CVE-2024-30259

CVE-2024-30259 affects eProsima Fast DDS (DDS) up to patch versions 2.14.1, 2.13.5, 2.10.4, and 2.6.8. A heap buffer overflow occurs on the subscriber when a publisher sends a malformed RTPS packet, potentially causing a remote crash and a denial of service. The issue is fixed in the cited patche...

CVE-2024-30258

Affected product: Fast-DDS (eProsima Fast DDS), a C++ implementation of the DDS standard. The issue occurs when a publisher sends a malformed RTPS packet, causing the subscriber to crash during pthread creation. This can remotely crash any Fast-DDS process, potentially enabling a denial-of-servic...

CVE-2024-4820

CVE-2024-4820 affects SourceCodester Online Computer and Laptop Store 1.0. The vulnerability resides in the file /classes/SystemSettings.php?f=update_settings, allowing unrestricted (remote) upload. This has been publicly disclosed and is classified as high severity by NVD/CNA sources, with pract...

CVE-2024-28866

CVE-2024-28866 (GoCD) affects GoCD versions 19.4.0–23.5.0 with a reflected XSS on the startup loading page via an inadequately validated redirect_to query parameter. An attacker could lure a user to open a crafted link during startup (when the server is starting but not fully started); the attack...

CVE-2024-4819

Campcodes Online Laundry Management System 1.0 contains an improper authorization vulnerability in an unknown function of admin_class.php. The issue arises from manipulating the argument type with the input 1, enabling a remote attack. Public disclosure of the exploit is noted in the sources. The...

CVE-2023-52656

CVE-2023-52656 is a Linux kernel issue where io_uring code related to SCM_RIGHTS was removed after dropping support for passing io_uring fds over SCM_RIGHTS. The vulnerability stems from dead code eliminated in the io_uring path, with advisories from Astra Linux and Nessus-based advisories descri...

CVE-2024-4825

Summary: CVE-2024-4825 affects Agentejo Cockpit CMS v0.5.5. A flaw in the POST /media/api endpoint allows arbitrary file uploads, enabling an attacker to store files on the server and potentially compromise the entire infrastructure. The issue is consistently described across multiple sources (Ve...

CVE-2024-4815

CVE-2024-4815 affects Ruijie RG-UAC prior to 20240507. The issue lies in the file path /view/bugSolve/viewData/detail.php, where manipulating the filename parameter enables OS command injection. Exploitation is possible remotely and the vulnerability has been disclosed publicly. Affected versions...

CVE-2024-4068

CVE-2024-4068 affects the NPM package braces. Versions prior to 3.0.3 fail to limit input length, causing a loop in lib/parse.js when given imbalanced braces, leading to memory exhaustion and potential crash of the host process. IBM/DB2-related bulletins confirm the brace-expansion issue as a vul...

CVE-2024-4747

CVE-2024-4747 affects Propovoice: All-in-One Client Management System (Propovoice CRM) for WordPress. Unauthenticated stored cross-site scripting vulnerability present in Propovoice CRM versions up to 1.7.6.2. A fix/patch has been issued (patched in the Wordfence entry); affected users should upd...

CVE-2024-35165

CVE-2024-35165 is a vulnerability in Gutenify that leads to Exposure of Sensitive Information to an Unauthorized Actor. According to the provided data, Gutenify versions up to 1.4.0 are affected, with the issue enabling information exposure via an API or similar surface. The description indicates...

CVE-2024-31377

CVE-2024-31377 concerns the WP Photo Album Plus plugin for WordPress, affecting WP Photo Album Plus versions from an unspecified inception up to 8.7.01.001. The description from the sources identifies an Unauthenticated Unrestricted Upload of File with Dangerous Type vulnerability, enabling arbit...

CVE-2024-34416

CVE-2024-34416 is an Unrestricted Upload of File with Dangerous Type vulnerability in the Pk Favicon Manager WordPress plugin (up to version 2.1). The issue enables uploading of dangerous files via the plugin, which, per the CVSS-derived metrics, could impact confidentiality, integrity, and avail...

CVE-2024-35172

CVE-2024-35172 describes a Server-Side Request Forgery (SSRF) in ShortPixel ShortPixel Adaptive Images for WordPress, affecting versions up to 3.8.3 (from n/a through 3.8.3). Connected sources confirm the vulnerability type, affected product (ShortPixel Adaptive Images), and root cause (SSRF), wi...

CVE-2024-34811

CVE-2024-34811 is an Improper Neutralization of Input During Web Page Generation (Stored XSS) in VeronaLabs WP SMS. Affected: WP SMS up to v6.5.1. Root cause: input is not properly sanitized during page generation. Impact: stored cross-site scripting vulnerability. Remediation: patched in public ...

CVE-2024-32700

CVE-2024-32700 – Kognetiks Chatbot for WordPress Unrestricted Upload of File with Dangerous Type in the Kognetiks Chatbot for WordPress plugin affects versions up to 2.0.0 and is unauthenticated. Documented by NVD/Red Hat and Wordfence as a critical issue: allows arbitrary file upload (dangerous ...

CVE-2023-43040

Summary: CVE-2023-43040 affects IBM Spectrum Fusion HCI (Ceph RGW) and Ceph RGW in IBM Storage Ceph, with versions 2.5.2–2.7.2 vulnerable to unauthorized actions in RGW due to improper bucket access. An unprivileged user can write to any bucket accessible by the signed key when a POST form-data b...

CVE-2024-29212

CVE-2024-29212 affects Veeam Service Provider Console (VSPC). Multiple connected sources confirm an unsafe deserialization in VSPC server communications between the management agent and components, enabling Remote Code Execution (RCE) under certain conditions. Affected versions are reportedly VSP...

CVE-2024-35205

The CVE-2024-35205 entry concerns WPS Office for Android (cn.wps.moffice_eng) before 17.0.0. The root cause is improper sanitization of filenames before external-application interactions, enabling a path traversal that could allow a crafted library file to overwrite a native library used by WPS O...

CVE-2024-4809

CVE-2024-4809 affects SourceCodester Open Source Clinic Management System v1.0. A vulnerability in setting.php allows manipulation of the logo parameter to trigger unrestricted file uploads. Exploitation is remote and the exploit has been publicly disclosed (VDB-263929). Several connected sources...