-34222

CVE-2024-34222 affects Sourcecodester Human Resource Management System 1.0, where an SQL Injection flaw resides in the searccountry parameter. The vulnerability is described as a local, low-complexity issue with low confidentiality, integrity, and availability impact (CVSS 3.1: AV:L/AC:L/PR:N/UI:...

CVE-2024-34706

Valtimo exposes the user JWT in the x-jwt-token header to api.form.io due to a Form.io component misconfiguration. An attacker with network access to api.form.io and the Valtimo API, and who can read the token TTL (default 5 minutes), can access personal data or perform actions on behalf of the l...

CVE-2024-34698

FreeScout versions prior to 1.8.139 are affected by a Prototype Pollution flaw in the getQueryParam function in /public/js/main.js. The function recursively merges user-controllable properties, enabling an attacker to inject a proto key and nested properties, which pollute the target object’s pro...

CVE-2020-18305

Extreme Networks EXOS is affected by a Web GUI URL access restriction flaw in versions prior to 22.7 and prior to 30.2. The root cause is that the Web GUI does not correctly restrict URL access, enabling access to sensitive information and potential privilege escalation. Affected products: Extrem...

CVE-2024-31460

CVE-2024-31460 is a SQL injection in Cacti prior to 1.2.27, caused by unsafely concatenating SQL in automation_tree_rules.php data used by create_all_header_nodes. The vulnerability may enable modification of the Cacti database and, as described, could lead to arbitrary file reading and even remo...

CVE-2024-30268

CVE-2024-30268 affects the Cacti monitoring framework, specifically the 1.3.x DEV branch. The issue is a reflected cross-site scripting vulnerability in the display_settings flow that allows an attacker to obtain administrator and user cookies and impersonate login using those cookies. The root c...